Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 05:31

General

  • Target

    REVENGE-RAT.js

  • Size

    1.2MB

  • MD5

    8ff99e0a81c684cefbc2a752c44f30a1

  • SHA1

    61b8dbc7483abcb72d2c633e6309feb26ac16eb0

  • SHA256

    4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e

  • SHA512

    7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364

  • SSDEEP

    24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

C2

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:6128
    • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
      "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5184
      • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
        "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\Documents\foldani.exe
          "C:\Users\Admin\Documents\foldani.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:732
          • C:\Users\Admin\Documents\foldani.exe
            "C:\Users\Admin\Documents\foldani.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2264
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-iyx-k-1.cmdline"
              6⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3524
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE1A1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1405367BD6E14DE99936F3992B77977D.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5396
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2548
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lm81s98h.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:536
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE29B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc910339FE1E1B4FE3952C7277236B8A1.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3476
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hmr7alc7.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3912
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE337.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1C5747989BDC4D868459A4A58951FE5F.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1052
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1ed4yanu.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5308
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE402.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCAB0D0FBB0DC433ABFF21342FB68EE1B.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1596
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uolihs-i.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2224
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE4DD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc625CD21B879F45B0A9E9CBE2FBEB7B4F.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3244
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sora8d0b.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1872
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE606.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9404EDDBCD864D72A0D9A05DBCD9FF8.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1404
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\liz_1yq8.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:956
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6B2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAB20DDEEC9854655B5C76F92EDE55D90.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5812
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ximid_hz.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3000
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE72F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6C94AE0AA81C435B93F7ED3FC280B9DA.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5068
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_ykfhwb5.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1212
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE7CB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4730A472E7FC44329A80C23BA0302991.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4296
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ykqgkutp.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1468
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE848.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC8EED48FA15947869CECE023E1FEFAA1.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4372
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\Documents\foldani.exe
      C:\Users\Admin\Documents\foldani.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:4288
      • C:\Users\Admin\Documents\foldani.exe
        "C:\Users\Admin\Documents\foldani.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:992

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log

          Filesize

          496B

          MD5

          cb76b18ebed3a9f05a14aed43d35fba6

          SHA1

          836a4b4e351846fca08b84149cb734cb59b8c0d6

          SHA256

          8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

          SHA512

          7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

        • C:\Users\Admin\AppData\Local\Temp\-iyx-k-1.0.vb

          Filesize

          145B

          MD5

          61413d4417a1d9d90bb2796d38b37e96

          SHA1

          719fcd1e9c0c30c9c940b38890805d7a89fd0fe5

          SHA256

          24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7

          SHA512

          9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4

        • C:\Users\Admin\AppData\Local\Temp\-iyx-k-1.cmdline

          Filesize

          195B

          MD5

          705b4cccf604e674eaa39962671ee9e2

          SHA1

          37126f13e8687e131f77f4aae68e8cebaeb7e6b2

          SHA256

          fca34e82183fdc6c926e291100304f5a672da4d2f7a90ff58abebcf6a0366f92

          SHA512

          a12b76e1e09093a52715572408a02f2f54ddd0e29b76501defc0e2b3fca124586c52b404d4c0b869f9594feee2e234bf537fd84f9c7bf2ac1fcb9edec3f1dde9

        • C:\Users\Admin\AppData\Local\Temp\1ed4yanu.0.vb

          Filesize

          284B

          MD5

          6989ad9512c924a0d9771ce7e3360199

          SHA1

          1bcc5312adf332719db83156f493ad365f5bdec6

          SHA256

          f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168

          SHA512

          13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536

        • C:\Users\Admin\AppData\Local\Temp\1ed4yanu.cmdline

          Filesize

          177B

          MD5

          1753d089a1bc302d5ff77f5be7215c54

          SHA1

          6968c4139d2997f653782dbbabdf33d6b24c17cd

          SHA256

          074182d7f62ccb5a7cadd9ce5f58013b78143de0646a929cd2643e8c4b2f5a2b

          SHA512

          1e8b186d697d4412d0a3ed7e1632dc4134aae749b770de1b12e3a8e517adb660ebdfcf380e0da4900fec9aa8794ce6ce08b057930b0ba853f07a24036c437ca8

        • C:\Users\Admin\AppData\Local\Temp\RESE1A1.tmp

          Filesize

          1KB

          MD5

          ad9f1ed44e3d3007bfcc55cd8449323b

          SHA1

          a0c1a919596a3c4e344267216045fdf10e1fc1b4

          SHA256

          6d071fe20f1f3272e1871b001af4468a38f6367c9688b224f74d5dd5e50e7582

          SHA512

          da22796fd4e336c50c1b0a09c82a56811f3f0c6734107f7d12019229d34c1f7347c8233ab9b2bb95e96ee4ad6555f19e434f4fa9d5a6f82740193f65f563c6f5

        • C:\Users\Admin\AppData\Local\Temp\RESE29B.tmp

          Filesize

          1KB

          MD5

          766eca56b80c7cc881aab2ca07788030

          SHA1

          0228964deae2d816a855245cdef96dae57f6b0b9

          SHA256

          4ec8ddbd23625b8d8820aa2770a045b379f286af508c3847773b2ffdd0dcc1ca

          SHA512

          9a78a59ac9e6a584b8cc017fa04fa46446852cfb8ff4b1bfcb2721b8d53b92af8a886937086d3784447a09fb9e6f8352153aa67d930f96db879136abc33a892e

        • C:\Users\Admin\AppData\Local\Temp\RESE337.tmp

          Filesize

          1KB

          MD5

          fde3d5c4d5b21911a72d6e14220f69bf

          SHA1

          a10d19a260765b28ce39e4624d73061a9e71e582

          SHA256

          74ab2c75af6a986ec724b257d229b4a888a172b38561ce4f2bf694871d7cdb46

          SHA512

          f5cef8db7923fd48b9f36f834eb7e23376ff0935789cdb20a4d6bf003f573ee26b0532c04f8c9636d65a01ad1b440b1c031bce9f27d0e902cc97bb1d81bc989d

        • C:\Users\Admin\AppData\Local\Temp\RESE402.tmp

          Filesize

          1KB

          MD5

          ea37b523365fb56b1dd3871e20dff900

          SHA1

          8cd969d845fe19ab7b56d79fdab7258153898648

          SHA256

          ef956908ced04b0ef31d5c14ffc009932cb443df9d9094c790af5e080bb31bc2

          SHA512

          bb59c36788a990c81d488edc1947cbdf06e4b06f909197097822dd05e460499e7987b3d55642b5bb0569004fbe29d9dac1bcf617559134c1b6bc5752702d9378

        • C:\Users\Admin\AppData\Local\Temp\RESE4DD.tmp

          Filesize

          1KB

          MD5

          707bbdf75ecd9ed28cbc9db01794541e

          SHA1

          8c332c4c43130e548c7471543476383633fe4222

          SHA256

          4402d8c41602edf9d721fde8495b9534b2f80b57d0a293423c57f031e991dbfc

          SHA512

          ca2429b15512d84f417c00f5df28f994dd7135c0d5192e2f741afce193d917bae935f9740dca1b3f2bbacd9532b88f6eb0f011885b43261526ad8a560fb668f5

        • C:\Users\Admin\AppData\Local\Temp\RESE606.tmp

          Filesize

          1KB

          MD5

          d6bf050a7671cfc960dacba929c68b2d

          SHA1

          e130ca73b9b01ce2853ac75ef6f0eeb7dc5a577d

          SHA256

          c51ca512587e41ece60e8886e4ce79b9749f24578dbcd126cf546cf9f7cbfcde

          SHA512

          5b27548e1d35bbd2ebc5f6bc4f37150630f0cd0f2d178131ceead3b6337c3bbbd752c6c806f9e271e66b115e3da0d73c7b2bd49f2f0c7c91f303e654e38b7bcb

        • C:\Users\Admin\AppData\Local\Temp\RESE6B2.tmp

          Filesize

          1KB

          MD5

          3dfe1afecd5c97c4a4eb71c193feaf97

          SHA1

          bf49a871e66ea4528b686c6d2c8a187466b2d244

          SHA256

          b0c10d7557492e3564687970e623a1166c004a4ec9101c36c16479132b07e83c

          SHA512

          3fe9495697d62de93ebfedfe1f53e63fc80c17c67f6ce265b999f6ec18ab54497f0b75e9bebc417239fcb072f110c66d889da7487bc1bb860a8a61b1ec067680

        • C:\Users\Admin\AppData\Local\Temp\RESE72F.tmp

          Filesize

          1KB

          MD5

          709b773926351c390c7ece090769be7a

          SHA1

          9779eb43383c82baa6a6726129895006e173d68f

          SHA256

          96577b4b012bfd78df61e29b19ff9df80d6c23f23b2864add1c0db33da67288b

          SHA512

          5dd7c757cdaf49791114c0de17e772ed0421986a3500fee7cf2e4583219312c40786cbe92c618bef2b228d252490809b7621fa20c647dc3dccd3c66d5ab14e1c

        • C:\Users\Admin\AppData\Local\Temp\RESE7CB.tmp

          Filesize

          1KB

          MD5

          aabab4370d03e4e10ce57d0c5dc0055f

          SHA1

          65376a7b3251ee6194d6dabe85675998ba5aa9b2

          SHA256

          fe813b97ef18d7a4dae113168d3721fd4af5e5341976afb8e02a139ff38b1d81

          SHA512

          d380d69deb3a88a7617d5fde10f9efb81c9f5ebb47b26f9cad957cd25e017178712d247fd16dfe0692e4c9ea0242d738f9278c90e32c47470ae5cb59492df66d

        • C:\Users\Admin\AppData\Local\Temp\RESE848.tmp

          Filesize

          1KB

          MD5

          046c6aba60de20799452a5eaef9abe57

          SHA1

          b50c8745c3e273a917a29389f93550f2a6243e4b

          SHA256

          d356004ebe47ea789e3cdcfaa8ad82c661a74ef8d4ef9e096ee29ec0c6e7594d

          SHA512

          8b22f06a1a019c28928339ab72d4d70f921060bc1705e0f28e1c5836a07c33f54e12bb4d6c3406f1787c54350da688bd914262ba845b7127b7f850e5fdd5477f

        • C:\Users\Admin\AppData\Local\Temp\_ykfhwb5.0.vb

          Filesize

          284B

          MD5

          62caeb4021ea9d333101382b04d7ac1c

          SHA1

          ebe2bb042b8a9c6771161156d1abdce9d8d43367

          SHA256

          e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7

          SHA512

          e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c

        • C:\Users\Admin\AppData\Local\Temp\_ykfhwb5.cmdline

          Filesize

          177B

          MD5

          530fd125d4a445ce0bff34e3ba2a5309

          SHA1

          9efe41afb692956b306b449b4ea18273988b75b6

          SHA256

          60a0b9fd03dbb0d82aa86fa48803788255021cef6d5124032970147a9b8dbd3a

          SHA512

          e635d121418a453efc432cbf5b15aba6097e2ef107fdf87708bd640acf2433be3c60baf118910ccd48fb84e2ecdad7e40ac414e38670cb9cd5b800896714d9fd

        • C:\Users\Admin\AppData\Local\Temp\hmr7alc7.0.vb

          Filesize

          274B

          MD5

          05ab526df31c8742574a1c0aab404c5d

          SHA1

          5e9b4cabec3982be6a837defea27dd087a50b193

          SHA256

          0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430

          SHA512

          1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40

        • C:\Users\Admin\AppData\Local\Temp\hmr7alc7.cmdline

          Filesize

          167B

          MD5

          9efd3775f96338cbbc8ff24780fe85b0

          SHA1

          27a6176064a2d76e53321a59a1818bc6dd5544c4

          SHA256

          19a6d2dd5c46e9015c30ab9da779525b1582797a02632609b8ec52bc822883ea

          SHA512

          fe05a2e5fe74294ef935d105e04e17d06c65d442ed5dd36c83c2adcb85b6cc9ac4a5bf2618e0b1453e207c900975082dff164dfee33e1ca9975992539fd3caad

        • C:\Users\Admin\AppData\Local\Temp\liz_1yq8.0.vb

          Filesize

          288B

          MD5

          af52f4c74c8b6e9be1a6ccd73d633366

          SHA1

          186f43720a10ffd61e5f174399fb604813cfc0a1

          SHA256

          2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07

          SHA512

          c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e

        • C:\Users\Admin\AppData\Local\Temp\liz_1yq8.cmdline

          Filesize

          181B

          MD5

          c2f69aacf9330b64914e413fee5ed350

          SHA1

          ef68b9cb8a709f12d9a470c9531f8ddfb5cea182

          SHA256

          792b206369382079ac270d7046105820352051ba58e571bff2b7e6c8ddca6b3e

          SHA512

          594b92cf9a847b34a97aecd5ad0b9da4bb0903423d608ed9c6d1280c0847a20986656ed30df3fbae7b32854fe5f88ab1f45af69eb53b0c4a38fcefa1f7f31dd8

        • C:\Users\Admin\AppData\Local\Temp\lm81s98h.0.vb

          Filesize

          268B

          MD5

          fe8760874e21534538e34dc52009e8b0

          SHA1

          26a9ac419f9530d6045b691f3b0ecfed323be002

          SHA256

          1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439

          SHA512

          24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed

        • C:\Users\Admin\AppData\Local\Temp\lm81s98h.cmdline

          Filesize

          161B

          MD5

          ff7ef3673fcd52018f745730a5bf780c

          SHA1

          5bbac4a8359d536df917e765c36e2622ade39328

          SHA256

          37b191460a27a622cbc62f1974dc72f214d181807c356b2e61d135da492ef170

          SHA512

          63efa45b46953cd69e38749d89d057723265d16e6e7d741777515a28f4b77d9de21e52b04e732acc344b3307c7aa02a23d8c17fb62a36ad29ccdc0f908829f6a

        • C:\Users\Admin\AppData\Local\Temp\sora8d0b.0.vb

          Filesize

          285B

          MD5

          b34b98a6937711fa5ca663f0de61d5bb

          SHA1

          c371025912ab08ae52ff537aaa9cd924dbce6dcc

          SHA256

          f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a

          SHA512

          2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f

        • C:\Users\Admin\AppData\Local\Temp\sora8d0b.cmdline

          Filesize

          178B

          MD5

          24d9cef8ee44eddeaa37061b3acdb3eb

          SHA1

          69fb77ab819acbf608e5c4698c5aa4b8e615d02a

          SHA256

          77524127c9ee6056e71c8e873bc86f4a863b793c3c5a7e359b18aeff1c9b7192

          SHA512

          7bd8c2f73cfab1d0590d2fca80c26b449b9d6bdec62df707a5c5246f8f360d0c487789133fc5328ba8fd715888eb75eb049744707823fa1b217e25a7dbe605b8

        • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe

          Filesize

          234KB

          MD5

          3d3e7a0dc5fd643ca49e89c1a0c3bc4f

          SHA1

          30281283f34f39b9c4fc4c84712255ad0240e969

          SHA256

          32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e

          SHA512

          93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68

        • C:\Users\Admin\AppData\Local\Temp\uolihs-i.0.vb

          Filesize

          285B

          MD5

          9a478476d20a01771bcc5a342accfb4e

          SHA1

          314cd193e7dae0d95483be2eae5402ce5d215daa

          SHA256

          e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40

          SHA512

          56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29

        • C:\Users\Admin\AppData\Local\Temp\uolihs-i.cmdline

          Filesize

          178B

          MD5

          874d6a155e85b3816c177f39f0083a63

          SHA1

          46b99d5d32c71bac0335a92b0af45b8b2b76bf5e

          SHA256

          b2243b602ec1a2af25b330b7a6da7e642b8e8aa0494cd0f2065c59a76bde9c1a

          SHA512

          bb1de0241e3cc7c4fddfc2f58912a63f202d0fed04c8554108d743d7097daa214b488f3eb0ca0db2156f0f7690fc301a9cc4192e2ea89dc97b1cff9071a1e8b9

        • C:\Users\Admin\AppData\Local\Temp\vbc1405367BD6E14DE99936F3992B77977D.TMP

          Filesize

          644B

          MD5

          55335ad1de079999f8d39f6c22fa06b6

          SHA1

          f54e032ad3e7be3cc25cd59db11070d303c2d46d

          SHA256

          e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac

          SHA512

          ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca

        • C:\Users\Admin\AppData\Local\Temp\vbc1C5747989BDC4D868459A4A58951FE5F.TMP

          Filesize

          668B

          MD5

          3906bddee0286f09007add3cffcaa5d5

          SHA1

          0e7ec4da19db060ab3c90b19070d39699561aae2

          SHA256

          0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

          SHA512

          0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

        • C:\Users\Admin\AppData\Local\Temp\vbc625CD21B879F45B0A9E9CBE2FBEB7B4F.TMP

          Filesize

          676B

          MD5

          85c61c03055878407f9433e0cc278eb7

          SHA1

          15a60f1519aefb81cb63c5993400dd7d31b1202f

          SHA256

          f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

          SHA512

          7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

        • C:\Users\Admin\AppData\Local\Temp\vbc910339FE1E1B4FE3952C7277236B8A1.TMP

          Filesize

          644B

          MD5

          dac60af34e6b37e2ce48ac2551aee4e7

          SHA1

          968c21d77c1f80b3e962d928c35893dbc8f12c09

          SHA256

          2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

          SHA512

          1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

        • C:\Users\Admin\AppData\Local\Temp\vbcAB20DDEEC9854655B5C76F92EDE55D90.TMP

          Filesize

          684B

          MD5

          8135713eeb0cf1521c80ad8f3e7aad22

          SHA1

          1628969dc6256816b2ab9b1c0163fcff0971c154

          SHA256

          e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

          SHA512

          a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

        • C:\Users\Admin\AppData\Local\Temp\vbcC8EED48FA15947869CECE023E1FEFAA1.TMP

          Filesize

          684B

          MD5

          7a707b422baa7ca0bc8883cbe68961e7

          SHA1

          addf3158670a318c3e8e6fdd6d560244b9e8860e

          SHA256

          453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

          SHA512

          81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

        • C:\Users\Admin\AppData\Local\Temp\ximid_hz.0.vb

          Filesize

          278B

          MD5

          6d569859e5e2c6ed7c5f91d34ab9f56d

          SHA1

          7bcd42359b8049010a28b6441d585c955b238910

          SHA256

          3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78

          SHA512

          accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7

        • C:\Users\Admin\AppData\Local\Temp\ximid_hz.cmdline

          Filesize

          171B

          MD5

          86a4907aa20e3663f8db86ecc0d86967

          SHA1

          0c1257be0fcaa8626ea9a7cf31375dbae58e9439

          SHA256

          4f24a1e02e9038b1b85fe7ebe0886051241331cebd1ae3b623e40d46283ded0c

          SHA512

          9dda2690b978cd21187660d587920bd6fd456ad9c9deb394b05fa576b5a90794ccd5fac9663654f30bc2631f3173325104dd37785d02898f881622661b3e2041

        • C:\Users\Admin\AppData\Local\Temp\ykqgkutp.0.vb

          Filesize

          287B

          MD5

          9cc0fccb33a41b06335022ada540e8f9

          SHA1

          e3f1239c08f98d8fbf66237f34b54854ea7b799a

          SHA256

          b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49

          SHA512

          9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb

        • C:\Users\Admin\AppData\Local\Temp\ykqgkutp.cmdline

          Filesize

          180B

          MD5

          a8e5cca3cec74af78e29c4b220a32499

          SHA1

          643130750c207fbc0bb046dc22da1ce2512a9c6e

          SHA256

          703ed0d9a6ee063b1b5ddf829abfe1efa3696ac68db138f08f46c051f973c94c

          SHA512

          87e6aa4845f39739dbb69e1467dc77e4e15088ff2534fdbccee4ca3da2708936e89c69bd83128c95907b3da494abf5a5de0207017345ac86b97a970bd11b3b92

        • memory/2740-20-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/2740-23-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/2740-16-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/2740-24-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/2740-17-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/2740-25-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/2740-38-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/5184-22-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/5184-12-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/5184-13-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/5184-14-0x0000000075342000-0x0000000075343000-memory.dmp

          Filesize

          4KB

        • memory/5184-15-0x0000000075340000-0x00000000758F1000-memory.dmp

          Filesize

          5.7MB

        • memory/5184-11-0x0000000075342000-0x0000000075343000-memory.dmp

          Filesize

          4KB