Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 06:28

General

  • Target

    REVENGE-RAT.js

  • Size

    1.2MB

  • MD5

    8ff99e0a81c684cefbc2a752c44f30a1

  • SHA1

    61b8dbc7483abcb72d2c633e6309feb26ac16eb0

  • SHA256

    4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e

  • SHA512

    7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364

  • SSDEEP

    24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

C2

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1124
    • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
      "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4116
      • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
        "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Users\Admin\Documents\foldani.exe
          "C:\Users\Admin\Documents\foldani.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Users\Admin\Documents\foldani.exe
            "C:\Users\Admin\Documents\foldani.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4928
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2qsihq2p.cmdline"
              6⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4416
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD23F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc681B0E2B99C94AA9A8FDC38B4969C647.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1904
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:212
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ahmccb5v.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1372
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2FB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc32D6131F8341D8BF58B78E4AF5F5E.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:536
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u74qwku8.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4944
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD3B6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA8F65F155C2941F9B5390A1DEBE33B.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1120
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ucfkupuc.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2296
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD462.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc147591C3364E4278A28FEA194DD072ED.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3656
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ju2ixuue.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD56C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc22AAB6F3F3824606BC5AEE1621A855B0.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3176
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wd1neis4.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1712
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD666.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB3F680F1D3A54DEC9845E286349D84F8.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3232
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-xqs-d-y.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3624
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6D3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFADFEEBD268345219ABD3438BC4CC1B4.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4208
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_h9nch5q.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2492
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD760.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc16AF8B03C5524E73BD36361CEC347F9.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4668
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rnuju-wq.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2760
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD7DD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3A62F310D04C49D2AFC0993D1EB52E3C.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3844
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\1kvjy3mx.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3812
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD85A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC9CC533D9C4D42339C64A88A334ECFB4.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1680
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Users\Admin\Documents\foldani.exe
      C:\Users\Admin\Documents\foldani.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:768
      • C:\Users\Admin\Documents\foldani.exe
        "C:\Users\Admin\Documents\foldani.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:396

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log

          Filesize

          496B

          MD5

          cb76b18ebed3a9f05a14aed43d35fba6

          SHA1

          836a4b4e351846fca08b84149cb734cb59b8c0d6

          SHA256

          8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

          SHA512

          7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

        • C:\Users\Admin\AppData\Local\Temp\-xqs-d-y.0.vb

          Filesize

          288B

          MD5

          af52f4c74c8b6e9be1a6ccd73d633366

          SHA1

          186f43720a10ffd61e5f174399fb604813cfc0a1

          SHA256

          2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07

          SHA512

          c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e

        • C:\Users\Admin\AppData\Local\Temp\-xqs-d-y.cmdline

          Filesize

          181B

          MD5

          247d94c428b86b83f92d034df52791a0

          SHA1

          619cb7c643fde86ec071376b84a6b0b2241b1350

          SHA256

          863f0d657591e88f7c79bde0f1ed45c7cf74752fa5c334bdccdfb83a571b8093

          SHA512

          90301278e267edac7c3875ebcd8c861e508837f6bdc770a90f9f9d0824ba1b3a5b7c6cd2a02a3ca7f5772c962705a7d480a64c4523d467daee0d7141816ce986

        • C:\Users\Admin\AppData\Local\Temp\1kvjy3mx.0.vb

          Filesize

          287B

          MD5

          9cc0fccb33a41b06335022ada540e8f9

          SHA1

          e3f1239c08f98d8fbf66237f34b54854ea7b799a

          SHA256

          b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49

          SHA512

          9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb

        • C:\Users\Admin\AppData\Local\Temp\1kvjy3mx.cmdline

          Filesize

          180B

          MD5

          a3c6adee5fbce289c1d23b0d151a8a8c

          SHA1

          aadf0ae6bbae84a6c736f9a160e2aabcf80471c6

          SHA256

          ab97d1a64d7b4888f939840cbc5018199c11935dffc60ab633b400844f1a4077

          SHA512

          5f740af285f6ede64d97df108f4e3438e59a7f9e487aab02c04c0440b8995753f1cae850b64f07586105669a0063382b1d5f9d406f7ffe62823b4bd5d51184fa

        • C:\Users\Admin\AppData\Local\Temp\2qsihq2p.0.vb

          Filesize

          145B

          MD5

          61413d4417a1d9d90bb2796d38b37e96

          SHA1

          719fcd1e9c0c30c9c940b38890805d7a89fd0fe5

          SHA256

          24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7

          SHA512

          9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4

        • C:\Users\Admin\AppData\Local\Temp\2qsihq2p.cmdline

          Filesize

          195B

          MD5

          170c8d4278a8525301688d9133c0c4a9

          SHA1

          9d70a509cc9570c7e7505316833f05f5e44faa1a

          SHA256

          ffb33ca5dbe14d5df8a58f4ed075b1a8b602b5d919c0c50df8325d46ea4620d2

          SHA512

          2516183814b50ec62c3c85954fa3ac7c95dd29516a6fd312d2ffd7075ad4c89e9bda17e45d5f3d767381a35bef0156c87b5cd334ff730a095f6c04b6b8c84443

        • C:\Users\Admin\AppData\Local\Temp\RESD23F.tmp

          Filesize

          1KB

          MD5

          e72847ad0dd706200884d7c6eeed5529

          SHA1

          51e95f734ef4f5edcace6e13238fc6da1724e83f

          SHA256

          73c7806cfd2d4e7f9cbd27f799aba30b5bd38f805dd0d25348ad9a56b678ffd4

          SHA512

          4ee955dc96f6ca2e209c2ad6bac64f843266202282d34311b0d72fdbdeb24ffc794a3614fba95d34c1f4ca45c97ed6a1d544ecce90d21b97ff201f2ad6737f65

        • C:\Users\Admin\AppData\Local\Temp\RESD2FB.tmp

          Filesize

          1KB

          MD5

          1a9cbf2ae25474b10aedfd3d95cfe78e

          SHA1

          0a51ecc2f4a1822b4b95324e919053aecb9c6685

          SHA256

          afe9508316e3374d18af17bc4c85d97985d341da274216e68bcd482f5122864b

          SHA512

          b9114c20d4da1eb40cff358992232d9a2058cd2800d9064bbbb40e120d5a46cbc9e97c87369594e95f4e180b60e173d1e4e4863e2397477d2d30a2a21a2b1631

        • C:\Users\Admin\AppData\Local\Temp\RESD3B6.tmp

          Filesize

          1KB

          MD5

          ab2fff3492a90d484a25675544bc4810

          SHA1

          6b420b5735c917bb99a04f8e724066d4147651be

          SHA256

          f4bdc26de3af00ffc7cc12f48b508785dc75529dd965b8892771e7d3b75db609

          SHA512

          e194104642ea09022a65aed3a67f8151680a89006a05eb2ce3efb43fe048ff4621d993146af7d39df1413665c1055a7e0e0b0d4b9d21bfddca39e2c970cb9307

        • C:\Users\Admin\AppData\Local\Temp\RESD462.tmp

          Filesize

          1KB

          MD5

          2ee40814e19d8263ba81920cfa06cdb3

          SHA1

          617a937e81b3ecabaca3768bc45a37be96bd0734

          SHA256

          48fafbe167dd5cbd5bf8e8de59136d442154e1e9fe0da32f7e402299c521c4af

          SHA512

          7f4aef40b1191fab21c7368df5cc82116362432d6d2aa27787882fa14e921d4d5eaf7f3b003bd32a6d183d14ce3df341c29a9f583957f725e7e21f14c5056717

        • C:\Users\Admin\AppData\Local\Temp\RESD56C.tmp

          Filesize

          1KB

          MD5

          5a45ff9367022977ffa0bb85cff92d96

          SHA1

          7b2b8f96c391b3d22e5f18ef5535a8cec1da5b9d

          SHA256

          8c9b92f1061228571cd1a0008348ecbd4f1a554ec5364b99d6ed0cbf491b25b4

          SHA512

          1da54350ad524632937a135b40eea38cb59d708957cd8d336389f90e84c15158e9ec8e2dccb9f0f67ee4236d24adbf6ff904d1aa5f5eba67e01f7616ad58212a

        • C:\Users\Admin\AppData\Local\Temp\RESD666.tmp

          Filesize

          1KB

          MD5

          37ac1f7a620b2645cf2c78971c46965e

          SHA1

          07e9b0593c49d867ebec3b312c85551d3fa5b277

          SHA256

          7ce6763d6680f3824c08e7b4111d4f8eee2280034b4fe1925e889fa291292238

          SHA512

          ef1ac5b668a9262d0a04536fc4824b0065225b9124d6db340e178c1416d1e163cac54f3cc08613ae4b51dce42ac874e6336f930c6e68158e4b0095feb56bea69

        • C:\Users\Admin\AppData\Local\Temp\RESD6D3.tmp

          Filesize

          1KB

          MD5

          df760c712a09ff5408361fcb5d220540

          SHA1

          d59984fc4e359b85d9c85f3b731cd3f9c54809b3

          SHA256

          6a263461bc5d38e4512322297f43da0c6378d1069baa75fcb12bf6a00f36f210

          SHA512

          f2a86dd5e070848873846f5adf9c1d469995a957d63dda9bea1fe092617e392a332f1aac275675258b38aaa781712127cdda81738e09b53d302a9251a495f771

        • C:\Users\Admin\AppData\Local\Temp\RESD760.tmp

          Filesize

          1KB

          MD5

          f16695a1cfbbce50c5c2e49885a190f6

          SHA1

          543529ff8433d7d399bafc13e361be0df40fa14a

          SHA256

          559b8138ee7ca2d154f95b6f2bb859cec0a7766477623670d31724dd79d7f749

          SHA512

          0834206bf20f4a44554566c35e6900eb2651a12bc839136fa25436c706c9be7d0727403595385f976cc869531c5f3929d7dc55d250a6c1c20105e8770dac612f

        • C:\Users\Admin\AppData\Local\Temp\RESD7DD.tmp

          Filesize

          1KB

          MD5

          7cc394d3204217f1b3faf0d10d6c7926

          SHA1

          2e0dbbd7f696bb600cbf5a3014152ea4c736dabe

          SHA256

          3f8a29574d4c08a6ecc9bec707657eb4b08b30066741894313fa9de112522463

          SHA512

          e1890999af8ce6966393aede4ffc1cbafe0ff157472fc732e00df63335916e51c64aabd371ca16d29df029c1a068f99b49985927a8da6ed2e5a8a36c1f57544f

        • C:\Users\Admin\AppData\Local\Temp\RESD85A.tmp

          Filesize

          1KB

          MD5

          71c31229618552ee489a0e8091bcf138

          SHA1

          3564d5870be72eb16907926a38e8dec26e39ef5e

          SHA256

          b808033afbd18b4291b6e3e0eb35a18d0940c06e6bd1b047cf39a64f5b8d635b

          SHA512

          52f2bd92c537dea7460e8925a11ac02d0f3c711cfdc70a5bb0806119072b1a682314b3db39b2e73cc8ea013f352e644453ae519686ebabab18920fb2ee58f449

        • C:\Users\Admin\AppData\Local\Temp\_h9nch5q.0.vb

          Filesize

          278B

          MD5

          6d569859e5e2c6ed7c5f91d34ab9f56d

          SHA1

          7bcd42359b8049010a28b6441d585c955b238910

          SHA256

          3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78

          SHA512

          accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7

        • C:\Users\Admin\AppData\Local\Temp\_h9nch5q.cmdline

          Filesize

          171B

          MD5

          bfdf34d33bc75a3f64a8a6178e62babd

          SHA1

          1209d6dd5efb58df03efef713a6edfc7754a87e4

          SHA256

          a66fbea2300de954429fb3fccc37063ddbcadb8261d72de78cae2a5582e13ac5

          SHA512

          331850b173876d39ee8213018e3edf38130597a4ff58203aad4cf2076b22c45320b6ac0efb00dc78640ecc954b64a136649b91c42a965d08b67c3ed74d08e53c

        • C:\Users\Admin\AppData\Local\Temp\ahmccb5v.0.vb

          Filesize

          268B

          MD5

          fe8760874e21534538e34dc52009e8b0

          SHA1

          26a9ac419f9530d6045b691f3b0ecfed323be002

          SHA256

          1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439

          SHA512

          24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed

        • C:\Users\Admin\AppData\Local\Temp\ahmccb5v.cmdline

          Filesize

          161B

          MD5

          43a76bb600696562a16d12eae862557b

          SHA1

          352096c902427f47ba31f8299f88953a02d61d88

          SHA256

          3ad8cb5b36b537695623c98e5870329f4219586da7cc95414dda94e99195929b

          SHA512

          ab59368faf537ae1c4b572947cf4b8c1db387c4bd3f8c4d7e75071108c22121c6f7b835cc10c729f724a1eea9d6689136eb2b6f287628b244dc4513a5626f863

        • C:\Users\Admin\AppData\Local\Temp\ju2ixuue.0.vb

          Filesize

          285B

          MD5

          9a478476d20a01771bcc5a342accfb4e

          SHA1

          314cd193e7dae0d95483be2eae5402ce5d215daa

          SHA256

          e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40

          SHA512

          56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29

        • C:\Users\Admin\AppData\Local\Temp\ju2ixuue.cmdline

          Filesize

          178B

          MD5

          f00771268c38f3e11288b36c148c47d2

          SHA1

          65c178576eb5ac495fa5218c4aded8ad34a0689b

          SHA256

          d5d1c2164442a19fc46829d0f26fcc16a7bbd1b8904cfedb24132b6826b229d0

          SHA512

          cd2060e232c6b5a1e8792af26b02e6d21b82f83de0eb83c53d44ba8d861f5f5c79d861e4341cb6bc81239402bed5d98872dfe20dc8ccefe4a2f63dc76c09550f

        • C:\Users\Admin\AppData\Local\Temp\rnuju-wq.0.vb

          Filesize

          284B

          MD5

          62caeb4021ea9d333101382b04d7ac1c

          SHA1

          ebe2bb042b8a9c6771161156d1abdce9d8d43367

          SHA256

          e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7

          SHA512

          e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c

        • C:\Users\Admin\AppData\Local\Temp\rnuju-wq.cmdline

          Filesize

          177B

          MD5

          b7b411b7e6625c94de0179daa431025c

          SHA1

          8a4b70928721e6225962dafeebdf3aa13931d59b

          SHA256

          518089de8887eff67734a4bfaab9e46d2336a8ef7fff5b3e0656cb72aa23852f

          SHA512

          cb89b4165cc20f44e30128b50a9e3254d16b24cd0a185167eed8c245c23456b90b0d20a38e95c2082000e896cc66788cd28a35fe8f3d313f77a375f3a9db128a

        • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe

          Filesize

          234KB

          MD5

          3d3e7a0dc5fd643ca49e89c1a0c3bc4f

          SHA1

          30281283f34f39b9c4fc4c84712255ad0240e969

          SHA256

          32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e

          SHA512

          93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68

        • C:\Users\Admin\AppData\Local\Temp\u74qwku8.0.vb

          Filesize

          274B

          MD5

          05ab526df31c8742574a1c0aab404c5d

          SHA1

          5e9b4cabec3982be6a837defea27dd087a50b193

          SHA256

          0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430

          SHA512

          1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40

        • C:\Users\Admin\AppData\Local\Temp\u74qwku8.cmdline

          Filesize

          167B

          MD5

          87803eb4d310a39736ab15b2dbe00c0a

          SHA1

          d5c48a338b267cf68836c1a868e3dae6a8d5d32a

          SHA256

          c45ec0c8d78c40c124f49b771bf9f97392cf7ee480775d324a3d37795476e92c

          SHA512

          6dd52fe9401d90de7c284365bcce3ec1d85de58c1fb0c2ee51c9372229136b0a79cb2e459eb64fe7ddf888f6176a1ae9cd8779ddedb8c684dd410ed2139376eb

        • C:\Users\Admin\AppData\Local\Temp\ucfkupuc.0.vb

          Filesize

          284B

          MD5

          6989ad9512c924a0d9771ce7e3360199

          SHA1

          1bcc5312adf332719db83156f493ad365f5bdec6

          SHA256

          f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168

          SHA512

          13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536

        • C:\Users\Admin\AppData\Local\Temp\ucfkupuc.cmdline

          Filesize

          177B

          MD5

          0320026b7dab4173c5f8007bb718030c

          SHA1

          16645e21a57ead7aab98e82dd8df2bccb88b53eb

          SHA256

          e38f12d20f1e4782f68c628e44d5ed3ec03f65500dab14521b4dd857d4ca957b

          SHA512

          1f30f6fb963b623f7c9a90e8514d57dd4093899d2d48c3fd31ad9319887fd359975c64bcbba692c6fcfbc9f07bfdb521c3dfbdc6d0ca3673b8959189c98b5bf0

        • C:\Users\Admin\AppData\Local\Temp\vbc22AAB6F3F3824606BC5AEE1621A855B0.TMP

          Filesize

          676B

          MD5

          85c61c03055878407f9433e0cc278eb7

          SHA1

          15a60f1519aefb81cb63c5993400dd7d31b1202f

          SHA256

          f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

          SHA512

          7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

        • C:\Users\Admin\AppData\Local\Temp\vbc32D6131F8341D8BF58B78E4AF5F5E.TMP

          Filesize

          644B

          MD5

          dac60af34e6b37e2ce48ac2551aee4e7

          SHA1

          968c21d77c1f80b3e962d928c35893dbc8f12c09

          SHA256

          2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

          SHA512

          1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

        • C:\Users\Admin\AppData\Local\Temp\vbc681B0E2B99C94AA9A8FDC38B4969C647.TMP

          Filesize

          644B

          MD5

          55335ad1de079999f8d39f6c22fa06b6

          SHA1

          f54e032ad3e7be3cc25cd59db11070d303c2d46d

          SHA256

          e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac

          SHA512

          ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca

        • C:\Users\Admin\AppData\Local\Temp\vbcA8F65F155C2941F9B5390A1DEBE33B.TMP

          Filesize

          668B

          MD5

          3906bddee0286f09007add3cffcaa5d5

          SHA1

          0e7ec4da19db060ab3c90b19070d39699561aae2

          SHA256

          0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

          SHA512

          0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

        • C:\Users\Admin\AppData\Local\Temp\vbcC9CC533D9C4D42339C64A88A334ECFB4.TMP

          Filesize

          684B

          MD5

          7a707b422baa7ca0bc8883cbe68961e7

          SHA1

          addf3158670a318c3e8e6fdd6d560244b9e8860e

          SHA256

          453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

          SHA512

          81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

        • C:\Users\Admin\AppData\Local\Temp\vbcFADFEEBD268345219ABD3438BC4CC1B4.TMP

          Filesize

          684B

          MD5

          8135713eeb0cf1521c80ad8f3e7aad22

          SHA1

          1628969dc6256816b2ab9b1c0163fcff0971c154

          SHA256

          e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

          SHA512

          a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

        • C:\Users\Admin\AppData\Local\Temp\wd1neis4.0.vb

          Filesize

          285B

          MD5

          b34b98a6937711fa5ca663f0de61d5bb

          SHA1

          c371025912ab08ae52ff537aaa9cd924dbce6dcc

          SHA256

          f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a

          SHA512

          2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f

        • C:\Users\Admin\AppData\Local\Temp\wd1neis4.cmdline

          Filesize

          178B

          MD5

          5b18a325ba4d974a06127aac1a3d3d87

          SHA1

          9fa6fe8a46ecc580b4108463dc81cb5acb333c18

          SHA256

          9ce0fdbc946e6353a1bf123192afb376b10632900a94458db728b9c55aa3e396

          SHA512

          77871de4a68e56ededead796b0755be0a0f6a743fe6f6d878d4d3fd1b99782338d5a61581a3f5c087066d30389214f026b29c54d87ca93f3ba0e154430c38ed3

        • memory/2076-17-0x00000000003D0000-0x00000000003DA000-memory.dmp

          Filesize

          40KB

        • memory/2076-22-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/2076-21-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/2076-20-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/2076-25-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/2076-16-0x00000000003D0000-0x00000000003DA000-memory.dmp

          Filesize

          40KB

        • memory/2076-38-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/4116-24-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/4116-15-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/4116-14-0x0000000075052000-0x0000000075053000-memory.dmp

          Filesize

          4KB

        • memory/4116-13-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/4116-12-0x0000000075050000-0x0000000075601000-memory.dmp

          Filesize

          5.7MB

        • memory/4116-11-0x0000000075052000-0x0000000075053000-memory.dmp

          Filesize

          4KB