Overview

overview

10

Static

static

10

RevengeRAT.exe

windows7-x64

10

RevengeRAT.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2024, 02:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    RevengeRAT.exe

  • Size

    4.0MB

  • MD5

    1d9045870dbd31e2e399a4e8ecd9302f

  • SHA1

    7857c1ebfd1b37756d106027ed03121d8e7887cf

  • SHA256

    9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

  • SHA512

    9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

  • SSDEEP

    1536:SGZiTHzreu+4SHYEJicHHkxcPiwlJ6BjQaJ7ehgQpmnp3bDBq+AD3tSYxV:Z8AHxicHEuP5l/aJ7ehgiYDk9SYz

Score
10/10
revengeratguestdiscoverypersistencestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Revengerat family
    revengerat
  • RevengeRat Executable 1 IoCs
    stealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RevengeRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\RevengeRAT.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2452
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2764
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jj-g_vx4.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3020
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40C9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc40C8.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1652
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ur7nlavm.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4145.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4144.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1300
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ab19qvuw.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1688
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4193.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4192.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1664
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dwgbq8qf.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1144
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41D2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc41D1.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:768
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\koumvprv.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4220.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc421F.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2128
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xl2xmu3a.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1708
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES425E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc425D.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2264
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\akfve-ph.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2936
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES429D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc429C.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1608
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vgeswpaj.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1712
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42FA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc42F9.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:864
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0ui1zasx.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1732
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4339.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4338.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2304
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ndcurfgw.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2136
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4387.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4386.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2916
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7ckyv0z_.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2220
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES43D5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43D4.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1920
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6plbjbje.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2884
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4413.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4412.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1700
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\p6m-5mpp.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2736
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4451.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4450.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1056
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r931wwdz.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2696
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44AF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44AE.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2252
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\77ctb686.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2868
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44ED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc44EC.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2584
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nr2a5hwr.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2592
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES452C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc452B.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2552
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h6ythgih.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3060
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4599.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4588.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1476
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jpqnzzee.cmdline"
        3⤵
          PID:2064
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES45E7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc45D6.tmp"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1840
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ut67il26.cmdline"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1676
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4625.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4624.tmp"
            4⤵
              PID:2524
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xbadtmwx.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:664
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4673.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4672.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2292
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ac6ee9mo.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1444
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46B2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc46B1.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1904
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fslyspce.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:556
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc46EF.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2984
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tg-mozfj.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2996
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES472F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc472E.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2880
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5carbaep.cmdline"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2180
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES477D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc477C.tmp"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2060
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:964
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
              4⤵
              • Drops startup file
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1584
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2980
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:1856
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jmpa8wll.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1588
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF19F.tmp"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2056
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yuak9_zc.cmdline"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2636
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1DF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF1DE.tmp"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2080
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j4obstax.cmdline"
                5⤵
                  PID:2820
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF21D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF21C.tmp"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2668
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zcesfso9.cmdline"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1988
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF26B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF26A.tmp"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2384
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\njk4ofcs.cmdline"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3068
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF2A9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF2A8.tmp"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2540
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\c3pqwsqs.cmdline"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2608
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF2E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF2E7.tmp"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:1336
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rla6bwjs.cmdline"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1652
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF336.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF335.tmp"
                    6⤵
                      PID:672
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\57b_6auc.cmdline"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1684
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF384.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF383.tmp"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2828
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jmolbzhu.cmdline"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2084
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3C2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF3C1.tmp"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:736
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ts_tfogj.cmdline"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1812
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF401.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF400.tmp"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2732
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {AD0DEBD4-CB08-490F-B18D-BA889F12311D} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
            1⤵
              PID:2936

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\svchost\vcredist2010_x64.log-MSI_vc_red.msi.ico
              Filesize

              4KB

              MD5

              c398ae0c9782f218c0068cd155cb676c

              SHA1

              7c5bb00a34d55518a401cd3c60c8821ed58eb433

              SHA256

              9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3

              SHA512

              85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

              Download Submit

            • C:\ProgramData\svchost\vcredist2010_x64.log.ico
              Filesize

              4KB

              MD5

              cef770e695edef796b197ce9b5842167

              SHA1

              b0ef9613270fe46cd789134c332b622e1fbf505b

              SHA256

              a14f7534dcd9eac876831c5c1416cee3ab0f9027cf20185c1c9965df91dea063

              SHA512

              95c7392ffcf91eaa02c41c70a577f9f66aff4e6a83e4d0c80dbd3a2725f89f90de7ab6484497bf6e0a0802fd8ced042647b67c5ea4bee09e1b2be30b0db1f12f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\0ui1zasx.0.vb
              Filesize

              375B

              MD5

              085f35c737b484465e1799359126ee1c

              SHA1

              f51feaf15af726cb9cbc151cd86b9913e428abcb

              SHA256

              940fb15c66dc34a66b192569ec3588a11285af4f7230c27d54191dcff5dd5b1e

              SHA512

              8314ec82f79a6dbd1e946be25984635c149ef6689e33d8010680f5bdf3bc8803bc14d8dbaa92717fec261d7f27e8f87384478130c3fe5ee37f3ec84fa2bf1402

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\0ui1zasx.cmdline
              Filesize

              265B

              MD5

              eb66b2d6ba0091e6fb1ffb8335ccd72e

              SHA1

              54ad3f94f07182ac50ebffd906a630c1f3c11f9e

              SHA256

              b689fd683a68e001af74089b558b248fbd591789c4723205cc3e2ab59bdcc301

              SHA512

              65c04aaf18e9462006ccba18f896b847218a6d11006df8a36b8bdb4f38f07a2e90ef162526b1842030ffe81f7092c34f6705015105ef6a45cf9a34e989b57a66

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\6plbjbje.0.vb
              Filesize

              378B

              MD5

              b3f4020948b586a0f9b5942315ffdd2e

              SHA1

              bcea9b02c02f4019410a5fc2d6aaa1b8448993e7

              SHA256

              62c128f4f8749a44b0ad3bae5847c107154d0af80562dd4774b92eab801ee16a

              SHA512

              e75ffeab199cdb63a8be4ba2c2607d1616aea9edbb8a4a4632f3d36f13c6e8bbad4dc23992db5f5a6390df143028247bd5a5012394ba47248e084067f9a2ecb8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\6plbjbje.cmdline
              Filesize

              271B

              MD5

              0029689a647b3a2d73cd6a2948dbe088

              SHA1

              e941b4ed9c215337668160423357c9a5e3143d7c

              SHA256

              5019c2190b8f1a21990726d68ce410f5cc8de7ba88078a6a93f1fd7cde45ceba

              SHA512

              f33eafc950a201a1d7a284bd999a67e21de788787da01a8aafd4143ba9f0d88c3626ad7351b968e36d317e0e0819ac6871260ad32178e77b83381b476f9878bc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ckyv0z_.0.vb
              Filesize

              375B

              MD5

              61580d8eee92263741c70b5e756b3a1d

              SHA1

              cb09d0e8635efa1fee911b9ead83c6a298139f27

              SHA256

              1430de0fb4d00afcb7d7df9abd3d248df27101eed793251c8bccaa325a9b6f77

              SHA512

              b0aa8925e8016324ebad6a4307ea4c9b9a58ff564b718092080f966ac069eba387157da708303ce83b7b42b3ffe16efc4dba874e7b4563693195d6736de96d60

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ckyv0z_.cmdline
              Filesize

              265B

              MD5

              9ec88c92308fdab7a1cdea93368ab8c8

              SHA1

              cc5eac1bcbce19a061cc6a3fe9c8e2a9fae2c361

              SHA256

              2b49855ea37d2d600295e400112deb051d141e8ac54e078ce9730ac58932b4b8

              SHA512

              9a282554231dd130a2a1a8705d2b9d7f214b4916ea0ff91c87cc0f1ce680d93aa46d786fb6f2a74ef9dcb62e2e6c14d3e84dbd01fde7edaf8905fc856be76ce1

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES40C9.tmp
              Filesize

              5KB

              MD5

              86544172b42f6b491d0cfab990ed70d4

              SHA1

              0675daacd200c896faae876dc68035c9e8bf8501

              SHA256

              17242744425969490b16c93e51bf68150eefb889ae914baee24aa67afaa6afa2

              SHA512

              4bb6894749a73d19a2ee1c5dfbfed6f7692943c4db80556685423eb9af44ea7277e611bad2e293757dfb4c7a06f8706f8c42237bfb6cdcde6b226ac7e633d168

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES4145.tmp
              Filesize

              5KB

              MD5

              3a9d3d36c49d688782f9626c56b06a59

              SHA1

              98677b0b7d9ccf66f3a82bc93a832b3b4a10aa57

              SHA256

              766f79bbfcf911ead00b7aeb204558ddc5fdcd0f439d9ff70a1d5bee8a5e3e2f

              SHA512

              83b67dac6ea53cd840c6a2f1c8c4f1ac3b031871c0165667203da62533cb682050920b3402157f2e672efd0f3bdd53ae8355c55a83f93ef73d82675d1ca1a529

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES4193.tmp
              Filesize

              5KB

              MD5

              2b450d030d69aa77d362d3b52aa6c078

              SHA1

              0755e44bf25b53ae54ecf441774a0ec6ac82c0a4

              SHA256

              9fdca50102aa04c7e9bca8886b57ab93acda3d46999f4b9afee6fdc9614687d8

              SHA512

              4f0b1af2c62ba6feefac1f158d98f412bd8533a1cfda761421e417ef96c7251748607e1a10a05e1148407ec21718bac4bd7d0f3ef0a7b1e05c72496edf8bca35

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES41D2.tmp
              Filesize

              5KB

              MD5

              2077de3339df6c06c10862d35dc5bfe5

              SHA1

              c6874b543cc684af874ba1bcffce5e12664a9647

              SHA256

              11ddb95c403f43c34a749bf3ac0c34fac2c2eca41ec80df273e243d04fd503f1

              SHA512

              7fe7738bec6a9b50acfc9dd9e9bfbe93a2e750b3e056d0ad2a38269815c7ba420b9c6123070ccd1444536694ab13b626ad82bb37af1b6ddfa56294ab8d888fae

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES4220.tmp
              Filesize

              5KB

              MD5

              c1ff61e784cbc3b7460258b4799229c1

              SHA1

              6f1f85448844e2e38592aecb514421f711a1f928

              SHA256

              fbbc96a756a5a59cb23b45b31b8e3cbb52678d64b4952c61408adeac4ccca6fa

              SHA512

              f7cd201047bdfccf0062de3ec14543276e2d962e23b38d04759a7f5e25de1127907a060a70ad21cda070d3e4c51f7fcfcaec710250b53078b39493becf780538

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES425E.tmp
              Filesize

              5KB

              MD5

              b4dd0c7cf06a59cc76cb0d705a83d7d3

              SHA1

              e36640e815f157091e18038644b2632da94733ad

              SHA256

              efb580e04eaeb417629165f1c5b44c70901503726ea6a6067d1dea13682abfac

              SHA512

              3874686211101f45b3e6ad2c93033dbc00685e51cc9bbe81fd09f6a7e358eb15c61db709c9244a5182b67d4f5ed8f63dd42c5f4434cef23e6e6a84c3714593e3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES429D.tmp
              Filesize

              5KB

              MD5

              c265fc1072f45a876cae1ccdb81e1332

              SHA1

              c41aee87ab7308047f67aebe6ee431bcb7deda68

              SHA256

              fee8b2de15018dda098ad9ca6b1d4a01de17093caf2ad1e959ae259cc19b7ac4

              SHA512

              e58c62eb15eb97fd462fe4c820bb1ebf318e1f0543187227fdeec78d26682d69dfe1119d7d8c59a83011fe96104567a5932b2ae2d77333b06af6620349dd1519

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES42FA.tmp
              Filesize

              5KB

              MD5

              dc5e54d9b05193340c0e47d9a349c0d4

              SHA1

              72ab85601c866089bcd43463b429053dc957ef90

              SHA256

              c2ab1a2a23b0983cb809af524a2b4793dd5e26ba3cfcaf969aa8fc1294003456

              SHA512

              37f43c8ba92fcda84fd7a005c59a616d3f9b00c8b8cf7e49143d4f227b39e1219aa44df407ed5777fa14ce2c44f2ef8ded2363df105f4f05de9a4289257a451e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES4339.tmp
              Filesize

              5KB

              MD5

              960d0f3936094c166546bf6f1bb4e538

              SHA1

              e082cc0f0b99710eff7d3f0960a3f4edc571f3f1

              SHA256

              b73c9df122ed7f8feeee438ea57cae9465a8d2dd5802e8b1d22c3bf88beefe17

              SHA512

              41811bd15352e5173e656b5aa8ecbb87f44d6521a0cba83816f17d1cbc3b8f2abc37e14d66d60742d92bfcbc5237589a78e659c7300ff1ac50ceccca3b0d5da6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES4387.tmp
              Filesize

              5KB

              MD5

              66f8ee19fe596ae0b121fe79cea1aae0

              SHA1

              ea52a67230343624e4dec12933ecb338ffe2c891

              SHA256

              54c4474017e3129285821e1708f152238e5d9921134b2b4308ecdca88132dfa8

              SHA512

              f6d389641cde0654404a09ddaa959f81e5702e90346ac6acba8b69d3ef7ed9a48697922576e6251aa90d73a2a55e0f2b23cdfc08e0be49a8456a755e5e67b4e5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES43D5.tmp
              Filesize

              5KB

              MD5

              9d551f27c603aafd64814a63b1d753fe

              SHA1

              814110c9d3e5f14819479e063e282cec8da0be00

              SHA256

              bfe33106bf58181466ba3b90cd4d34b6b01f2f9436015a99a4fee7307587594d

              SHA512

              7924cc01424289e4ed41d7e9baa72765c60df5dcb42a3a53d719727449b8cf781e40a8e03e9d22037b61f0e22830d56e2aee987f5f08e7e7a1a6f104c0e4fc72

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RES4413.tmp
              Filesize

              5KB

              MD5

              c5b6439f7e2d28a2bc28aa05264063cd

              SHA1

              5cc4f7ff6cf957a969edd5888583318224a6dd47

              SHA256

              b17df2301d624ccbafc462a3e2bab9b09cef461ba16c49fb1ea2dcd1c46e59c2

              SHA512

              e3a92918e1605d8da24363bb8432cf5f33dcd06914fba1f399d736c354a41d618fab9207009d55278c43886fb8c24c043b0e7faf09b899b3ed3ad824689b5f02

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ab19qvuw.0.vb
              Filesize

              369B

              MD5

              83f6067bca9ba771f1e1b22f3ad09be3

              SHA1

              f9144948829a08e507b26084b1d1b83acef1baca

              SHA256

              098cd6d0243a78a14ce3b52628b309b3a6ac6176e185baf6173e8083182d2231

              SHA512

              b93883c7018fdd015b2ef2e0f4f15184f2954c522fd818e4d8680c06063e018c6c2c7ae9d738b462268b0a4a0fe3e8418db49942105534361429aa431fb9db19

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ab19qvuw.cmdline
              Filesize

              253B

              MD5

              c9ae593c7df6c21edea486722e98182f

              SHA1

              d5a3f705902b0e4a2e1a7a52c0eeb8c620716f78

              SHA256

              f36cc40ada7e300e599f1d74b78d7ab2787a62b4fe6c45106e933854d3faba4f

              SHA512

              729573c0f467633449dd84d0523eee27007148888f2b73d942a993a2d960cb386d1d60ecd854ec321f8797d96a50dfb103df51efc4b664bee4ae47e3b672cc12

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\akfve-ph.0.vb
              Filesize

              373B

              MD5

              7d0d85a69a8fba72e1185ca194515983

              SHA1

              8bd465fb970b785aa87d7edfa11dbff92c1b4af6

              SHA256

              9f78b435099106c2c3486c5db352f7d126b3532c1b4e8fe34ef8931c7b8968d5

              SHA512

              e5ef339dc329dbba2ab06678a9e504aa594d2f21ade45e49bccd83a44a76dc657f5f44dcf368f4d112bb3b01af2e577a487c6078751943770e90780fad202989

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\akfve-ph.cmdline
              Filesize

              261B

              MD5

              d923ac6a7a5764fd4d634a257d14564f

              SHA1

              0f7bbf063238a35bf1f0a072959ea0192f962be0

              SHA256

              508fcdad657abb5f82c7d918f95476684ca73c903c117d39f8afc7748eba3868

              SHA512

              03bc70028eee83a69a387da7cf51248cf2392ee30fcb7d4fd36ced62067805e6d5b39ffa5dfb98a6577dca681e79b7af980cdd317eec8cd9cc47aa2a32df3024

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\dwgbq8qf.0.vb
              Filesize

              355B

              MD5

              6e4e3d5b787235312c1ab5e76bb0ac1d

              SHA1

              8e2a217780d163865e3c02c7e52c10884d54acb6

              SHA256

              aec61d3fe3554246ea43bd9b993617dd6013ad0d1bc93d52ac0a77410996e706

              SHA512

              b2b69516073f374a6554483f5688dcdb5c95888374fb628f11a42902b15794f5fa792cf4794eae3109f79a7454b41b9be78296c034dd881c26437f081b4eaea8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\dwgbq8qf.cmdline
              Filesize

              224B

              MD5

              7ced0eab4b57a21a06c841943d433be7

              SHA1

              a0077faf7520f308ab744042ca466c0237611f67

              SHA256

              a50ad055a3eca77578cd023183ded4e255d3e88479e45c399fcf48361127f8af

              SHA512

              99d927209a13dea4b190b3a038f40771cade5a6a100112cbfd83f90e2762afb4e2cb459828da80ec1f61321b71e587102a31f8ee17231e60051af10522f4bd2e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\jj-g_vx4.0.vb
              Filesize

              369B

              MD5

              e4a08a8771d09ebc9b6f8c2579f79e49

              SHA1

              e9fcba487e1a511f4a3650ab5581911b5e88395d

              SHA256

              ef4c31d167a9ab650ace2442feeec1bf247e7c9813b86fbea973d2642fac1fb6

              SHA512

              48135e0de7b1a95d254ae351ccac0cb39c0d9a46c294507e4bf2b582c780c1b537487161396dd69584c23455950f88512e9931dbff4287c1072938e812a34dd1

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\jj-g_vx4.cmdline
              Filesize

              253B

              MD5

              8bcebeec53017a55277c1d50bc652fbc

              SHA1

              a0e939c3277d3433e8bdca98eb67e4dbc142b9cd

              SHA256

              a0dfa880e9c25480e674755ba460ea4a9dedc5d2b9bf05727a6cb3bbf64c2e29

              SHA512

              49eaeba54c98556e3d5ce558bb790852982692fcf2757e23878187e1e039aadde40588b2bfff0585db9ba2e2ac4013e344f9c859fb37cf30ae2962808433bead

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\koumvprv.0.vb
              Filesize

              373B

              MD5

              197e7c770644a06b96c5d42ef659a965

              SHA1

              d02ffdfa2e12beff7c2c135a205bbe8164f8f4bc

              SHA256

              786a6fe1496a869b84e9d314cd9ca00d68a1b6b217553eff1e94c93aa6bc3552

              SHA512

              7848cdc1d0ec0ca3ec35e341954c5ca1a01e32e92f800409e894fd2141a9304a963ada6a1095a27cc8d05417cd9c9f8c97aed3e97b64819db5dd35898acac3b7

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\koumvprv.cmdline
              Filesize

              261B

              MD5

              addda8a226228e510f5c090457c755d0

              SHA1

              06f2fde5eba15de4b85294b63b44dcaf04181d71

              SHA256

              96b5c58aca0e228ea55d2cff57b61fad22d5f8f4d9c5aa6e407b30883a5e4413

              SHA512

              8daf0f2a61364839daa43701c81042a42aab9c527a42f37790027bfb7679bf176daafa52fd64f57b3abdd608802b72dae8d3b6ea1d2c16353e83b224bc5a9948

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ndcurfgw.0.vb
              Filesize

              378B

              MD5

              a52a457213a9d0522f73418af956a9ef

              SHA1

              cd46e651cb71f2b3736108d58bd86c7cf3794ecc

              SHA256

              be60d63078e797b8b46dc31f978e20e9819ef09b6fd3d5869934ace0530f23f7

              SHA512

              9d3458eefcd36539d4e97ed847f06faf96e0a8445e1d352d6a77506a042f513fb39523f90eff3aa1ef06afb000371e94d1968bc61d28bfb00f2a8cbbcc2eb3c2

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ndcurfgw.cmdline
              Filesize

              271B

              MD5

              3e0929c98a89aeb4f66e944e68023241

              SHA1

              d307a852d64754a9aed0bfbdfcc6b2ddc0f793ce

              SHA256

              0e66680b5a904837bd55fefc23f7085748e048246db978ef5efa3d54a2f8f062

              SHA512

              691254b0119300d7364c464e5d4bed93f2c7f3b6cb0dfbf54ac349a09426ac829ffe937bc8ba64572cadcb19b8fd870bb8e7a1ff1e92ef7d6ea224a6d9870afa

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\p6m-5mpp.0.vb
              Filesize

              375B

              MD5

              7114e7bf3cad956caa61ac834cbf7a90

              SHA1

              9e245814174794c08bcd49d3c1cbbeee528fbdfb

              SHA256

              be2de05d5378b8c7617e9818cf1c992a9148959e0bc3ee18ec98500c7acf3c25

              SHA512

              2a3a229bf576a520634670715921ee021b13a726cde40d13fe17129471c9d44e092df505c11d3c396df2c69c6651be619b92bb14251d7f37275a840a391bcd0a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\p6m-5mpp.cmdline
              Filesize

              265B

              MD5

              c3d0876b5d06b730932de66fd208e482

              SHA1

              2373f19f5f7e0eb50c085766c8e5dd872f31a55c

              SHA256

              505698c2cdbf63a95ad492974162abef0c407dbbbb5dfa8864610fbcd040ac86

              SHA512

              0473a81a77be8934ac7ca41f490a3686c8cf4436348190f9bf36d39e6c6864fbd1db0060c7e33c7e3dd7fd56fb1564ccc5b6f9f51cf59551e1e3962942815898

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt
              Filesize

              48B

              MD5

              927d973950bd5fed1c49b57432117d5f

              SHA1

              197a5267707a8b6503728c11aced2c44a1e952c4

              SHA256

              30e4bfd472dfe004fdbc162f8ed3989a20bb39b7a8aa436b88b69817960efb00

              SHA512

              3504742d0a960dfe9211eb971a2464dd49fe2e140bf32bd375fb5fcb277ee97766cf5c7a2ab31382fc49bce7118ab63f30006b92a23eba18dfe138f3f03f90d0

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ur7nlavm.0.vb
              Filesize

              355B

              MD5

              acd609faf5d65b35619397dc8a3bc721

              SHA1

              ba681e91613d275de4b51317a83e19de2dbf1399

              SHA256

              4cfd86d51d0133dda53ba74f67ffe1833b4c0e9aae57afe2405f181fc602f518

              SHA512

              400ffd60ce7201d65e685734cea47a96abca58ca2babda8654b1d25f82d2766ca862a34f46c827249a4dc191d48f56005a9f242765d7becdda1344b8741a9d8c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ur7nlavm.cmdline
              Filesize

              224B

              MD5

              fcb3f4afc7e12216d436a76b8da10f40

              SHA1

              75a96985ae5c6e6a5d64a909404aab15e2a70294

              SHA256

              7143483826e81a34496bceba82042d2e87a25b17e7c0cb8878d850358a000ac6

              SHA512

              25e50d581b8f694d228d28236972cf2b2fd4d224fcd3a37a9ddc8fe13fe0f8c476809c097ad4a7f5a322868419b2b8dcbc6c90663a872512b4a8f101588406ea

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc40C8.tmp
              Filesize

              5KB

              MD5

              955c29e6642db6b23d9ca8d18903794f

              SHA1

              2a12553a01cafeaf83d2f52febb424af00e649bd

              SHA256

              6839c94e5031c8646f5d3db534b41c09076e93cae238d1337aa8a1d41ad741f5

              SHA512

              30eaed32fb99fa62ef8883c4b6e34678175cf8ce24a953d80e43ef67a68f79e9a59996ea3cb4465c6f6d6e0b03a0fab1b241c1d21430bedc49e3e757293fe296

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc4144.tmp
              Filesize

              5KB

              MD5

              d7d67a3915a3aae053cb2867a77fd9fc

              SHA1

              829757b4c84456ea3771deb6988e77bfc3ad117c

              SHA256

              d1d578383b3b0b42856bef5deb0fc8cd2406e1f9bc8f6818b2c719a66e6d8093

              SHA512

              bb877e96798c34921c613aaa44e424593a791f450a10e254e5a643ec774d527178c7b36bf91cf683e712d893e8e321c8ecafc6a2521f148200f769c9ce2d78be

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc4192.tmp
              Filesize

              5KB

              MD5

              666d582d0f49759982ad0b7cea623a35

              SHA1

              54f28f61b9f4ae52dcce4ee9eb8ac0b8d7809ba8

              SHA256

              b890a7bcccc09c2d2577b944bb32e3419d70458e5ecd02f2f846325b86bef862

              SHA512

              29d157e897c2e0547cf105ebee1dca1eabf410ef364fb807055e2dfc79bae4be60ae2d8f012ca02eb37696b335fa0eaffafa1db7a032b80945fcabf954b18d00

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc41D1.tmp
              Filesize

              5KB

              MD5

              1efc3dabeb7009b6007394dd082dfd86

              SHA1

              a410d235b0cf2733a2ebccc1215dc6d0302a2540

              SHA256

              6185bd2851899871047c82a55a8019a7f3435270e8e93bc06aa3dc757ff55846

              SHA512

              25cf1e8e4a81fc324e1b0324c41f67381ca47760a9cd64b52111286f4ce2b02228db5c5e948586201628ba0a6b8fc73597b216ecfe3b74f072c3ba9c0e7e3bdf

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc421F.tmp
              Filesize

              5KB

              MD5

              a4da846ea032d0e25d23ca969a569fe4

              SHA1

              facf679f92a929a6fd914bb43f7b52e6536b6802

              SHA256

              329ca0161ca179613635d25604e61a249ba4f1b762f5672bfe27c3bb9a7f47d3

              SHA512

              3255e2339afa13b7e0f1d74572712bcb87ee7366859b3161bf2570b57a9738c1d195a14a7f784849e1ce2233f31b048c393c07f854c0a7a9fb037693d941f8ec

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc425D.tmp
              Filesize

              5KB

              MD5

              f039d48c1767e0e4303ba43ffe355c97

              SHA1

              2e92eb77d16962623212f004480717303db5101e

              SHA256

              e78a94663d6c227a309e24b0952ee7ec52c49fe817a02f29516b36d24d465acb

              SHA512

              4a5e0e693827cbf1a742f71e8b6395382cdfee797ee1e8b0b3fb9e4132e593da9cc532a5cb0b2e9d660d2eefc29f6b0bba849792a6385100348d18cda0950ec3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc429C.tmp
              Filesize

              5KB

              MD5

              abeeccd127afe60188318600ec0e2795

              SHA1

              adc607f07fc09053d796abf25095c76b361436f2

              SHA256

              d1df4661c37810b6e6d906cad05c9e45c42a080f2b832e56c9e08316a35f6792

              SHA512

              7a6ff2db0e83b9b6d24210fb9a44ea3e0345221f656f46290841bf352edac16dc5a4cb4e8a914ef60c6ca507e6bd5eb1e169ea187feedb7b3050022567dc0ab5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc42F9.tmp
              Filesize

              5KB

              MD5

              55e078852806b5d83533794483a09a7b

              SHA1

              ed79aa8f044b59bdef3c7091acab59f92543227c

              SHA256

              be654a24194cd1ffca4dd20466530905c4f208bbfe0f464746d6784bb56e60fe

              SHA512

              632b637781498756bbffa5b267d80ed155f6b89a2842a9691f7cf302ec8ddc1b360d1f4202661b666fd01a1335c6d0ef2f2c69a10c5ff15f086156f2eb031068

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc4338.tmp
              Filesize

              5KB

              MD5

              4a95cbe7406a930bc0b431ccf5ec97a2

              SHA1

              1ef8622262c9d6c829affd42877361fec2ac105c

              SHA256

              61d27f9f3053d3366d2ea7234418be37478f0c1773d7d622f2b9c7e0c39f07a3

              SHA512

              b83016a32a253624ee336c74cfd1265f4bd5c95fa7667d776e236783a537215440b4d2a5f7ba6f9421a756ce11b22c3584544d3f9c5d9c4b0a7e12a5fc09da14

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc4386.tmp
              Filesize

              5KB

              MD5

              0b29c6dc82961bb1ba502861a41b0a9f

              SHA1

              0491d8095d42138c473b92f400b6138662cdd8ef

              SHA256

              3152b3a5164b8f7ced037e4dce64e877bd6054d4d39caa0547c318ccd25d15f7

              SHA512

              1b4b429c2f60dd47f37bbdb40c19bcddb1b2c0c708b458c11969c89bb5f94db82dab6dad7ccc9c2112c50c0c584de93924a4be242a9738d6ccc36e6dd7ca55fb

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc43D4.tmp
              Filesize

              5KB

              MD5

              5b433d6e19bfb6046ea8babe98b38fef

              SHA1

              f7c31647ca9efd914a1bd005664f6216fc412c86

              SHA256

              71c163391ea0a47c536db329b28344f6b99f06c45d0d5d9a898b0c024d961cec

              SHA512

              f42496445d976b4d09942f2cd7cf60fa0abac253601a956eef473a0a8e632ad2552926a0c55edf6ca87e3e50e48d0833fe86143158bb413068206ad667fbbfd8

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbc4412.tmp
              Filesize

              5KB

              MD5

              556ae762417965d4e6362dac7f6d00d1

              SHA1

              de59a1bd1e1cf8f213975e5fcd03cc1a74e25750

              SHA256

              92c67382383e236fcac528c6389533787a5d85f08cb4919f403e057773371d72

              SHA512

              c3b9590200285371334617feafd9aecf0b374fae08237fc31ce5e03655ad371af2c944b888f3f317906b246d81bc11561c48c5f5c3c7f487a6f503bfd286018b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vbcF2A8.tmp
              Filesize

              668B

              MD5

              3906bddee0286f09007add3cffcaa5d5

              SHA1

              0e7ec4da19db060ab3c90b19070d39699561aae2

              SHA256

              0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

              SHA512

              0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vgeswpaj.0.vb
              Filesize

              376B

              MD5

              688ef599a13c30230d9c00287511e084

              SHA1

              496834103ac52660dd8554590a2f92cbda8ab759

              SHA256

              9ce0d8e22177e91d78bf3e578b8b5f0d22d724ae17931195de2e3b5b46255051

              SHA512

              0f244536f83308c7db23337dadcef882fd258954d7e3c8a5f3f66ee0861fec0cd6ea7b3310db65a306de380da410af1e8e4041fabbc917b6af4b94d9424cec8b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\vgeswpaj.cmdline
              Filesize

              267B

              MD5

              20999334f0f571a4726f3992a0fd3631

              SHA1

              cae3f75223f48277fad01361720c442cb723fd0e

              SHA256

              9cfcd02ff68dd18f75e8b285da052f313ceeac14ab0c8f123d686f810dbb1b60

              SHA512

              458f827c10151cae8e97b182d2f426ec1f1f754d10077aa962fc0fb3fca005cb6ca2e80a4da9916decd0a3e5af88b0938840cf4f56f636ef50e95849ad096d1f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\xl2xmu3a.0.vb
              Filesize

              376B

              MD5

              7a8e43324d0d14c80d818be37719450f

              SHA1

              d138761c6b166675a769e5ebfec973435a58b0f4

              SHA256

              733f757dc634e79bdc948df6eff73581f4f69dd38a8f9fafae1a628180bf8909

              SHA512

              7a84dbe0f6eebdc77fd14dd514ed83fb9f4b9a53b2db57d6d07c5ff45c421eac15fdc5e71c3bc9b5b5b7c39341d8e3157a481d9dacefe9faff092478a0cea715

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\xl2xmu3a.cmdline
              Filesize

              267B

              MD5

              156bfd12a3c891e099ebf592a10ea416

              SHA1

              1d7ecdbff97247b571e6ee886f2e1c3f34c4c8ef

              SHA256

              c1df073e842cdde357043b6299d0b7dfdf42e2c72bf63d4490ccac9ec2748be3

              SHA512

              3f3520e9d7eff97ac252910b6432e5b13caaec8736b9f966acb594777ceddc3d76dbddb6d3bd66643cf22aa5bdbcf0e5d59941df48b098255e2f2ce01d7eb3ec

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
              Filesize

              4.0MB

              MD5

              1d9045870dbd31e2e399a4e8ecd9302f

              SHA1

              7857c1ebfd1b37756d106027ed03121d8e7887cf

              SHA256

              9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

              SHA512

              9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

              Download Submit

            • memory/2452-6-0x0000000000090000-0x00000000000B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2452-42-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2452-19-0x0000000074171000-0x0000000074172000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2452-21-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2452-354-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2452-12-0x0000000000090000-0x00000000000B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2452-351-0x0000000070810000-0x0000000070C1B000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2452-15-0x0000000000090000-0x00000000000B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2452-17-0x0000000000090000-0x00000000000B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2452-4-0x0000000000090000-0x00000000000B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2452-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2452-343-0x0000000070810000-0x0000000070C1B000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2452-345-0x000000006FB90000-0x00000000703F4000-memory.dmp

              Filesize

              8.4MB

              Download

            • memory/2452-344-0x0000000070400000-0x000000007080F000-memory.dmp

              Filesize

              4.1MB

              Download

            • memory/2452-11-0x0000000000090000-0x00000000000B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2452-20-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2452-7-0x0000000000090000-0x00000000000B0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/2460-2-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

              Filesize

              9.6MB

              Download

            • memory/2460-18-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

              Filesize

              9.6MB

              Download

            • memory/2460-0-0x000007FEF545E000-0x000007FEF545F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2460-3-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

              Filesize

              9.6MB

              Download

            • memory/2764-40-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2764-35-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2764-38-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2764-39-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/2764-37-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2764-24-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2764-26-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2764-32-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2764-28-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2764-22-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2764-41-0x0000000074170000-0x000000007471B000-memory.dmp

              Filesize

              5.7MB

              Download