Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 06:35

General

  • Target

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

  • Size

    21KB

  • MD5

    6fe3fb85216045fdf8186429c27458a7

  • SHA1

    ef2c68d0b3edf3def5d90f1525fe87c2142e5710

  • SHA256

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

  • SHA512

    d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

  • SSDEEP

    384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • RevengeRat Executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
    "C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Windows\system32\MSSCS.exe
      "C:\Windows\system32\MSSCS.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4808
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2332
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kycsvriw.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2AD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc10FC02529754FF6964D60491E6C46CC.TMP"
          4⤵
            PID:3280
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\adbnoku0.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:552
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD387.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFE451DE6CBB94E6F87D7719856132B3.TMP"
            4⤵
              PID:4596
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\n-kvktmj.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3132
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD452.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1A19EA8634C8425291771E2FD2F0E7DA.TMP"
              4⤵
                PID:372
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cn3lnx1t.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5104
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD4CF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4091B41FB8224806B46BC519B2151554.TMP"
                4⤵
                  PID:2792
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\w9df8tt9.cmdline"
                3⤵
                  PID:4280
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD53D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8A8AAB47924353B9334F1793F9345D.TMP"
                    4⤵
                      PID:2776
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\s5mtz_fn.cmdline"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:988
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5AA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE1778FB527B941A6A0BBB04BD6EF5CC.TMP"
                      4⤵
                        PID:1680
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hy6uzdsx.cmdline"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4000
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD618.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC73764B856F94A23BE77C3302A501198.TMP"
                        4⤵
                          PID:3604
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r4cwkroy.cmdline"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2860
                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD685.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc80C88E62D08D4E0BB61DBE8E21B83034.TMP"
                          4⤵
                            PID:1552
                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oqqkrj4-.cmdline"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1448
                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6E3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF2561214FB4F496A91847FF0EDA872E.TMP"
                            4⤵
                              PID:1640

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\RESD2AD.tmp

                              Filesize

                              1KB

                              MD5

                              673365b98b3adafdffe3d4f9b31d98e6

                              SHA1

                              cad12e9a37dc4210d5b2d6dc8f569bd430cfcf8f

                              SHA256

                              347875a36602a3c2878e41888240b27a72adca21cc478966bca6139e3a363096

                              SHA512

                              cdd4d4114aabd0ed32e76e03f824b347888455559967cf6e692a5f7420e331d055340537e3b57e67e1a65e25ffd099b84c63c5d18dfa83d5ec6a7ab8ed9d84eb

                            • C:\Users\Admin\AppData\Local\Temp\RESD387.tmp

                              Filesize

                              1KB

                              MD5

                              6dfffc226556aec2806091263f60bb50

                              SHA1

                              c5c3e79eed597c98c0f1fe0931d65479c90c6416

                              SHA256

                              7f2fb529447cbbd6a7e73442f55b4ce72f4af5ab7fd64b136bd1e29d9e8e8ca8

                              SHA512

                              33c0c5eaaa668c58aa4aaa0973fd3ecfc79a33927a98e30f97cdc136d0e72b3ad8f21d737945a82ea8db66e28ac36bccc0ee384fe5acf70fa58d155a6cde2f99

                            • C:\Users\Admin\AppData\Local\Temp\RESD452.tmp

                              Filesize

                              1KB

                              MD5

                              4fdf94ac1d009e03a7723a90d34c47c5

                              SHA1

                              3afad77e0898d5033bd14b6be99062c142733f69

                              SHA256

                              afa3f3024960b668ac2013739cfb11e6346fb43c136ed745849bbbb0529810f1

                              SHA512

                              8f385b895767ba4b17f390027cf3f3a0938c0bfd675baa876abeee2ad4ae12ae003af4180260dc2cfd3b47af483bf95d8313d096dc92598ef0c613322e47bc94

                            • C:\Users\Admin\AppData\Local\Temp\RESD4CF.tmp

                              Filesize

                              1KB

                              MD5

                              5f6776c916d6c58871185e2c00fa7cf6

                              SHA1

                              8e0aaaf85f5e07601147cf596ebe9eee63f43a80

                              SHA256

                              0a6c30350a77d5aa054ae9c91c45e683421bdf93c4d2279041b130d201f251b6

                              SHA512

                              3814ca27df39f7774a123afc52e732e40d3cb6301cdf6c16a2a95485766283f5cdfbe36a4bce1472e7fea6b619b46fd7cebb8207e764c42d8ef199233c7109b5

                            • C:\Users\Admin\AppData\Local\Temp\RESD5AA.tmp

                              Filesize

                              1KB

                              MD5

                              227ff3c762e198e81552daefc8541254

                              SHA1

                              f4942a07371a5358d379a97155a92a6e4777b7b8

                              SHA256

                              c6e98dcc1c40b4c65270c29aa72b4873c3d2f93236546c50dc067bbb1bae2666

                              SHA512

                              24b158b147cada122d3261acfb88e70e29447e5d03115ec4f004c2130daeecf5eae1b589faa8483a7006cd7a02be921d171f246577c4cda62afaf57be1e154ee

                            • C:\Users\Admin\AppData\Local\Temp\RESD618.tmp

                              Filesize

                              1KB

                              MD5

                              2125880e75574326bc6a3bd975bac30a

                              SHA1

                              2c04f9ee907694142590aa7455f19bfc55b957ea

                              SHA256

                              4ee93ad0bb9ea380bab2f4898d2b0cbdb72c5887c1e28e4ac93e20e7f07ff0a5

                              SHA512

                              21f5093dd310cba519bf88798540c47072baba636c1e68dac45e3222504de586c739f6d9857c68c89963248e092062368b9bb1f0dadf4c7094142f013e645262

                            • C:\Users\Admin\AppData\Local\Temp\RESD685.tmp

                              Filesize

                              1KB

                              MD5

                              f1d8befa870a9dc5429ccaff8be0d384

                              SHA1

                              222c5ae560fdbc1dcb3d2a8cf188964fa5b0f1d3

                              SHA256

                              d2305999af2bd8e64caf83ad6aca87ce143223bfaf66e468d4c3c77615b51d26

                              SHA512

                              bdb00446fc70583e77f56aea9160d826d7f23c1cc130886e7d13a43fc8502dcb7064cbf39aa0ec2d27e75a2e3f7f1a14a085e9efd317feec0a567276e043b00f

                            • C:\Users\Admin\AppData\Local\Temp\RESD6E3.tmp

                              Filesize

                              1KB

                              MD5

                              0bff8285a122a56560826a452d9ff9fc

                              SHA1

                              a4a1a62ecccc516c874f062ab3130bd6a34e37a4

                              SHA256

                              a4fd7ed0824af7af676f70689724fe49908f8cd20e912f98d8cb1842eb3301e7

                              SHA512

                              3811cbe1d28bdbc4d9b57bd6c9a0696cc805b70a65393072a1e3e2efd800c564420a81bfd603241570cbab27d07deecf3893f5138ae9aa4311fc4c7fc8c5bc0a

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_njget0zd.foq.ps1

                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            • C:\Users\Admin\AppData\Local\Temp\adbnoku0.0.vb

                              Filesize

                              262B

                              MD5

                              88cc385da858aaa7057b54eaeb0df718

                              SHA1

                              b108224d4686b5ca3faaeb1c728dfba8740a6eca

                              SHA256

                              08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020

                              SHA512

                              4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7

                            • C:\Users\Admin\AppData\Local\Temp\adbnoku0.cmdline

                              Filesize

                              162B

                              MD5

                              de04decc2a5802ba9a02e54bb50c4c43

                              SHA1

                              379fb652e22e089b4653bc29d491e34298495fcf

                              SHA256

                              72ee9636597998664996daa0295e4d02dc860b72d66c25f0ebef69d2f7dc2666

                              SHA512

                              e4a61fd5fe26e10a9cc914edc04a4d32515d69e0d98a42bbd38557d5e9b04383df5d254f0e6ef5d49e50371ec6e9000e87f900efe741bab7e33da2edd1f337be

                            • C:\Users\Admin\AppData\Local\Temp\cn3lnx1t.0.vb

                              Filesize

                              272B

                              MD5

                              2b3aac520562a93ebef6a5905d4765c9

                              SHA1

                              10ab45c5d73934b16fac5e30bf22f17d3e0810c8

                              SHA256

                              b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89

                              SHA512

                              9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446

                            • C:\Users\Admin\AppData\Local\Temp\cn3lnx1t.cmdline

                              Filesize

                              172B

                              MD5

                              2f1fb317c2763fd16b76c0aa1b3a61b0

                              SHA1

                              fe19f0b808cee06f546dad37e36a4111a85c543e

                              SHA256

                              ddf84d3e211d6cdcb447243849bb8e64ef26f1ba1d1f3228d385a47dda5bfc2a

                              SHA512

                              e4534a93a607c8f457d6bf4fead02a88045c831f117817640d65f6f327184930e1ea18b739064caec9d86b414398f9d63579e96a7de9486f7abd690136df88df

                            • C:\Users\Admin\AppData\Local\Temp\hy6uzdsx.0.vb

                              Filesize

                              264B

                              MD5

                              5ce3977a153152978fa71f8aa96909e9

                              SHA1

                              52af143c553c92afc257f0e0d556908eaa8919cb

                              SHA256

                              e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed

                              SHA512

                              eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

                            • C:\Users\Admin\AppData\Local\Temp\hy6uzdsx.cmdline

                              Filesize

                              164B

                              MD5

                              c732dda234181144f0ab8d9819c4dd59

                              SHA1

                              ec9467ab87ba0c523cd929abd8ea3abbd1263014

                              SHA256

                              d50bd3c52e96d0dcc7c6dd1c9dbb7c7c9eac7f3821b08d9df5199b43546f860c

                              SHA512

                              f2699497dcb2ec6c53e1203e4f7cbfdd6d711f3a8eb086c2963edfacce67ec9df42bd44cf411544089168b817205a27a087c05321a18ea64bf6b45eb794a0f55

                            • C:\Users\Admin\AppData\Local\Temp\kycsvriw.0.vb

                              Filesize

                              256B

                              MD5

                              076803692ac8c38d8ee02672a9d49778

                              SHA1

                              45d2287f33f3358661c3d6a884d2a526fc6a0a46

                              SHA256

                              5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3

                              SHA512

                              cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d

                            • C:\Users\Admin\AppData\Local\Temp\kycsvriw.cmdline

                              Filesize

                              156B

                              MD5

                              7c35a7de4d569a0acb511d702e20ca39

                              SHA1

                              a9d0beccf71d7d057c1b97bfc38a66a05a89e1fa

                              SHA256

                              27e8d7948689e3a9eae53c3bfdd05413e8cd1287918f03649157661cac82497a

                              SHA512

                              2ceed26b0901f7a05d2d54e125084f047913497221c6f87232e0f2a29be569203269e03a5fbc677211b12e1ce6c28c131751a85cca4497c4abbc4565c5f2e768

                            • C:\Users\Admin\AppData\Local\Temp\n-kvktmj.0.vb

                              Filesize

                              271B

                              MD5

                              ac972015bef75b540eb33503d6e28cc2

                              SHA1

                              5c1d09fcf4c719711532dcfd0544dfc6f2b90260

                              SHA256

                              fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7

                              SHA512

                              36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

                            • C:\Users\Admin\AppData\Local\Temp\n-kvktmj.cmdline

                              Filesize

                              171B

                              MD5

                              2ab1781d3c3855da2b1a8c25091d4952

                              SHA1

                              9f45c498b7e657bb8f86f80ac7f9e7924aeb8995

                              SHA256

                              9c69a7d8e833a04c26f0b855b7d5ccb983b84bf6a33fc2365202ef81b3d87293

                              SHA512

                              d25fbbbd35761d5b7833f2e39af845963673ddea308dfe36aebcdc9e7cfbcd4bc396889ea54ebc1f8a1df24119d97df7302044c53688622b6f0a883c1ee1dbbf

                            • C:\Users\Admin\AppData\Local\Temp\oqqkrj4-.0.vb

                              Filesize

                              273B

                              MD5

                              3c3d3136aa9f1b87290839a1d26ad07a

                              SHA1

                              005a23a138be5d7a98bdd4a6cc7fab8bdca962f4

                              SHA256

                              5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd

                              SHA512

                              fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

                            • C:\Users\Admin\AppData\Local\Temp\oqqkrj4-.cmdline

                              Filesize

                              173B

                              MD5

                              43543448c01e451ca38061e9c0bcefa8

                              SHA1

                              22048c67d60910e5800859111e2770255bbefa2c

                              SHA256

                              de035b918bba96d479e53bb81440137c3a5701f1bbdb553e85538d82f919a426

                              SHA512

                              f8ec499533f9b93886b80cde74fd3c8d7852c24d370f0dcc336334c7a1a3d00ec920b3365f87f405b12ac102a113a5f82c728a6074ec56e6dbcdeb5a7ac6018a

                            • C:\Users\Admin\AppData\Local\Temp\r4cwkroy.0.vb

                              Filesize

                              270B

                              MD5

                              658573fde2bebc77c740da7ddaa4634b

                              SHA1

                              073da76c50b4033fcfdfb37ba6176afd77b0ea55

                              SHA256

                              c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607

                              SHA512

                              f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

                            • C:\Users\Admin\AppData\Local\Temp\r4cwkroy.cmdline

                              Filesize

                              170B

                              MD5

                              8b59f4c3cea43ae74d9b5d57dee5443f

                              SHA1

                              e90759efc4cf4afc4ecbedd241c4f4becc2cf8ac

                              SHA256

                              7c6802a9c68a3d800b48e64354437b848c558c0fe4152d982f3e3393ab1aa6f3

                              SHA512

                              259d7b19d9945086583822274efeb60529cd78dbdfe8b292c83adc5d1c5cb0d44530f494d73109a56f863a4052f63e44b977e6244a04372a7be901ccc2c13389

                            • C:\Users\Admin\AppData\Local\Temp\s5mtz_fn.0.vb

                              Filesize

                              274B

                              MD5

                              539683c4ca4ee4dc46b412c5651f20f5

                              SHA1

                              564f25837ce382f1534b088cf2ca1b8c4b078aed

                              SHA256

                              ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e

                              SHA512

                              df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac

                            • C:\Users\Admin\AppData\Local\Temp\s5mtz_fn.cmdline

                              Filesize

                              174B

                              MD5

                              817ab9a388ce1067376693e3d1c13928

                              SHA1

                              f06c73f3d6c11c16550a51c1e8f98000c885eb35

                              SHA256

                              c6ed5bc7f0c054869dc879a81e2b1abdd481fabb919ed9f0ddd13be6531ba3a2

                              SHA512

                              ea31ce14399070bee07bd247a5128eabc44bd0243c8e804c1add978b319be259b20776902d9832aa265919c85919af7d022416f3990e1c78a0fe2be12c184171

                            • C:\Users\Admin\AppData\Local\Temp\vbc10FC02529754FF6964D60491E6C46CC.TMP

                              Filesize

                              644B

                              MD5

                              dac60af34e6b37e2ce48ac2551aee4e7

                              SHA1

                              968c21d77c1f80b3e962d928c35893dbc8f12c09

                              SHA256

                              2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                              SHA512

                              1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

                            • C:\Users\Admin\AppData\Local\Temp\vbc4091B41FB8224806B46BC519B2151554.TMP

                              Filesize

                              676B

                              MD5

                              85c61c03055878407f9433e0cc278eb7

                              SHA1

                              15a60f1519aefb81cb63c5993400dd7d31b1202f

                              SHA256

                              f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

                              SHA512

                              7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

                            • C:\Users\Admin\AppData\Local\Temp\vbcE1778FB527B941A6A0BBB04BD6EF5CC.TMP

                              Filesize

                              684B

                              MD5

                              8135713eeb0cf1521c80ad8f3e7aad22

                              SHA1

                              1628969dc6256816b2ab9b1c0163fcff0971c154

                              SHA256

                              e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

                              SHA512

                              a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

                            • C:\Users\Admin\AppData\Local\Temp\vbcF2561214FB4F496A91847FF0EDA872E.TMP

                              Filesize

                              684B

                              MD5

                              7a707b422baa7ca0bc8883cbe68961e7

                              SHA1

                              addf3158670a318c3e8e6fdd6d560244b9e8860e

                              SHA256

                              453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

                              SHA512

                              81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

                            • C:\Users\Admin\AppData\Local\Temp\vbcFE451DE6CBB94E6F87D7719856132B3.TMP

                              Filesize

                              668B

                              MD5

                              3906bddee0286f09007add3cffcaa5d5

                              SHA1

                              0e7ec4da19db060ab3c90b19070d39699561aae2

                              SHA256

                              0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                              SHA512

                              0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                            • C:\Windows\System32\MSSCS.exe

                              Filesize

                              21KB

                              MD5

                              6fe3fb85216045fdf8186429c27458a7

                              SHA1

                              ef2c68d0b3edf3def5d90f1525fe87c2142e5710

                              SHA256

                              905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

                              SHA512

                              d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

                            • memory/2332-36-0x0000014EF18D0000-0x0000014EF18F2000-memory.dmp

                              Filesize

                              136KB

                            • memory/4456-6-0x000000001C3D0000-0x000000001C46C000-memory.dmp

                              Filesize

                              624KB

                            • memory/4456-4-0x000000001BC00000-0x000000001BC62000-memory.dmp

                              Filesize

                              392KB

                            • memory/4456-1-0x000000001B510000-0x000000001B9DE000-memory.dmp

                              Filesize

                              4.8MB

                            • memory/4456-3-0x000000001BA90000-0x000000001BB36000-memory.dmp

                              Filesize

                              664KB

                            • memory/4456-2-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4456-9-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4456-8-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4456-7-0x00007FFE58225000-0x00007FFE58226000-memory.dmp

                              Filesize

                              4KB

                            • memory/4456-22-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4456-5-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4456-0-0x00007FFE58225000-0x00007FFE58226000-memory.dmp

                              Filesize

                              4KB

                            • memory/4808-20-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4808-19-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4808-23-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB

                            • memory/4808-18-0x00007FFE57F70000-0x00007FFE58911000-memory.dmp

                              Filesize

                              9.6MB