Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 06:21

General

  • Target

    REVENGE-RAT.js

  • Size

    1.2MB

  • MD5

    8ff99e0a81c684cefbc2a752c44f30a1

  • SHA1

    61b8dbc7483abcb72d2c633e6309feb26ac16eb0

  • SHA256

    4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e

  • SHA512

    7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364

  • SSDEEP

    24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

C2

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
      "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:408
      • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
        "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Users\Admin\Documents\foldani.exe
          "C:\Users\Admin\Documents\foldani.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3468
          • C:\Users\Admin\Documents\foldani.exe
            "C:\Users\Admin\Documents\foldani.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4344
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mbmzoipa.cmdline"
              6⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5060
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDAAB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc89EAE5C8278747D8AE4B4BCEC439BF8.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4520
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1204
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5yhe1r5-.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:964
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB86.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1FD401167FE047B79495D2B1E0B71B69.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4232
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kqz_2ccs.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3888
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC13.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBE07F6B7F3CA4D66BD38C33797E4354F.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4552
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oh7zkhsm.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3524
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCEE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1C6A69D0E8E8486D859F8FC5B7E8388.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:692
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nyrbmj8d.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1596
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE45.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc24558E1E6AE484FAE45D1C8898E45E9.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1468
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7hoidlik.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4604
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF3F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF764AD379F374C34ABFA25B5D0907399.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:428
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wlcfz_mf.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1012
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDFCC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc67A2C67222DB43E3A69815E0A61A591A.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4804
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\edww_ajk.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3816
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE049.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE08A8D6A367F4D26A89EB62B9320825D.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4116
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\7ticnxyd.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1464
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0C6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDA109FE253454C91A66CB291A23AA26E.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3468
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mhprvsht.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3628
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE133.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF6BDA8892A9C4E028CD962DB63C6FFAF.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3988
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\Documents\foldani.exe
      C:\Users\Admin\Documents\foldani.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:2952
      • C:\Users\Admin\Documents\foldani.exe
        "C:\Users\Admin\Documents\foldani.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log

          Filesize

          496B

          MD5

          cb76b18ebed3a9f05a14aed43d35fba6

          SHA1

          836a4b4e351846fca08b84149cb734cb59b8c0d6

          SHA256

          8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

          SHA512

          7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

        • C:\Users\Admin\AppData\Local\Temp\5yhe1r5-.0.vb

          Filesize

          268B

          MD5

          fe8760874e21534538e34dc52009e8b0

          SHA1

          26a9ac419f9530d6045b691f3b0ecfed323be002

          SHA256

          1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439

          SHA512

          24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed

        • C:\Users\Admin\AppData\Local\Temp\5yhe1r5-.cmdline

          Filesize

          161B

          MD5

          27b111a8f8dc6d4e5134dde3f940e39a

          SHA1

          c7f25bc76943c8e2e6a41d32f3ab4f369067ce56

          SHA256

          787549bcfe36e92433e94815d7df19c8b78d5eab0de9f3b908df09bd620cb37a

          SHA512

          aaefa0d782ce751cb6f630c1caee722c85f6601a4e02d1bc31d4c6955b69b457223255e286fb047d77261d7d17b14df434498cfd6734a708f63d881f5fa3f13c

        • C:\Users\Admin\AppData\Local\Temp\7hoidlik.0.vb

          Filesize

          285B

          MD5

          b34b98a6937711fa5ca663f0de61d5bb

          SHA1

          c371025912ab08ae52ff537aaa9cd924dbce6dcc

          SHA256

          f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a

          SHA512

          2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f

        • C:\Users\Admin\AppData\Local\Temp\7hoidlik.cmdline

          Filesize

          178B

          MD5

          8785292d538e47ca773031baab0b45bc

          SHA1

          44cba32f7cb4146bd8ea585cc88db6dd10b048e8

          SHA256

          ef2997210267005389180b5392858166185aa6f80631fea8c90eb0a5244fb4bf

          SHA512

          304d5debd94ee20b6013ea9635a14f3c3b71c308dc2e5fc6c8d3f0084fb2127fbb8318f6e95061bc85aede8395d2bb20728a81f8265c1ee6b45b02c360eb7408

        • C:\Users\Admin\AppData\Local\Temp\7ticnxyd.0.vb

          Filesize

          284B

          MD5

          62caeb4021ea9d333101382b04d7ac1c

          SHA1

          ebe2bb042b8a9c6771161156d1abdce9d8d43367

          SHA256

          e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7

          SHA512

          e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c

        • C:\Users\Admin\AppData\Local\Temp\7ticnxyd.cmdline

          Filesize

          177B

          MD5

          1f72397e824b01b5f0a380243a443d91

          SHA1

          7e63366b5d747a3a98dc606d73b561ef8247c588

          SHA256

          e376154972bd8d92dbe9bec13315ec69cd4740aa22c8c7363c4529df3063b93f

          SHA512

          81b71fc1edf6548dcd9381efe7aa372d4ff4c1bdf784fd1584ee542b2be6292e8c0bd88c528d13ca1eec7f9d6611f1034549e6a416de85a5c2cd390bf2582e5d

        • C:\Users\Admin\AppData\Local\Temp\RESDAAB.tmp

          Filesize

          1KB

          MD5

          0f0769b24f67ddc6aafbed48140a20c9

          SHA1

          a162582e6486f2f0ed1072ae246c36fda87d5e49

          SHA256

          095f8378546cb2ba03729901ab76955074f8842a8aaa607213e96293c97c533d

          SHA512

          d87d2678641127d9510721f6fc1551a9018bc10c7ec1d07df430a22e8a66f2c46026fccd13a7fd6f030ca0c6d0d066d369dcfb2cf0fbce1625089b011b0dfffa

        • C:\Users\Admin\AppData\Local\Temp\RESDB86.tmp

          Filesize

          1KB

          MD5

          2f84cf0ae97dce704fddcd1b28a59c4a

          SHA1

          19bd17d0c710ed1975c45247b6a8cd411eda6c48

          SHA256

          560f78568014b8fccb004568fbce052d1f5d5512c2c009799dd6d3d0f0933a4b

          SHA512

          46691e33540952770b0ec669c77158a07393a5c4c07de84c6aa12c67ccfa65c2179b4c7791cf385fcc08042eb378fa174d498592b1a2e269e21af1e56e998c14

        • C:\Users\Admin\AppData\Local\Temp\RESDC13.tmp

          Filesize

          1KB

          MD5

          123f58f75a67c1435a76a1d39f2fbae0

          SHA1

          901c09fb7fcfd2544158e89f98187aa2d93311c3

          SHA256

          0222c501c839bc950e4abebff7cea9bbfffb09bfc59a26d749600f25f0de21b5

          SHA512

          843dd15cb27dc36cdb2f047c82bc81b690d2a719e8dac06ad971c3cfef5f79b244b86c00e66a54d422c57fe74e5d104cedad8b39cf500d6beccc413da1e8113b

        • C:\Users\Admin\AppData\Local\Temp\RESDCEE.tmp

          Filesize

          1KB

          MD5

          dbfe61bc29e901e26cc0204cc8168434

          SHA1

          6649e402f9bb820bd5d1c903c9727ca94d3bddf5

          SHA256

          43a22270314aeac704f23064a058d533861762c5d7253b73d43288f826c6171b

          SHA512

          95c5dee62f81d29eee0df9dfe4782aadc0963326c762963d9504910a876dd0c9794f7c88bf41202a86c3224ca541b594b887003a717d2cc990e796108cbbd3f6

        • C:\Users\Admin\AppData\Local\Temp\RESDE45.tmp

          Filesize

          1KB

          MD5

          297b01855557a938585f8df600512ffb

          SHA1

          9238d715f9e152b46c7fb20cbf7603151f9205b2

          SHA256

          a14c136408c334cea129cdbb68f511c4a23c7732a0ee6ec951940b3d374b18a8

          SHA512

          395ea2d32146c484febe0a533ad50ed0bffee252614cab0390e107f8ea9f487f515c50ef129aa73297145c3701aa45a591c9cd2606a3b4a461094790fc89b083

        • C:\Users\Admin\AppData\Local\Temp\RESDF3F.tmp

          Filesize

          1KB

          MD5

          a51b42bfe6443aa55617b26572ef9fe3

          SHA1

          da984532da26c6dc4a064d1eb0111874990e410f

          SHA256

          2c90754f9a4b1f93d359389f4790bb0cb7527484a24531a0898e239e70fb5653

          SHA512

          43f28797b34f725c559ec6426527460b2f249a0aa0c6bacfbf44e8df82f316bbdacec8341cad0c998d3508e53f31385fc01255452c6b6cd674ddc83bba0d1b69

        • C:\Users\Admin\AppData\Local\Temp\RESDFCC.tmp

          Filesize

          1KB

          MD5

          8d4227b48bc8e914136a175af564b01a

          SHA1

          0a734207c8be13db19e8ee1ee31514ee8fdae5d5

          SHA256

          1d1a8f6a2995e1f06d134650c51f5212395872baa912768ec43c5dfb5df990cd

          SHA512

          9c8e5704443f0cf13934679323045bd188d13706b6a6ad7fd581b3545d1475bffa69d60d8f68704aec4e88e727a024380bfe857aca0dd972c3b33babc16fc975

        • C:\Users\Admin\AppData\Local\Temp\RESE049.tmp

          Filesize

          1KB

          MD5

          163c58fe487c164e145c01da61adab4d

          SHA1

          163cae392593ec228d5f43cc92a1501a1c901b96

          SHA256

          761c0b0ae0d79721552bd993fb9c4e41729c70841ba1ad887fc8120cbb207dd2

          SHA512

          5fc4fc0bed7caea0288a7fd87cad2490cb0578428b758c2f8befe30ed9ccde3d899272175a438d355d6a430f2c465acb4e5c32a1cdcaf28389a20cee957392bc

        • C:\Users\Admin\AppData\Local\Temp\RESE0C6.tmp

          Filesize

          1KB

          MD5

          a0c6aec14052c73f9a55aaa259f40d55

          SHA1

          f4909a3b62a4349ebaa1b3fe201339c86cceb6b8

          SHA256

          851bca379cac4fe6666391102f719eec80a8be0e487d8c0e6e5a6ca0380d0b11

          SHA512

          bc05cb5d4941850b7afdff9eaabedaab3b26b4d80d2c5a4f58f79ac0e126217ca8236b5e1ea6d54aa5537f3c31f99cbe67f9a11e62cb7ac15942dcc2b1e5a291

        • C:\Users\Admin\AppData\Local\Temp\RESE133.tmp

          Filesize

          1KB

          MD5

          94c90913c9f2534ea331f47842d53508

          SHA1

          d11a318a60d628834768ae97af584a406b476d14

          SHA256

          ce03973ce709fe7429d9e17517860f997fb9557742dfd4ec393670e35bf255a6

          SHA512

          1a4567596788a12a0a362df4f2091091a368f435ec7615b53d1ec27fc2e3180cf50f2eded7d05ba366979905dfda5dc0dd03a1b192931ccf23b90520ece7d632

        • C:\Users\Admin\AppData\Local\Temp\edww_ajk.0.vb

          Filesize

          278B

          MD5

          6d569859e5e2c6ed7c5f91d34ab9f56d

          SHA1

          7bcd42359b8049010a28b6441d585c955b238910

          SHA256

          3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78

          SHA512

          accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7

        • C:\Users\Admin\AppData\Local\Temp\edww_ajk.cmdline

          Filesize

          171B

          MD5

          d1bf023f36f375c7f25570aa11a5ff0f

          SHA1

          38ecfe1c142368ab02172a621fff1f6d485f6d73

          SHA256

          aafca39cc35b8c46189e38bb7e2db1c5e764b997d3b43329631a72957196bd85

          SHA512

          20a1e0acb0c9e967c8f9a2e4f97d70af3b784b05ef6d954a90c4e6c4fccc09c8578602cb90ddabe2e7bed16ceb4908a0dac3c10f539ac94229bd6cbeabd6d892

        • C:\Users\Admin\AppData\Local\Temp\kqz_2ccs.0.vb

          Filesize

          274B

          MD5

          05ab526df31c8742574a1c0aab404c5d

          SHA1

          5e9b4cabec3982be6a837defea27dd087a50b193

          SHA256

          0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430

          SHA512

          1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40

        • C:\Users\Admin\AppData\Local\Temp\kqz_2ccs.cmdline

          Filesize

          167B

          MD5

          2e1263efbd08f7b88aa4d9b97ad6252e

          SHA1

          83512d453ec755df2dfd5a140bf3bf37df60a9d1

          SHA256

          409dfbbbd5f98b4f2e45a850625b15865eb3fcd97e4ad1596a74b961a4317322

          SHA512

          13199f6d96139516ddba57a5ef14b7bc59d8472fde79ecbc25480521768eeb77959294267e86e765c42ae5b976cb90552b0fe00d0f279193e8324c437e850049

        • C:\Users\Admin\AppData\Local\Temp\mbmzoipa.0.vb

          Filesize

          145B

          MD5

          61413d4417a1d9d90bb2796d38b37e96

          SHA1

          719fcd1e9c0c30c9c940b38890805d7a89fd0fe5

          SHA256

          24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7

          SHA512

          9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4

        • C:\Users\Admin\AppData\Local\Temp\mbmzoipa.cmdline

          Filesize

          195B

          MD5

          9db28f2b0c316e338b1806ec97cb9098

          SHA1

          7811fcf0abbdae8f376011d84f120ef6091784f3

          SHA256

          46318ac6a0c5594b3437549d1acd51b6c84ba300c79cdaceb7b7ce12f6a0b571

          SHA512

          fe43027b11ccc7c7d3a5317d9a9ebfd65a5907cf8b8401612e3af94ceb7795a71bc0f3edd7f205f5705ae6e66946cfe5112528b3d92f10945ae8ed0cd42aabea

        • C:\Users\Admin\AppData\Local\Temp\mhprvsht.0.vb

          Filesize

          287B

          MD5

          9cc0fccb33a41b06335022ada540e8f9

          SHA1

          e3f1239c08f98d8fbf66237f34b54854ea7b799a

          SHA256

          b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49

          SHA512

          9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb

        • C:\Users\Admin\AppData\Local\Temp\mhprvsht.cmdline

          Filesize

          180B

          MD5

          da94eeacc4f87d4c01652cb1d530a02a

          SHA1

          010274c62b6a1d25e9454ac3b9141343f43ae1cc

          SHA256

          2b397e9b228ab0a11d64298cd08dfc8775a92f347eec3fdd506b093cd67aa690

          SHA512

          07bfd249dfc54f11517d97d029ddd0d8167c2ea229b617d0a2700b2f996e27b36c7291caf4f418c357da040547dc34fb1d61184a9d96e17e99b84ac42c16f150

        • C:\Users\Admin\AppData\Local\Temp\nyrbmj8d.0.vb

          Filesize

          285B

          MD5

          9a478476d20a01771bcc5a342accfb4e

          SHA1

          314cd193e7dae0d95483be2eae5402ce5d215daa

          SHA256

          e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40

          SHA512

          56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29

        • C:\Users\Admin\AppData\Local\Temp\nyrbmj8d.cmdline

          Filesize

          178B

          MD5

          dc6179775e76b07c5533224a789aeb00

          SHA1

          bbe456cbc2a76371f532cd3c4bed6f1f68ea9922

          SHA256

          8b223159c534417279bc3991668d2e1bc390d6660b91250250041bef59b109a1

          SHA512

          d591aaf5755ccd5b6aa1bb2c35643b7c27c10a7eac588194c5208175f268e2e97706fb54658e9bd9cda8d91aa44fdfcb1a306ec7f8561c6b583af57dc2914183

        • C:\Users\Admin\AppData\Local\Temp\oh7zkhsm.0.vb

          Filesize

          284B

          MD5

          6989ad9512c924a0d9771ce7e3360199

          SHA1

          1bcc5312adf332719db83156f493ad365f5bdec6

          SHA256

          f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168

          SHA512

          13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536

        • C:\Users\Admin\AppData\Local\Temp\oh7zkhsm.cmdline

          Filesize

          177B

          MD5

          3aebe03dffcdec67e3577a7c7e2f50d8

          SHA1

          69d80e12bb433dc484c000d688ff1119cee77f4c

          SHA256

          985d8ef7429cfe0ad5305a4cd8657e3d253f39964d162ca3be4198eb9eab115d

          SHA512

          b8aff12777ab798a1e27816a3751b8f33f72d32375682534a0e8ea864b062043c167406c45cd05d83ce713e3287dba21d57a24f58a4375b4371b2d9978a32b41

        • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe

          Filesize

          234KB

          MD5

          3d3e7a0dc5fd643ca49e89c1a0c3bc4f

          SHA1

          30281283f34f39b9c4fc4c84712255ad0240e969

          SHA256

          32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e

          SHA512

          93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68

        • C:\Users\Admin\AppData\Local\Temp\vbc1FD401167FE047B79495D2B1E0B71B69.TMP

          Filesize

          644B

          MD5

          dac60af34e6b37e2ce48ac2551aee4e7

          SHA1

          968c21d77c1f80b3e962d928c35893dbc8f12c09

          SHA256

          2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

          SHA512

          1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

        • C:\Users\Admin\AppData\Local\Temp\vbc24558E1E6AE484FAE45D1C8898E45E9.TMP

          Filesize

          676B

          MD5

          85c61c03055878407f9433e0cc278eb7

          SHA1

          15a60f1519aefb81cb63c5993400dd7d31b1202f

          SHA256

          f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

          SHA512

          7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

        • C:\Users\Admin\AppData\Local\Temp\vbc67A2C67222DB43E3A69815E0A61A591A.TMP

          Filesize

          684B

          MD5

          8135713eeb0cf1521c80ad8f3e7aad22

          SHA1

          1628969dc6256816b2ab9b1c0163fcff0971c154

          SHA256

          e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

          SHA512

          a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

        • C:\Users\Admin\AppData\Local\Temp\vbc89EAE5C8278747D8AE4B4BCEC439BF8.TMP

          Filesize

          644B

          MD5

          55335ad1de079999f8d39f6c22fa06b6

          SHA1

          f54e032ad3e7be3cc25cd59db11070d303c2d46d

          SHA256

          e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac

          SHA512

          ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca

        • C:\Users\Admin\AppData\Local\Temp\vbcBE07F6B7F3CA4D66BD38C33797E4354F.TMP

          Filesize

          668B

          MD5

          3906bddee0286f09007add3cffcaa5d5

          SHA1

          0e7ec4da19db060ab3c90b19070d39699561aae2

          SHA256

          0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

          SHA512

          0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

        • C:\Users\Admin\AppData\Local\Temp\vbcF6BDA8892A9C4E028CD962DB63C6FFAF.TMP

          Filesize

          684B

          MD5

          7a707b422baa7ca0bc8883cbe68961e7

          SHA1

          addf3158670a318c3e8e6fdd6d560244b9e8860e

          SHA256

          453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

          SHA512

          81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

        • C:\Users\Admin\AppData\Local\Temp\wlcfz_mf.0.vb

          Filesize

          288B

          MD5

          af52f4c74c8b6e9be1a6ccd73d633366

          SHA1

          186f43720a10ffd61e5f174399fb604813cfc0a1

          SHA256

          2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07

          SHA512

          c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e

        • C:\Users\Admin\AppData\Local\Temp\wlcfz_mf.cmdline

          Filesize

          181B

          MD5

          2d3b84135245f3afa5f45ce486fa54b3

          SHA1

          227b26c0757bcbdf67b9e32f94952d14cdf24614

          SHA256

          1eeb8ba53dc3fe68183dcd644a9112664bae460c907fcaeda116281d52f7b5da

          SHA512

          1b29547f50674d1ac2732e4353ccb3c89b20e1cf68c29bebae1f42774b7d4cdd5a459f81df6de1704c4368ae392fa1bda23a4788ffbfd7e54b4563935fc59eb9

        • memory/408-11-0x00000000751C2000-0x00000000751C3000-memory.dmp

          Filesize

          4KB

        • memory/408-14-0x00000000751C2000-0x00000000751C3000-memory.dmp

          Filesize

          4KB

        • memory/408-24-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/408-12-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/408-13-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/408-15-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/1412-23-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/1412-17-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/1412-16-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/1412-20-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/1412-21-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/1412-25-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/1412-38-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB