Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 06:14

General

  • Target

    REVENGE-RAT.js

  • Size

    1.2MB

  • MD5

    8ff99e0a81c684cefbc2a752c44f30a1

  • SHA1

    61b8dbc7483abcb72d2c633e6309feb26ac16eb0

  • SHA256

    4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e

  • SHA512

    7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364

  • SSDEEP

    24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

C2

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
      "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
        "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5304
        • C:\Users\Admin\Documents\foldani.exe
          "C:\Users\Admin\Documents\foldani.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2364
          • C:\Users\Admin\Documents\foldani.exe
            "C:\Users\Admin\Documents\foldani.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:608
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lew2azfw.cmdline"
              6⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:316
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF2D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc502C26786D254895A7F6F226B9CF49C7.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1144
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:5752
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hjqpzhbk.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4576
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEFF9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFE15AD76391F4AEE89BDA73736E5D24.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5740
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_4eamfyu.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5312
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF085.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAFF516EEFC7540B7A92BDFA6894359AF.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1724
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fnluq7ep.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3660
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF19E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc23221680448548AC9A64947E794E653B.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3008
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-l9bdpfh.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4896
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF26A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4AD91232DAF4EA99F59826CA0D06D9E.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5164
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\el-ataqd.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2256
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF306.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc125E0E66383B4A8E91F768B8B822E8E1.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5492
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nx0s9dep.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5396
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF364.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9761254C22944CEDBA2AD5AFB956544D.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4848
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ylbau5ux.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4300
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc820C9BA7564429E8F3E5BE3ABE4A4E1.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3444
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vjykvorm.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2776
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF45E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDC7AD6814BB44C32BAB7CAF3C14ECB.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3468
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-qu7gfae.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3984
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4DB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc688D5A1DA8AE4C0E9085DB9D4790A9CA.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1088
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\Documents\foldani.exe
      C:\Users\Admin\Documents\foldani.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:3516
      • C:\Users\Admin\Documents\foldani.exe
        "C:\Users\Admin\Documents\foldani.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1632

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log

          Filesize

          496B

          MD5

          cb76b18ebed3a9f05a14aed43d35fba6

          SHA1

          836a4b4e351846fca08b84149cb734cb59b8c0d6

          SHA256

          8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

          SHA512

          7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

        • C:\Users\Admin\AppData\Local\Temp\-l9bdpfh.0.vb

          Filesize

          285B

          MD5

          9a478476d20a01771bcc5a342accfb4e

          SHA1

          314cd193e7dae0d95483be2eae5402ce5d215daa

          SHA256

          e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40

          SHA512

          56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29

        • C:\Users\Admin\AppData\Local\Temp\-l9bdpfh.cmdline

          Filesize

          178B

          MD5

          9d4600ab84991fb59eb6577bf27ae0d2

          SHA1

          a363514f31b42421e8873e00a1771f61bdb0b3ff

          SHA256

          ea3fa598a02ad055ed4864f33b33b2aab9140a3e6693fca89a4be3bf1dc92500

          SHA512

          c92ea9333ead31bd16acca3030ade8087d8ac9d3b7c2e18da7402a61726b2335d061aa12a5c099cdd8e456da808d470668dcd7ef844f780a43301494596c724b

        • C:\Users\Admin\AppData\Local\Temp\-qu7gfae.0.vb

          Filesize

          287B

          MD5

          9cc0fccb33a41b06335022ada540e8f9

          SHA1

          e3f1239c08f98d8fbf66237f34b54854ea7b799a

          SHA256

          b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49

          SHA512

          9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb

        • C:\Users\Admin\AppData\Local\Temp\-qu7gfae.cmdline

          Filesize

          180B

          MD5

          6664beebf7336cdf32f257bedb8119f3

          SHA1

          c2b56fddf18368be5b4b751d37b6bcacf17493a0

          SHA256

          3eccab439512a2bed4e7e814aeddc15e293d7d061fe25d70dc024bf07ad6092d

          SHA512

          07530600b0cb145c33f07f2a50d70ac15f4fe0dc7a24d6a85b7b9180d50b3b42241d2b2f01be58a994543c319677e4a333f700ec6580a061cb0fbdd6bcddf2d9

        • C:\Users\Admin\AppData\Local\Temp\RESEF2D.tmp

          Filesize

          1KB

          MD5

          ea0a1fedbd26175936f6352177a0b34e

          SHA1

          7deb79170d97421f69f1ab587c0f4c3fa009089c

          SHA256

          65c7a547b4946496f169f8670c0265c8f7f6db96c5cbce5e957e7de2319333d2

          SHA512

          f339a4fce1bbcac799205d59013e1496ed9f842f51376d20499ca8a69280ef36338ff8452618d3d4c9936a7672e3c8b739799a2475c68fb935e1b1f17a2b9185

        • C:\Users\Admin\AppData\Local\Temp\RESEFF9.tmp

          Filesize

          1KB

          MD5

          79ed036f786ca5739af160b80c745c3b

          SHA1

          ef4e6de06ff7fa8f97dfb08bbcad0980800af3c8

          SHA256

          9e76626520b3102c8089ab00584bc9acb5861dd174795eb3f10d233a44aa73b4

          SHA512

          9b9d8f71b66f7899608bc635e930fcb597ee0cf5a6e4421034096f7c78435f6dc76855f04c1888a4eae27a880f45f5362172fd02ba0320b11eb1d84ddfceb62e

        • C:\Users\Admin\AppData\Local\Temp\RESF085.tmp

          Filesize

          1KB

          MD5

          ada67a20eb9d3c7d885bdf6c514cb090

          SHA1

          506621e19ba2be8c397679bb5fc8b5a4376ed0c3

          SHA256

          3c5b1dba800a8acfbae2949bfbddffb068a7c5566243852b3755598805f49b9d

          SHA512

          0014cc6eda19f856485285bab191d016d00c6ea96e6badb1ea6f60b074972a2a27b4c9a19aa1b0d71e26c3b4c89f4da37684d6e2224cb4b469266e5af0e679a8

        • C:\Users\Admin\AppData\Local\Temp\RESF19E.tmp

          Filesize

          1KB

          MD5

          5edd11bb4a89543720dbdb535afeae0f

          SHA1

          2b70bf6a7b49e4fa9decaa898696eea134747d13

          SHA256

          c27fa1a7a31192830d194fa7eb658d7c5aac2ea7feb7c58cd2f4d755f35fcbf5

          SHA512

          de72595db09ea0079cbb7156c1308a2ed62afd627ffe8d9034718a40ecec72d92da13675e435981a8643d970902b887b8548fa054e2fa315aba244c5f94cb973

        • C:\Users\Admin\AppData\Local\Temp\RESF26A.tmp

          Filesize

          1KB

          MD5

          98546f44b7f1dbcbc86327bd28e88ce7

          SHA1

          102d1f9826cd656cd4ea0e3eb3ee758840eaa939

          SHA256

          b06f29e8491769307b2af5a90aa010ffd3dff3b8d89e5484bf042b1fe4eace3e

          SHA512

          ed7672b6e19e6acced77346785954e2f9b42c94405b825f18c1003ec608181ddd5ddd865a594a033787e543a54f1737455a96fa91d76ecbc405515c3dae40f85

        • C:\Users\Admin\AppData\Local\Temp\RESF306.tmp

          Filesize

          1KB

          MD5

          d06a92c2626219d6e997843dfc67f9b6

          SHA1

          48f7d4f7d202fdc15d4d2a2cf67e67c4f164d038

          SHA256

          464ca394ee5372ae8c2b398b64351cb441d0a1b2bc2e12d8d94be5e6a0d213f9

          SHA512

          d81aff4afd1bf2b6196f911c08f051866e881d72ac6c9bed3b4ae781d787289031fef4b6946c5779040c546e2e58f3fdfd1c24c9e62beda2a70e02ca8bd8e699

        • C:\Users\Admin\AppData\Local\Temp\RESF364.tmp

          Filesize

          1KB

          MD5

          b059fb816eb091cbef0697acf4eedd12

          SHA1

          1dc761e9fc8c46d2b8c48af850399ba8a17cc449

          SHA256

          c336ba82b8bd3ce7cc0daeb3817fad72ce909f13d25822b8b77bf277ca69cf8b

          SHA512

          d308093b5355960eba4829a0d3521da2c51bea286b03c1795cfb3c504f98f4da1d7c2f1f00627fd45e98909d5ac83fc796f537651bf54f6d9dc047cfbb18082d

        • C:\Users\Admin\AppData\Local\Temp\RESF3F0.tmp

          Filesize

          1KB

          MD5

          b555b517447f36815416d91e997b84dd

          SHA1

          2ab49aaa26c6d3d3fcb88476125b91212a2c04bc

          SHA256

          0c7a680d09e456437feef8ef21939007cd24c3cfda25f67998d7da10d295949b

          SHA512

          d0405194e0a0de2daed08842991be142ceb2b39f5f6cd62cf7614b2e5a84a25160ad63278885bb96367d2d142ec09bc5d18b12686cad6faee08fb3235637b63c

        • C:\Users\Admin\AppData\Local\Temp\RESF45E.tmp

          Filesize

          1KB

          MD5

          dfa90aa099d0646eb10edaa78a33b2e0

          SHA1

          7b317cbe758ec61911c3e0d3723318ca0fd40dfd

          SHA256

          3bc7bd97a92b6363bd9aa739b7515fd3e967cfcfd4919a5d4ba77b57f5ec9ba7

          SHA512

          258ad2cb2b4d8d327126a1d9e66206d8ff155dc1352dcfbf7da008fe82dd1db1eab5535835fd8d6e7e7b471cea7ffbffa472d2d68e909a156c1ab8e0c29ca562

        • C:\Users\Admin\AppData\Local\Temp\RESF4DB.tmp

          Filesize

          1KB

          MD5

          25e47fecaa8d196531f0c469ce374247

          SHA1

          47adc574fc15befeca68158813492aedee373ea3

          SHA256

          a704493a1d18552d89702e41e71497b4fe8f0dbdeb2ef996671aac3bdac79bbc

          SHA512

          7b76008d79d6af76cb92fb3111e0ac5851ce201a8c48a9758b4fb6a0f76beb2cde8d805f239892a3ef8f8515075a37b299cdfb089845cf4110bcdc0ef6941dff

        • C:\Users\Admin\AppData\Local\Temp\_4eamfyu.0.vb

          Filesize

          274B

          MD5

          05ab526df31c8742574a1c0aab404c5d

          SHA1

          5e9b4cabec3982be6a837defea27dd087a50b193

          SHA256

          0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430

          SHA512

          1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40

        • C:\Users\Admin\AppData\Local\Temp\_4eamfyu.cmdline

          Filesize

          167B

          MD5

          a84a1eca57d7ad44c812e3462882c13c

          SHA1

          a0d0d6c7a955f62e563c27648c000e681631d31f

          SHA256

          9d5c4ac4e64afd1444da07adf91c543f55950a7dd7001bb06c0cbec6531be9c8

          SHA512

          5e82441792e85208290021e6c72928de293b61b420a2c4afbe9c6bb46999307fc576099dc7dbfda5afeb7d1133b25091b4645b62cc8b426b4bc0ed5993fb2cb8

        • C:\Users\Admin\AppData\Local\Temp\el-ataqd.0.vb

          Filesize

          288B

          MD5

          af52f4c74c8b6e9be1a6ccd73d633366

          SHA1

          186f43720a10ffd61e5f174399fb604813cfc0a1

          SHA256

          2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07

          SHA512

          c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e

        • C:\Users\Admin\AppData\Local\Temp\el-ataqd.cmdline

          Filesize

          181B

          MD5

          f657b02a7d739f1a1d8dc83846590311

          SHA1

          e493a18814cf9701e9a84ba75e5ac585ea9ef1e4

          SHA256

          b01d3515fa03ccd3653d60a1341828ff922ec4e5e0f4b2e62b5ed6cd745b3d10

          SHA512

          bb31dfdba4bfd80b51318ceaf4794b05ed1be5f8039bef9654cf1f8f1508784e5700fc91d0c1d36354bdccabe564c69028e7941f34a8da29ca30c8b495c779b4

        • C:\Users\Admin\AppData\Local\Temp\fnluq7ep.0.vb

          Filesize

          284B

          MD5

          6989ad9512c924a0d9771ce7e3360199

          SHA1

          1bcc5312adf332719db83156f493ad365f5bdec6

          SHA256

          f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168

          SHA512

          13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536

        • C:\Users\Admin\AppData\Local\Temp\fnluq7ep.cmdline

          Filesize

          177B

          MD5

          fef4e8ef0480e49bdc85919d84e3bfba

          SHA1

          892cb47899db709e9daa6930d0533e1fd92c7e3b

          SHA256

          3f1bfafe73d495ed668937cb5c92073364565da8d947b158f41ce77384bde11d

          SHA512

          375574553bebed6326eb6fdb2c8108a17f1fad2866b2853cfa4729d5c0608a60e229e8a20037d930e1a00259b171097719ee1f23ed3647656f9ccf314aa9373f

        • C:\Users\Admin\AppData\Local\Temp\hjqpzhbk.0.vb

          Filesize

          268B

          MD5

          fe8760874e21534538e34dc52009e8b0

          SHA1

          26a9ac419f9530d6045b691f3b0ecfed323be002

          SHA256

          1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439

          SHA512

          24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed

        • C:\Users\Admin\AppData\Local\Temp\hjqpzhbk.cmdline

          Filesize

          161B

          MD5

          724320f8e7a22e0ed08a5edac1ac2e73

          SHA1

          cd7d8fb6454352ca44d672eca613867ae23a57fb

          SHA256

          9817767916c2835a0dbeb61f3fc7b92337a3834391bae78c78d95f2b029ed64f

          SHA512

          82558ca6dd93b3d931558a581241fd787945ff29f91d596c9645def6812e18392b1e2f8211517d131b379d97af4197bde29e74ba489dea6f51647c36d10c1db0

        • C:\Users\Admin\AppData\Local\Temp\lew2azfw.0.vb

          Filesize

          145B

          MD5

          61413d4417a1d9d90bb2796d38b37e96

          SHA1

          719fcd1e9c0c30c9c940b38890805d7a89fd0fe5

          SHA256

          24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7

          SHA512

          9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4

        • C:\Users\Admin\AppData\Local\Temp\lew2azfw.cmdline

          Filesize

          195B

          MD5

          ff8feeb65dbb95b55af2626def2eeae4

          SHA1

          957ff0fe121864daa2a49e602ada69085baf1fd4

          SHA256

          4580e9b8208f6c95cd683b04f95316e29dc125620d203ed0d24e9fb68338781e

          SHA512

          199be07a22cfa7270b2d3d85801af7463fccaf403b1071cdb71d2a0f244cbcc80278169dee1cf2847aed568f2a9ac746a582adaf52934ccca4057f1953c1a6d2

        • C:\Users\Admin\AppData\Local\Temp\nx0s9dep.0.vb

          Filesize

          278B

          MD5

          6d569859e5e2c6ed7c5f91d34ab9f56d

          SHA1

          7bcd42359b8049010a28b6441d585c955b238910

          SHA256

          3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78

          SHA512

          accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7

        • C:\Users\Admin\AppData\Local\Temp\nx0s9dep.cmdline

          Filesize

          171B

          MD5

          821fc36600b045b586a593521d93500b

          SHA1

          a76e9d655bca1c540e7f883a49baf78514f7c6e0

          SHA256

          1f893b0db622f8da03b43219f467a743ccc03d32b883d2b48a168b93ec1b0978

          SHA512

          0729c527287ed9b0360600e9458671425a1fae8a833760c09d70d7fb4e5a26a6a41784fe7f1002a913b75d375aae3257b01de1308ddec01ccb85aa4359d7fe5e

        • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe

          Filesize

          234KB

          MD5

          3d3e7a0dc5fd643ca49e89c1a0c3bc4f

          SHA1

          30281283f34f39b9c4fc4c84712255ad0240e969

          SHA256

          32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e

          SHA512

          93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68

        • C:\Users\Admin\AppData\Local\Temp\vbc125E0E66383B4A8E91F768B8B822E8E1.TMP

          Filesize

          684B

          MD5

          8135713eeb0cf1521c80ad8f3e7aad22

          SHA1

          1628969dc6256816b2ab9b1c0163fcff0971c154

          SHA256

          e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

          SHA512

          a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

        • C:\Users\Admin\AppData\Local\Temp\vbc4AD91232DAF4EA99F59826CA0D06D9E.TMP

          Filesize

          676B

          MD5

          85c61c03055878407f9433e0cc278eb7

          SHA1

          15a60f1519aefb81cb63c5993400dd7d31b1202f

          SHA256

          f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

          SHA512

          7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

        • C:\Users\Admin\AppData\Local\Temp\vbc502C26786D254895A7F6F226B9CF49C7.TMP

          Filesize

          644B

          MD5

          55335ad1de079999f8d39f6c22fa06b6

          SHA1

          f54e032ad3e7be3cc25cd59db11070d303c2d46d

          SHA256

          e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac

          SHA512

          ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca

        • C:\Users\Admin\AppData\Local\Temp\vbc688D5A1DA8AE4C0E9085DB9D4790A9CA.TMP

          Filesize

          684B

          MD5

          7a707b422baa7ca0bc8883cbe68961e7

          SHA1

          addf3158670a318c3e8e6fdd6d560244b9e8860e

          SHA256

          453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

          SHA512

          81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

        • C:\Users\Admin\AppData\Local\Temp\vbcAFF516EEFC7540B7A92BDFA6894359AF.TMP

          Filesize

          668B

          MD5

          3906bddee0286f09007add3cffcaa5d5

          SHA1

          0e7ec4da19db060ab3c90b19070d39699561aae2

          SHA256

          0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

          SHA512

          0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

        • C:\Users\Admin\AppData\Local\Temp\vbcFE15AD76391F4AEE89BDA73736E5D24.TMP

          Filesize

          644B

          MD5

          dac60af34e6b37e2ce48ac2551aee4e7

          SHA1

          968c21d77c1f80b3e962d928c35893dbc8f12c09

          SHA256

          2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

          SHA512

          1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

        • C:\Users\Admin\AppData\Local\Temp\vjykvorm.0.vb

          Filesize

          285B

          MD5

          b34b98a6937711fa5ca663f0de61d5bb

          SHA1

          c371025912ab08ae52ff537aaa9cd924dbce6dcc

          SHA256

          f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a

          SHA512

          2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f

        • C:\Users\Admin\AppData\Local\Temp\vjykvorm.cmdline

          Filesize

          178B

          MD5

          d45e63c6fc25265afc5e97c7047d40a7

          SHA1

          4f0e74774daf62779b9c5d92a79f9e3fdcbf69ef

          SHA256

          f26e3b2140a7e535a965b75cbf8b6ce3bdc2d9df8ec79b367ececf2f2fb2a0c6

          SHA512

          c8759fc83d6da5e39e1e6c7951dd7ffda907cfd0d895408fa0dbee39d584682a1bdf2312bba86f08f48524ccab26ea0967b665e36199434d74ca5da6739e1240

        • C:\Users\Admin\AppData\Local\Temp\ylbau5ux.0.vb

          Filesize

          284B

          MD5

          62caeb4021ea9d333101382b04d7ac1c

          SHA1

          ebe2bb042b8a9c6771161156d1abdce9d8d43367

          SHA256

          e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7

          SHA512

          e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c

        • C:\Users\Admin\AppData\Local\Temp\ylbau5ux.cmdline

          Filesize

          177B

          MD5

          5b120f172662f0188fd489fce89bd6c7

          SHA1

          d27934ead46c7af6222cd63731a58ff9830cdd8c

          SHA256

          910ea1ba3037167d8c1fd4ec781ad2e5f071a2de1c6232e7d8869b64902c22c5

          SHA512

          9368f436eff46d0ec2b845a75094d113e6bad4e5113337708909e3c6ebdad3a16a6a5008097519332b99a600acbb33ddf9c9ab2e001941123287e8cfcaa27631

        • memory/4396-14-0x0000000074762000-0x0000000074763000-memory.dmp

          Filesize

          4KB

        • memory/4396-24-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/4396-15-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/4396-12-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/4396-13-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/4396-11-0x0000000074762000-0x0000000074763000-memory.dmp

          Filesize

          4KB

        • memory/5304-22-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/5304-16-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/5304-20-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/5304-23-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/5304-25-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB

        • memory/5304-17-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/5304-38-0x0000000074760000-0x0000000074D11000-memory.dmp

          Filesize

          5.7MB