Resubmissions

09/05/2025, 14:24

250509-rqz93svyhv 10

Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 06:42

General

  • Target

    REVENGE-RAT.js

  • Size

    1.2MB

  • MD5

    8ff99e0a81c684cefbc2a752c44f30a1

  • SHA1

    61b8dbc7483abcb72d2c633e6309feb26ac16eb0

  • SHA256

    4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e

  • SHA512

    7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364

  • SSDEEP

    24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

C2

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
      "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
        "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Users\Admin\Documents\foldani.exe
          "C:\Users\Admin\Documents\foldani.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Users\Admin\Documents\foldani.exe
            "C:\Users\Admin\Documents\foldani.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2376
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sac1uvp5.cmdline"
              6⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5516
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB1B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2DC16CB02B9341F3BAB70C73FD6FEA2.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1868
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:5656
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lpidtsm1.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5644
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCBD7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc49CB104C949640BD861B5FEB61264052.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4468
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\h0urjw9y.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3080
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC82.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc179C0D5ACC364DB7A3652134AF42FDB6.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5172
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\okafoi7c.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5728
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD7C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2EFE64F0861848DE879D7A4DB6C6792.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2012
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xds9aaqx.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1692
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE67.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2953CF0E6F1442FDAF9C29A285D46CCB.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:1320
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\3lrrxqdy.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:916
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF13.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD87101DEB6A84FABA8A82DA7C8666766.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4344
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\octzpirm.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:968
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF80.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBD2A87099FC042938A2EBFEE98937F3.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2928
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gsfness9.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5584
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFED.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc58967EFA420D4BD0983939E84D86739.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5196
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dtm8hnby.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5792
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD06A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA7485447CB640B6B7625BF956AF1FD.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3580
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fqjyyenh.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5508
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0D8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc643A7F4CB1A74A36BD4F56DD8656FC41.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5752
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\Documents\foldani.exe
      C:\Users\Admin\Documents\foldani.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:5100
      • C:\Users\Admin\Documents\foldani.exe
        "C:\Users\Admin\Documents\foldani.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5776

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log

          Filesize

          496B

          MD5

          cb76b18ebed3a9f05a14aed43d35fba6

          SHA1

          836a4b4e351846fca08b84149cb734cb59b8c0d6

          SHA256

          8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

          SHA512

          7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

        • C:\Users\Admin\AppData\Local\Temp\3lrrxqdy.0.vb

          Filesize

          285B

          MD5

          b34b98a6937711fa5ca663f0de61d5bb

          SHA1

          c371025912ab08ae52ff537aaa9cd924dbce6dcc

          SHA256

          f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a

          SHA512

          2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f

        • C:\Users\Admin\AppData\Local\Temp\3lrrxqdy.cmdline

          Filesize

          178B

          MD5

          09d9a99c71118eb13881bf05ca756445

          SHA1

          f9c9ea9487d5c040882b18717e73787904779a3e

          SHA256

          e8726e93da785e87c06a942d150adbadc0b81cd58a45240145f94ee1331f730e

          SHA512

          6ba41a70073ef3fc6bbde33e54eab53a290a687e0d1bc6e2f4943c3976ee3c19f8c887444716c94fe627f861b6ae20c808d7d30d15900ca64a204d636f23ae57

        • C:\Users\Admin\AppData\Local\Temp\RESCB1B.tmp

          Filesize

          1KB

          MD5

          89950eea84bcc1a874e75646aa13724c

          SHA1

          4c5c1827bd66f2e57ba4dd398bc848bd573e483f

          SHA256

          fceebd6f4f88fffc72b8a36dd86d1cfa6b5170d29d43ca3c7eb11973463cb9bb

          SHA512

          ea04e45d92dbf62a7d257e497515e07c9b4c5945e088c7e622eac66695088c01f1d7de1df24652d778f4dfb987be3189146200cde8a8c9df5288976c608eadd0

        • C:\Users\Admin\AppData\Local\Temp\RESCBD7.tmp

          Filesize

          1KB

          MD5

          7b945fef5cdbdbc5915e85cd6c58e799

          SHA1

          3b03ab855024ae20522a6ba15641ae70ba16c2e1

          SHA256

          0153716452b4d302bc58ac6d8f5e19d499e804dd343e0e26e8b863fd552a25b9

          SHA512

          542c29c0239027fcc12d935a3ff5c649be77f19b2ca5c1cfdb6f94c731b076394af436e295e099341aa6f8150128c8941f423bc0a3688769070d73d3b32a4d93

        • C:\Users\Admin\AppData\Local\Temp\RESCC82.tmp

          Filesize

          1KB

          MD5

          6383a0fce0f4a4207b52ec781318151f

          SHA1

          8e67630139b35d1e7c9b24a3c30bc8bd2ea08972

          SHA256

          ca63bad6f437b888c60b4c958f377cc4c282f65f9124e4ecc9353d138b19b837

          SHA512

          5b8b54945809d14a06dc5291e12c9ce9f650a767236becfe6d65ecee6868ba581a379d245c45cf96e1f6119edcba520e7177740c72e8d0be7d3279ae441f60cb

        • C:\Users\Admin\AppData\Local\Temp\RESCD7C.tmp

          Filesize

          1KB

          MD5

          9edc2c1375f6777dd608a7d90c4efa12

          SHA1

          0850ff758eb1e7f48193a0750af4b604f03a49dd

          SHA256

          ee81723600cd93467090fc657b3b62d69a4543fb8706cfb268cccea331309d85

          SHA512

          0f7604853e0cc7e3b863c1fd80d4a69e77e03778817dc77994538e450963923531b2c190b11bd43b92f21a69db0fe68bbe34523c1e2f6bffd0e760ed79b2f38e

        • C:\Users\Admin\AppData\Local\Temp\RESCE67.tmp

          Filesize

          1KB

          MD5

          4e46093d1fdb5f06109268058ee4d2ac

          SHA1

          a3d95e21312a62a0e51a85fd5659f6c386ec2af7

          SHA256

          9d83b9a25fa7789d20fb81d49bf380e12a0c5f13d34bdcc67bc3106362f40022

          SHA512

          3710f6a3b8c980f2f405fd1299c32dd6a995fb5f8f559423f3c9ebbcf677fba349a0a1162cccc655b7485560c3654dcf19e732cc4ff52de376e659a17430d022

        • C:\Users\Admin\AppData\Local\Temp\RESCF13.tmp

          Filesize

          1KB

          MD5

          758272c2c0dbad412f52e9265b74e430

          SHA1

          5827822fecc9f916db611ecf813eb83eacb56c87

          SHA256

          3713fbbdf41c86548cf955ea0ded677f9074eeaef0465ebb201000e2851ef9fe

          SHA512

          a67d69d0e91fc8c5d28fcdf49d1e1a1e5e8c7f47000e514b2262bfb27e998ccce805cb34bc1049b861187042af345628a7f0a06279ad4274706d60de75cd1983

        • C:\Users\Admin\AppData\Local\Temp\RESCF80.tmp

          Filesize

          1KB

          MD5

          4888089fcec3364049e2f9e62728d5e2

          SHA1

          a63700058cd5f3bebc4491e2fc00c5e7beae6225

          SHA256

          f82d7a64ce4f30ed02579ec870c7b3d0d583b6560f90f3975f4dcdce2d16b89a

          SHA512

          0a9d5fbf4c6c01df1c2fc8008d876713f81356af307d1d6459815af9eb3c632f8c43649a421c8243f656ffb0bdf9b1736a4c77ecf1bd6cc6309d45da6b866ddf

        • C:\Users\Admin\AppData\Local\Temp\RESCFED.tmp

          Filesize

          1KB

          MD5

          7b3df6166a030975e4fc0494f3e2629c

          SHA1

          36b0161740f83f5b32ffa015c1afdf7582c859c6

          SHA256

          c8d7251291f79f453f8cacd02e09b30aaf6885076295f2182a4fceff246db65e

          SHA512

          a1b916912e2c8daf3df4753d1671219735092812aa6fadca1696e596c7747af0654abe7ad017f5b8205e2443b89a301492867ceca5850753b4a4d2f7e773c36f

        • C:\Users\Admin\AppData\Local\Temp\RESD06A.tmp

          Filesize

          1KB

          MD5

          a311e34d9980039829e5aea8d8d39e68

          SHA1

          a097597e333fe3b948aa58fc16e11b8c2517d64f

          SHA256

          fc5f557940eafd99fe45d5143e88fb7b205b6e8ec176dd2eb23e51149b1a8de5

          SHA512

          b83def83f2eb58a8aacf5415f7473cc42cd83905bfaa0ff3db9ddc82875210bccd8fc17a3041164092c3fdd257271dc3a0c4b0f12b3b7ff5663ca939a8423b1e

        • C:\Users\Admin\AppData\Local\Temp\RESD0D8.tmp

          Filesize

          1KB

          MD5

          9b66024e64c54b1eecf83dc49651f6df

          SHA1

          a8011c7bac6424d1aa150f16d84926435d2795c3

          SHA256

          662690f12fb3bda3329fdf62588a391e1067c8bf6546b3a7627a3cc7b23cd614

          SHA512

          34cb74dc807a08f38cb92162adcd153f08a7206c0c0817bf3250802870fba90fbc9ec9ab888b032351a9539d1df882af57ef1b03ec1d68b1f467809c753dd56b

        • C:\Users\Admin\AppData\Local\Temp\dtm8hnby.0.vb

          Filesize

          284B

          MD5

          62caeb4021ea9d333101382b04d7ac1c

          SHA1

          ebe2bb042b8a9c6771161156d1abdce9d8d43367

          SHA256

          e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7

          SHA512

          e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c

        • C:\Users\Admin\AppData\Local\Temp\dtm8hnby.cmdline

          Filesize

          177B

          MD5

          5e728cac78f7d390019f376bc0cc6f47

          SHA1

          871e911c6fc0ba3c19f172f0034affd331d5b658

          SHA256

          345478188dee899320d787c66e662ead918ea7e9615bc3f0ab08a756ca9c30ff

          SHA512

          0d1845db038c9c98f3aaade2c3b53c24f42772a49199023cd45680513e3fc5815fc841934fe8a2e506d2163df76da36e90e6f6ed1866c80a7c48d370cb8b73bf

        • C:\Users\Admin\AppData\Local\Temp\fqjyyenh.0.vb

          Filesize

          287B

          MD5

          9cc0fccb33a41b06335022ada540e8f9

          SHA1

          e3f1239c08f98d8fbf66237f34b54854ea7b799a

          SHA256

          b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49

          SHA512

          9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb

        • C:\Users\Admin\AppData\Local\Temp\fqjyyenh.cmdline

          Filesize

          180B

          MD5

          4150052d049e80a9a45ecbf2ed8fc84e

          SHA1

          8baf8bc33393575738ea04b0c8f50581279d71a7

          SHA256

          1563a5b5b0cf87bce1619e154565092d084b03f8da3aa67099df596750540bc5

          SHA512

          d09d46a7817cc3a46c5f59ab6fa87ce66a19a89fd61e9e3a0d47067d2becd589711a9bb752efbbddbda721107ba52b7fbc57a80ecd0408140f28b942d292f2f0

        • C:\Users\Admin\AppData\Local\Temp\gsfness9.0.vb

          Filesize

          278B

          MD5

          6d569859e5e2c6ed7c5f91d34ab9f56d

          SHA1

          7bcd42359b8049010a28b6441d585c955b238910

          SHA256

          3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78

          SHA512

          accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7

        • C:\Users\Admin\AppData\Local\Temp\gsfness9.cmdline

          Filesize

          171B

          MD5

          ed5e77b29d05e9be9987f3f2209b3668

          SHA1

          941c3a2a93fc5ac3170ceef818467b34c56d2403

          SHA256

          ded29c69a36edb5d79b92ab3d489d402a33bfe0ae26fbf9fd823c70c7dcd468d

          SHA512

          ed4cc364e80ee8273b16b8c6672b498fca85d8a9111ae6f04b1aa0e75b5cb63fcd773ce379ac70d1f2e36d46990a6f1e32ea64fec7ecaec5cf5955af6d05417c

        • C:\Users\Admin\AppData\Local\Temp\h0urjw9y.0.vb

          Filesize

          274B

          MD5

          05ab526df31c8742574a1c0aab404c5d

          SHA1

          5e9b4cabec3982be6a837defea27dd087a50b193

          SHA256

          0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430

          SHA512

          1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40

        • C:\Users\Admin\AppData\Local\Temp\h0urjw9y.cmdline

          Filesize

          167B

          MD5

          4050a880ff3d86bdaeb1ba219f163b76

          SHA1

          01f2230a1271724ddc29feda87c00504316c23e6

          SHA256

          650fb8d3af059c1ddd503a2d7e392272a77882b364fe615144653d1aa25cff93

          SHA512

          16b34971cdcb20740775fe9e5851b4eb224e3a79e646c3e95fe8a4556e4cf94915a19cdf2684e424ba9fe5750e62fe035f2f89a6d06655a1ef249cead9f93790

        • C:\Users\Admin\AppData\Local\Temp\lpidtsm1.0.vb

          Filesize

          268B

          MD5

          fe8760874e21534538e34dc52009e8b0

          SHA1

          26a9ac419f9530d6045b691f3b0ecfed323be002

          SHA256

          1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439

          SHA512

          24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed

        • C:\Users\Admin\AppData\Local\Temp\lpidtsm1.cmdline

          Filesize

          161B

          MD5

          d9a4bc75c9bdaa927375062da2825176

          SHA1

          95d558764c7a209354c8c1f398b86e387acf8974

          SHA256

          8509337381b9b3e9b32179e9b6cd2525b0f1e800bb7dc19e7956bece69d21406

          SHA512

          c85a1d0c7dbd5540b9a88cf86e812c3ec316a0379e383a4f8186a82e06f5b3b7b3e3690c603e29b481d7040f165af22f6c86fcdc39915776c40e4d64dc1e4e1c

        • C:\Users\Admin\AppData\Local\Temp\octzpirm.0.vb

          Filesize

          288B

          MD5

          af52f4c74c8b6e9be1a6ccd73d633366

          SHA1

          186f43720a10ffd61e5f174399fb604813cfc0a1

          SHA256

          2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07

          SHA512

          c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e

        • C:\Users\Admin\AppData\Local\Temp\octzpirm.cmdline

          Filesize

          181B

          MD5

          aa9fba96f446ad6315a3d5d8538b43ce

          SHA1

          38db9d8c2d2441def7cecf348c96fe7b34a9d5c4

          SHA256

          ec176f4a1ce9f096a7edbac94dcf764fa7423f550b08fee056b033f93792d922

          SHA512

          6a5a1df8dd78a568453e93346adf69accbbad1f13424494a37be4a7728c6d87c7ff321e2b616c17fa7ce4569796053def1be07c5a83f1d1633cc06c639ff5361

        • C:\Users\Admin\AppData\Local\Temp\okafoi7c.0.vb

          Filesize

          284B

          MD5

          6989ad9512c924a0d9771ce7e3360199

          SHA1

          1bcc5312adf332719db83156f493ad365f5bdec6

          SHA256

          f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168

          SHA512

          13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536

        • C:\Users\Admin\AppData\Local\Temp\okafoi7c.cmdline

          Filesize

          177B

          MD5

          cf62482f53a35b241597c557b58a06d4

          SHA1

          3a2728c073e9fe4bc939559768d30769ade62d6c

          SHA256

          f2b883a9692f06d1286154c190459d090117c4a9a0eaf9326a61a061e8827553

          SHA512

          1f7d06b4802a6e573fffa772f0f8ea2e3f5b0cb2119860b58dbf350f73e97043c791db2d0b885de72c2295d3fea339f6b75f7241d2728e59f5dce25f0062999f

        • C:\Users\Admin\AppData\Local\Temp\sac1uvp5.0.vb

          Filesize

          145B

          MD5

          61413d4417a1d9d90bb2796d38b37e96

          SHA1

          719fcd1e9c0c30c9c940b38890805d7a89fd0fe5

          SHA256

          24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7

          SHA512

          9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4

        • C:\Users\Admin\AppData\Local\Temp\sac1uvp5.cmdline

          Filesize

          195B

          MD5

          6046e0fb52032182bf4ecb611506b6b7

          SHA1

          7f6a52e21d42b89e05493dab24436a51470cf9c2

          SHA256

          ff25753b25a8177fece676d52af1d74531d0259d1d3af477a68ca3db18e6719b

          SHA512

          260483666f4f5b2521f80904646249de1adeb4ba4c0f98b73b4ecf446602c3c08cf25821c8fb1869290e9af3f78cb95f5dbb231099a890fd73f2fe15af34e314

        • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe

          Filesize

          234KB

          MD5

          3d3e7a0dc5fd643ca49e89c1a0c3bc4f

          SHA1

          30281283f34f39b9c4fc4c84712255ad0240e969

          SHA256

          32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e

          SHA512

          93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68

        • C:\Users\Admin\AppData\Local\Temp\vbc179C0D5ACC364DB7A3652134AF42FDB6.TMP

          Filesize

          668B

          MD5

          3906bddee0286f09007add3cffcaa5d5

          SHA1

          0e7ec4da19db060ab3c90b19070d39699561aae2

          SHA256

          0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

          SHA512

          0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

        • C:\Users\Admin\AppData\Local\Temp\vbc2953CF0E6F1442FDAF9C29A285D46CCB.TMP

          Filesize

          676B

          MD5

          85c61c03055878407f9433e0cc278eb7

          SHA1

          15a60f1519aefb81cb63c5993400dd7d31b1202f

          SHA256

          f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

          SHA512

          7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

        • C:\Users\Admin\AppData\Local\Temp\vbc2DC16CB02B9341F3BAB70C73FD6FEA2.TMP

          Filesize

          644B

          MD5

          55335ad1de079999f8d39f6c22fa06b6

          SHA1

          f54e032ad3e7be3cc25cd59db11070d303c2d46d

          SHA256

          e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac

          SHA512

          ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca

        • C:\Users\Admin\AppData\Local\Temp\vbc49CB104C949640BD861B5FEB61264052.TMP

          Filesize

          644B

          MD5

          dac60af34e6b37e2ce48ac2551aee4e7

          SHA1

          968c21d77c1f80b3e962d928c35893dbc8f12c09

          SHA256

          2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

          SHA512

          1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

        • C:\Users\Admin\AppData\Local\Temp\vbc643A7F4CB1A74A36BD4F56DD8656FC41.TMP

          Filesize

          684B

          MD5

          7a707b422baa7ca0bc8883cbe68961e7

          SHA1

          addf3158670a318c3e8e6fdd6d560244b9e8860e

          SHA256

          453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

          SHA512

          81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

        • C:\Users\Admin\AppData\Local\Temp\vbcBD2A87099FC042938A2EBFEE98937F3.TMP

          Filesize

          684B

          MD5

          8135713eeb0cf1521c80ad8f3e7aad22

          SHA1

          1628969dc6256816b2ab9b1c0163fcff0971c154

          SHA256

          e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

          SHA512

          a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

        • C:\Users\Admin\AppData\Local\Temp\xds9aaqx.0.vb

          Filesize

          285B

          MD5

          9a478476d20a01771bcc5a342accfb4e

          SHA1

          314cd193e7dae0d95483be2eae5402ce5d215daa

          SHA256

          e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40

          SHA512

          56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29

        • C:\Users\Admin\AppData\Local\Temp\xds9aaqx.cmdline

          Filesize

          178B

          MD5

          44bc2828ac6714319d34f1d3b58080fb

          SHA1

          df1ec3e0eba1eb6fe4c99b323fa6d5a3fdb732b4

          SHA256

          f34e9e83eb7967990c64c1ed3aae24acfbb2dbffa77b8eff41ae23318a68e425

          SHA512

          b653440a341166b42fe786045b161809de316ae77b10ef898fbe507204a5531405cb8829219d38ebb6332f3556ebe081a9801bd1741946d5dc7e48f686159e9a

        • memory/2656-24-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/2656-11-0x00000000754A2000-0x00000000754A3000-memory.dmp

          Filesize

          4KB

        • memory/2656-15-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/2656-12-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/2656-13-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/2656-14-0x00000000754A2000-0x00000000754A3000-memory.dmp

          Filesize

          4KB

        • memory/4476-25-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/4476-17-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/4476-16-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/4476-20-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/4476-21-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/4476-23-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB

        • memory/4476-38-0x00000000754A0000-0x0000000075A51000-memory.dmp

          Filesize

          5.7MB