Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 06:00

General

  • Target

    REVENGE-RAT.js

  • Size

    1.2MB

  • MD5

    8ff99e0a81c684cefbc2a752c44f30a1

  • SHA1

    61b8dbc7483abcb72d2c633e6309feb26ac16eb0

  • SHA256

    4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e

  • SHA512

    7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364

  • SSDEEP

    24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

C2

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
      "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
        "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3420
        • C:\Users\Admin\Documents\foldani.exe
          "C:\Users\Admin\Documents\foldani.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4008
          • C:\Users\Admin\Documents\foldani.exe
            "C:\Users\Admin\Documents\foldani.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5888
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u5hldrcl.cmdline"
              6⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2008
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD54.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc86307F33BA18434B92C7CB13D030D634.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1016
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2116
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wm43ttts.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3668
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE10.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc71B11D474383448A841D988CCB9CA417.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5396
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gt3wyjer.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5696
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEEA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc548CC96F61DE43948BC1426616D95.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3360
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hu8hn6si.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5764
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1023.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD3F1DD4EC4C0488394FBC9D9315F696.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3592
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\swztxue8.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2340
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10A0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBEDD2F53D9AD4628B883979A697E3A76.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4960
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ag0-ixym.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3492
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES113C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc50363F23E21D4645A9ABF3EE7714E07.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2728
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\re1dfdex.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1712
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11B9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2DCA921232F1433CA32A182DBA452A3.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5840
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zelaswx4.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5404
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1236.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF0362A6FE6554FA0A6E5D75DE58CB656.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:952
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eurvcyk-.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4188
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES12C3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7DCDC94DB20D4AE4A3E32A5F34D85B68.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5008
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\d-htz__v.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3672
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1340.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6B94701097A14A3294152E38B1801B25.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5912
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\Documents\foldani.exe
      C:\Users\Admin\Documents\foldani.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:5700
      • C:\Users\Admin\Documents\foldani.exe
        "C:\Users\Admin\Documents\foldani.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:64

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log

          Filesize

          496B

          MD5

          cb76b18ebed3a9f05a14aed43d35fba6

          SHA1

          836a4b4e351846fca08b84149cb734cb59b8c0d6

          SHA256

          8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

          SHA512

          7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

        • C:\Users\Admin\AppData\Local\Temp\RES1023.tmp

          Filesize

          1KB

          MD5

          38c1bda29728b52354b23817077ed9c7

          SHA1

          d3e225b41d0824b63598101b4f6e109675d27594

          SHA256

          91ade7fca571b09a103d936dc1a12b8ce516a4a40b4ef079ded8f557a5f022de

          SHA512

          438c9c632f7cc091a032f8654318056901963a03351092563397d79e6fc0fe5df88e2c324b08a2ce2445eafb5ae8e010e3d9df150e695434e3a30b0a45ecde82

        • C:\Users\Admin\AppData\Local\Temp\RES10A0.tmp

          Filesize

          1KB

          MD5

          2396af4359694ab0b7c51865a43dddbf

          SHA1

          b8d7e6d51ce782479cb68726c2c0780ecc1ea524

          SHA256

          8f5a1cd7e19beb2bccda9e154bc606d9b90909d73a6ca10b3e908216c214cd60

          SHA512

          db2d7b915724701b71b933334e4cef62fa6b7a609a47a340e42042448e8a2240631e0fc95e67a746a80c8df94ea4328963cd025e5ced5f417c800a56830a075e

        • C:\Users\Admin\AppData\Local\Temp\RES113C.tmp

          Filesize

          1KB

          MD5

          385de469e8480f94ee7d70be3abc7cb7

          SHA1

          af2e7fd1414715a57d9835b145ee06ce0f4631a5

          SHA256

          0ba93d102374305a50f3ce51720f9399428eb420ec0f0fbe3b28a3c2b227c151

          SHA512

          e560307c7ecc45b387c19ddbf2541ea85c90b5282e8efbbfc1b1f251af3df44e4ccf84f1b1d34eb736258af0a73f36264d81bbe841ca740a1e0268274c7cced2

        • C:\Users\Admin\AppData\Local\Temp\RES11B9.tmp

          Filesize

          1KB

          MD5

          cdb205a2318ba6e3546442e52d62a69f

          SHA1

          51b96097edae9c74bce6299921dff339b30ff76a

          SHA256

          cf14bcf530e462db82b8601c424f26e5552a29f66c20283ea2b030de3df2d4f3

          SHA512

          e86f791d360c93de072704f4444ee876570d3e699b24e43b71b526f2aa65a9880b2ec6ef94ed43301c093f3ebc8a5f7e85cba11be8d6306bb62c81e3fea98ba9

        • C:\Users\Admin\AppData\Local\Temp\RES1236.tmp

          Filesize

          1KB

          MD5

          a83f11ed248af53230ef8449a1c856d5

          SHA1

          73ea4cfa269be912bb9e064951873791d1cefd8f

          SHA256

          c762db6fe6d534e3898e443cf215e7479784cf0a6606cde533747366f32fe2fa

          SHA512

          d63d604d48ae39a6e5f6a234eedb50532c84fc72d9973860c554d635d67ae6debb01d6df2fbe87e91edf8620c8d05f4e8b38b715ca7625bc304bd60c8328c1f2

        • C:\Users\Admin\AppData\Local\Temp\RES12C3.tmp

          Filesize

          1KB

          MD5

          0048b69870af72c463bb38a952723f44

          SHA1

          6d8ef3d5f9be41ea6035c0bcd0e9e41628dd1c55

          SHA256

          24bd8d93c443008949c9e5cc449dce28d65f946f1ae78884d693ccb32e20b4e5

          SHA512

          ea0eb314a971d9fe78ebe00bac9607d0ffedd7ffb45b9223843680b4ff7c64b502f0c8454e95e22bac1f3ec31276bd51dc582a645afb1c3d4c75a0b299baa13d

        • C:\Users\Admin\AppData\Local\Temp\RES1340.tmp

          Filesize

          1KB

          MD5

          8aec2aa704ca021492384959169e80e2

          SHA1

          0c8f3068143955b9b0be3dbf7f6b98e647683fc3

          SHA256

          af78d6a02b879d39bb0f8d689a8933646f4a408145b857f5d2e9a1c4fad88c7d

          SHA512

          a92af87baa2b115f4a22b15832e065bd027f43ec8903fedea84fdd23fff5744dc26134d5085cc013299e706d7532b3b32fd3c3238f70d1d61cfeccb5f3479a4b

        • C:\Users\Admin\AppData\Local\Temp\RESD54.tmp

          Filesize

          1KB

          MD5

          bcf17a6b194dedf993fd09dff3bbbbb2

          SHA1

          4e34f0e5e48b38e292bbb41d8f683772fa46b458

          SHA256

          9b6ae8ba51a52b3e7b7a496af3ce3f0a6260780ca07c778b86460e09131a2378

          SHA512

          e6244a4badd7e859141cd731d496be6449578d438c00a2da8ad8b5574176e5e759d79ed9e68a0ca75b340fd0e133ba6c0fdaea996265621b38d06fb6f0b1f7d1

        • C:\Users\Admin\AppData\Local\Temp\RESE10.tmp

          Filesize

          1KB

          MD5

          19f5a9c22158cb037bda908950aa9344

          SHA1

          9386ccf578a5fc2b11716bff3c73be886ac039d0

          SHA256

          6c94ef90899355d8ca8757d2d3f7196efd69884e604a1ffaa7a14fae00cc0ae9

          SHA512

          3d0dd7cc6fa70d681db8f197e3ae01c750265f59ef728dc5d1973459490163b065cba66deb8f0f2c877940270d699c33871181b2361a238c077a8e85aabb9f35

        • C:\Users\Admin\AppData\Local\Temp\RESEEA.tmp

          Filesize

          1KB

          MD5

          fce1a5f5a5873e17a6a2d90643789b97

          SHA1

          2ab316314e557d31486cbd7dc49a843173235df2

          SHA256

          bc213ae5841c1a6df0bc95bc1886d8db702a72e1a05eccf93c0b270b63511eda

          SHA512

          eadd3e9085840105be912a4d8cd678f89a46db05bc5c2fcfd990d8ed7136ff54db46dc6595d156ceb6c3fb348605fc7b6030336a4d14cfb00f0d76ae05f30724

        • C:\Users\Admin\AppData\Local\Temp\ag0-ixym.0.vb

          Filesize

          285B

          MD5

          b34b98a6937711fa5ca663f0de61d5bb

          SHA1

          c371025912ab08ae52ff537aaa9cd924dbce6dcc

          SHA256

          f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a

          SHA512

          2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f

        • C:\Users\Admin\AppData\Local\Temp\ag0-ixym.cmdline

          Filesize

          178B

          MD5

          509895a4c0561b3767b64a00f2e25601

          SHA1

          13839b2d9401611c665d88b6da2981b09564a786

          SHA256

          b407eab693935a64d553dd1d14874799466a6cd7ae403a8de8c4113df0acc060

          SHA512

          8c821dbd423dcb6c20a23da5566dd31f684bd22fe8fef340ef57d9a35e3bc6f968433d47d36528e783ae734241599a2177de0e705089746be04ebbf0328c8e64

        • C:\Users\Admin\AppData\Local\Temp\d-htz__v.0.vb

          Filesize

          287B

          MD5

          9cc0fccb33a41b06335022ada540e8f9

          SHA1

          e3f1239c08f98d8fbf66237f34b54854ea7b799a

          SHA256

          b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49

          SHA512

          9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb

        • C:\Users\Admin\AppData\Local\Temp\d-htz__v.cmdline

          Filesize

          180B

          MD5

          86369aa75a0f132b33a204226067c20a

          SHA1

          967d2d1541ec1291e18df9432bc71a0011196a25

          SHA256

          80c225955aa122c77d17207b0a1a1e7691fbfb25dc7f5ebbdfa3a33abc7aab7e

          SHA512

          489ff1bab07884ed41db5d4bcf3e9ded0f0ac5a178c938502dd511e06658136e3c05721e48ded12986a264a10c0bedaaab59b82a1a3e95c335bf9b13fd43fef6

        • C:\Users\Admin\AppData\Local\Temp\eurvcyk-.0.vb

          Filesize

          284B

          MD5

          62caeb4021ea9d333101382b04d7ac1c

          SHA1

          ebe2bb042b8a9c6771161156d1abdce9d8d43367

          SHA256

          e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7

          SHA512

          e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c

        • C:\Users\Admin\AppData\Local\Temp\eurvcyk-.cmdline

          Filesize

          177B

          MD5

          604555504c4a34dcd3dc8a6d61fc0b74

          SHA1

          c7810619220857b6718558204c0786479988376c

          SHA256

          9228d117260900c48c181dbc265f3ca84595cb9e4d71876281d8990a60f7d8c9

          SHA512

          dc15a53beb5453c1c615251f7c72849975e8b6549ec4a951726c8839b98a44123040293da8d74304e5131981bb49d9ab26d713ac9028da21d3786ad445a4e27d

        • C:\Users\Admin\AppData\Local\Temp\gt3wyjer.0.vb

          Filesize

          274B

          MD5

          05ab526df31c8742574a1c0aab404c5d

          SHA1

          5e9b4cabec3982be6a837defea27dd087a50b193

          SHA256

          0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430

          SHA512

          1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40

        • C:\Users\Admin\AppData\Local\Temp\gt3wyjer.cmdline

          Filesize

          167B

          MD5

          31c08982ef6c53c454272cafe95832e2

          SHA1

          e8a7df61a6323e77545c9946f780d3ce5c230ccd

          SHA256

          71d4734abdc7527c35dcfeeede4de33ef21d10bb0ae69b20f6ccdc0d1e85d7c0

          SHA512

          2d9285e32e658954c9e4766ac5c2a2d3e04e360894e7e455b56ab6f1f673a2712e49f60d1209046c2c4b4254869f56a34403831d0e32723817720e0eb733da74

        • C:\Users\Admin\AppData\Local\Temp\hu8hn6si.0.vb

          Filesize

          284B

          MD5

          6989ad9512c924a0d9771ce7e3360199

          SHA1

          1bcc5312adf332719db83156f493ad365f5bdec6

          SHA256

          f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168

          SHA512

          13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536

        • C:\Users\Admin\AppData\Local\Temp\hu8hn6si.cmdline

          Filesize

          177B

          MD5

          e1557bd8e73e15379f6d4920a420376f

          SHA1

          3d74f6a80f43d7ffa103b7b6015249a5ac07c8cf

          SHA256

          7060568edb7fbf1d1ac8c4e8568c31fe791a1678197dc006ff34f72499058a89

          SHA512

          22e39de69db5978d4f71d355bbd7c3431e3a03fafd5c112e816eed67b49211dbf273992c81de5dcc38a4780bd05be91d6d5c71d6c7fa1d57de8af6e19cb4fe63

        • C:\Users\Admin\AppData\Local\Temp\re1dfdex.0.vb

          Filesize

          288B

          MD5

          af52f4c74c8b6e9be1a6ccd73d633366

          SHA1

          186f43720a10ffd61e5f174399fb604813cfc0a1

          SHA256

          2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07

          SHA512

          c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e

        • C:\Users\Admin\AppData\Local\Temp\re1dfdex.cmdline

          Filesize

          181B

          MD5

          b04864522755472992ed47b8560e27db

          SHA1

          b58f0b6fc25d5cd4093350e8a1daf4da87bc7570

          SHA256

          763b253e2fbf48329b79f6342d731b6f8531b390b1d5c58004cefbce41c9596f

          SHA512

          d6a28298ed12215eb75cd507b34aac515aaeea8ccae2207dba92f6d5f0c1d2be74d34dceb6d13ece1ee375ebb17ef620ba3267142a093e092e74168ce7cad15d

        • C:\Users\Admin\AppData\Local\Temp\swztxue8.0.vb

          Filesize

          285B

          MD5

          9a478476d20a01771bcc5a342accfb4e

          SHA1

          314cd193e7dae0d95483be2eae5402ce5d215daa

          SHA256

          e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40

          SHA512

          56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29

        • C:\Users\Admin\AppData\Local\Temp\swztxue8.cmdline

          Filesize

          178B

          MD5

          813339139b584fbc7e714933e22b16e4

          SHA1

          818983a596aa3d37a59d81647815b55a9a4dfc16

          SHA256

          01d504e5b6ab30e44619b65fcf47a3953aec37ce40cb5397d018f14284d11dea

          SHA512

          e12a74ac81493a47a0b0612bb44201c63be46b49276965318938bab8f29de057cf07f1027479209bf4ad7043527ac8934bddb58c98118c37a43986fb9ff4d409

        • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe

          Filesize

          234KB

          MD5

          3d3e7a0dc5fd643ca49e89c1a0c3bc4f

          SHA1

          30281283f34f39b9c4fc4c84712255ad0240e969

          SHA256

          32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e

          SHA512

          93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68

        • C:\Users\Admin\AppData\Local\Temp\u5hldrcl.0.vb

          Filesize

          145B

          MD5

          61413d4417a1d9d90bb2796d38b37e96

          SHA1

          719fcd1e9c0c30c9c940b38890805d7a89fd0fe5

          SHA256

          24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7

          SHA512

          9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4

        • C:\Users\Admin\AppData\Local\Temp\u5hldrcl.cmdline

          Filesize

          195B

          MD5

          30d18470d5b3dd558956b876b80882d7

          SHA1

          b842f8a5ae4a0c5eb9ed55bbd1256ebb0ebd81d1

          SHA256

          c6255d1177ee35221b27d99f755675c9ab07737719a693f81df7cf49ea1de24a

          SHA512

          88e58ae207bbaa231b1d12b41a36e420bcb51a18aad2dd5a877ea763aa9633c2d2e85b6522cb72e1f8bab61247dd995c769884a0a8efd484b8e2d49145e463f1

        • C:\Users\Admin\AppData\Local\Temp\vbc2DCA921232F1433CA32A182DBA452A3.TMP

          Filesize

          684B

          MD5

          8135713eeb0cf1521c80ad8f3e7aad22

          SHA1

          1628969dc6256816b2ab9b1c0163fcff0971c154

          SHA256

          e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

          SHA512

          a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

        • C:\Users\Admin\AppData\Local\Temp\vbc548CC96F61DE43948BC1426616D95.TMP

          Filesize

          668B

          MD5

          3906bddee0286f09007add3cffcaa5d5

          SHA1

          0e7ec4da19db060ab3c90b19070d39699561aae2

          SHA256

          0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

          SHA512

          0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

        • C:\Users\Admin\AppData\Local\Temp\vbc6B94701097A14A3294152E38B1801B25.TMP

          Filesize

          684B

          MD5

          7a707b422baa7ca0bc8883cbe68961e7

          SHA1

          addf3158670a318c3e8e6fdd6d560244b9e8860e

          SHA256

          453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

          SHA512

          81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

        • C:\Users\Admin\AppData\Local\Temp\vbc71B11D474383448A841D988CCB9CA417.TMP

          Filesize

          644B

          MD5

          dac60af34e6b37e2ce48ac2551aee4e7

          SHA1

          968c21d77c1f80b3e962d928c35893dbc8f12c09

          SHA256

          2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

          SHA512

          1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

        • C:\Users\Admin\AppData\Local\Temp\vbc86307F33BA18434B92C7CB13D030D634.TMP

          Filesize

          644B

          MD5

          55335ad1de079999f8d39f6c22fa06b6

          SHA1

          f54e032ad3e7be3cc25cd59db11070d303c2d46d

          SHA256

          e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac

          SHA512

          ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca

        • C:\Users\Admin\AppData\Local\Temp\vbcBEDD2F53D9AD4628B883979A697E3A76.TMP

          Filesize

          676B

          MD5

          85c61c03055878407f9433e0cc278eb7

          SHA1

          15a60f1519aefb81cb63c5993400dd7d31b1202f

          SHA256

          f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

          SHA512

          7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

        • C:\Users\Admin\AppData\Local\Temp\wm43ttts.0.vb

          Filesize

          268B

          MD5

          fe8760874e21534538e34dc52009e8b0

          SHA1

          26a9ac419f9530d6045b691f3b0ecfed323be002

          SHA256

          1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439

          SHA512

          24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed

        • C:\Users\Admin\AppData\Local\Temp\wm43ttts.cmdline

          Filesize

          161B

          MD5

          6213c84bda9cfc48196655c7a29d2ea3

          SHA1

          873d4cc2a7110262c7e0656f5ade472897ab17aa

          SHA256

          6374301e210e7bc885ceb83db945899a525e95ced329f0952c28830a28f86fd2

          SHA512

          85ccdb6e48f8ad80ca184f947167e5f9d50f9ffececc3d0e7752b96800683e508646dead641a3ef151cddb188d4704a679ba9dbb5be9bacb00488254703d69bc

        • C:\Users\Admin\AppData\Local\Temp\zelaswx4.0.vb

          Filesize

          278B

          MD5

          6d569859e5e2c6ed7c5f91d34ab9f56d

          SHA1

          7bcd42359b8049010a28b6441d585c955b238910

          SHA256

          3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78

          SHA512

          accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7

        • C:\Users\Admin\AppData\Local\Temp\zelaswx4.cmdline

          Filesize

          171B

          MD5

          91b400683d77040466dcfe19fdc596ff

          SHA1

          debc262bd367d4d30be8b1c8cee81c6218aae2fd

          SHA256

          041b87a3f78ced74d064da471e363085b7afd17ebe07e5693a274a93ff276875

          SHA512

          c511d4313caf281d41e6b0345fb4d92054c084aeea06736601e1502e3bc1623a4633ff1e7366294d12d3f400ababa7c35c43dba8daf1e14dae4134fdc306714f

        • memory/1608-11-0x00000000749B2000-0x00000000749B3000-memory.dmp

          Filesize

          4KB

        • memory/1608-12-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/1608-13-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/1608-23-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/1608-15-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/1608-14-0x00000000749B2000-0x00000000749B3000-memory.dmp

          Filesize

          4KB

        • memory/3420-22-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/3420-17-0x0000000000580000-0x000000000058A000-memory.dmp

          Filesize

          40KB

        • memory/3420-16-0x0000000000580000-0x000000000058A000-memory.dmp

          Filesize

          40KB

        • memory/3420-19-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/3420-20-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/3420-24-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB

        • memory/3420-37-0x00000000749B0000-0x0000000074F61000-memory.dmp

          Filesize

          5.7MB