Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2025, 22:42

General

  • Target

    REVENGE-RAT.js

  • Size

    1.2MB

  • MD5

    8ff99e0a81c684cefbc2a752c44f30a1

  • SHA1

    61b8dbc7483abcb72d2c633e6309feb26ac16eb0

  • SHA256

    4f7aa725bb1c08b1ca9179e2efd09d48b62ad6a9cd89a1937ae3842363f5280e

  • SHA512

    7aaee800cc8dbd8f2ededc4d0454476307c14621fde0c4edbe6d4088cb2dc2e9a2ab4d4f04891a2923cac10ed2c6d436d121f9a52f327e55096a318389ace364

  • SSDEEP

    24576:ZU+R0Eg650x+M5+7Yzx0rpdizEAikr2d212SrO7cZbZ8xxTBE/lhEIirIzW0rvWx:v

Malware Config

Extracted

Family

revengerat

Botnet

tenakt

C2

94.23.220.50:559

Mutex

RV_MUTEX-YtjWSTUKIWwi

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 7 IoCs
  • Executes dropped EXE 6 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\REVENGE-RAT.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:6032
    • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
      "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe
        "C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Users\Admin\Documents\foldani.exe
          "C:\Users\Admin\Documents\foldani.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5560
          • C:\Users\Admin\Documents\foldani.exe
            "C:\Users\Admin\Documents\foldani.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5440
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\eudsqps7.cmdline"
              6⤵
              • Drops startup file
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:316
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE5F6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA9CEA52C52E6424F9D2314B78BD76686.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:696
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 10 /tn "bladzabi" /tr "C:\Users\Admin\Documents\foldani.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3412
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yqd0pmki.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3600
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE6D1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2F1BE61061364E659B88B1592A1855A.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4884
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vpzlzbir.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2556
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE76D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4D6B8D9B5EBD4C1DBDAAC06E4B567257.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5060
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i64zfqhq.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1728
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE857.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc915BA9C7800D4A6B99639FB7C6A6B347.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4872
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\trbfpclz.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3628
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE923.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A871F773DAE4F3FA9E2EAA6A3961ED.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5784
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lrapn3nk.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4564
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9BF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc48D81AE22F0A47539A7C805F218B8EB.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2744
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v0bduxs-.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:412
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC5CADA4D884CCEB46AA423C620E740.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:544
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\szw2mvvg.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3212
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEAB9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8742A587D40E4E79B037BF4A1B393B8A.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4348
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iil-khh1.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1984
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB26.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFC6A406ECF91481D87C38306997FF7D.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:408
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\alg0cxn6.cmdline"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5288
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEBA3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcED3C99422BCA4942A11CB1F73A1C817D.TMP"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:5384
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\foldani.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\Documents\foldani.exe
      C:\Users\Admin\Documents\foldani.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:4440
      • C:\Users\Admin\Documents\foldani.exe
        "C:\Users\Admin\Documents\foldani.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tacbvfff.exe.log

          Filesize

          496B

          MD5

          cb76b18ebed3a9f05a14aed43d35fba6

          SHA1

          836a4b4e351846fca08b84149cb734cb59b8c0d6

          SHA256

          8d0edecf54cbbdf7981c8e41a3ed8621503188a87415f9af0fb8d890b138c349

          SHA512

          7631141e4a6dda29452ada666326837372cd3d045f773006f63d9eff15d9432ed00029d9108a72c1a3b858377600a2aab2c9ec03764285c8801b6019babcf21c

        • C:\Users\Admin\AppData\Local\Temp\RESE5F6.tmp

          Filesize

          1KB

          MD5

          bcc1abd1f97e9cf228128fa062d5f039

          SHA1

          893e5ab0bc2d7c13ac21c6b5e41e44a7482897d1

          SHA256

          5fe15afbe4d0719af27458fd57665f3b2d3dd4e9359cfa482a57fc6739f33d50

          SHA512

          82e68574d359f293a3ffc051effbd3759f9f7dee892001fe4339b061f0d7eb80c89beea0a45ec8eaa8fc8e49eae6e78288a69691839229ff3636d77403255643

        • C:\Users\Admin\AppData\Local\Temp\RESE6D1.tmp

          Filesize

          1KB

          MD5

          9d6e1340c436b75b3dd4f95f726df87f

          SHA1

          2f23b225e9cdde177f119140aab3063c380bbaf7

          SHA256

          6bbecbec9b7112e1dfd57c214d22d691280174f4d74f7aa954ed121c27db9283

          SHA512

          71b992cc5d1936b5a2fd5d83ef7d4e4747e2b0e8bf1ab0b8494125c95c5c0a6b0b0a039b0b463c9cdd8ac2accf5eb6f16e97139b1551c3bd109c89fe83d4d560

        • C:\Users\Admin\AppData\Local\Temp\RESE76D.tmp

          Filesize

          1KB

          MD5

          d3122165982c8104285fe327001bb60b

          SHA1

          c1fb8722bbf8fd1eceabe4f4ff5fd6bb79f79788

          SHA256

          770537e09cbb531545df90fba5b0b6841cbf3ef6349da3715f40f73120f58bde

          SHA512

          3381a61d587484dd28b27cbf4532d4d902d3e6858d98e8518e884d757b9433f48301f098f3265d26e091a35d62c5761b91ef6246d816dcdc25c77dc60ba36c56

        • C:\Users\Admin\AppData\Local\Temp\RESE857.tmp

          Filesize

          1KB

          MD5

          b9f17cd84784c1cf910325da43f194be

          SHA1

          1b4c56cc9f22f0abbab0e54c49afa7022e020a10

          SHA256

          5424a52c4e9f378724b249a17c5791ff3879bb7059597e55d8f0dab64217d8cb

          SHA512

          6cd2dbb3c03acecde04186609cc6cb5fe288dbfee8483b58c823d73cc6b43e4a9589cf9b7d17c2085f9b11b202a651652f51e83067c065dbf81d7e58f77ecd7b

        • C:\Users\Admin\AppData\Local\Temp\RESE923.tmp

          Filesize

          1KB

          MD5

          ffe9de41d166ee87c7a24ec8dd48ca44

          SHA1

          c43b7dfc0e781eba27baaa79ac9238a56913ee0f

          SHA256

          bea09e4abf4bd0c9a361ec813d818ab931ea6b002e86d8d21df3275a6c5e5880

          SHA512

          7d48d16162639c24c2c9813813441f5fcc404495cc2e87709afebcb35379e43901ac65238b389b30c63af0e2f33fa2c981bb28e1709d37700b3b351bd94fcc54

        • C:\Users\Admin\AppData\Local\Temp\RESE9BF.tmp

          Filesize

          1KB

          MD5

          25819cca6b9c628c7823f716729df46e

          SHA1

          6e023637e8e0c0756773c19b7b8fffa4db1dbcef

          SHA256

          797ab626b65ed32ee56504207f7b8d444f14fdd2eec884fe6ec8c7e9d4d508d2

          SHA512

          f95f0f69f617adabd4d13e1bb57b631f58af0cb79aded0cc05c7d2dd8fa2b7ab5190e58a318181c54e82c1ca79d236138bbee91eb8bea7c566359d42ab8e4f1f

        • C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp

          Filesize

          1KB

          MD5

          97c47a68b36a7dbab9c3112f6ef22c8a

          SHA1

          feb026a5f0d825f02a99acd6daad163f048260e0

          SHA256

          184cec22ee39b5ee2e1b89f2e95a6fc9c0f896133fe01f633946e08fb3f0d6c3

          SHA512

          7de6fd54e4eae9bb7b26e7725e831fc6383c931038290dcb2d28d09b2e53cd9eb08f2e0733c1b504f7bbb4ec4feb47c1a11657b78b713d87644b900f1289148f

        • C:\Users\Admin\AppData\Local\Temp\RESEAB9.tmp

          Filesize

          1KB

          MD5

          cc33b9ab43f958c37c01008fa40e47ad

          SHA1

          65946b44f87fb472c85cb2a3f04378209d8ad3b4

          SHA256

          c7e73dddbda0da3fd6f9e42e81c7bbc3665fd6d65bb8cbdedc44f5bd6d2c93e8

          SHA512

          58a21ff0a6734da8753b2510878c9f52e53844883b3d5c211c11122fbfe529eb6eed04c7ef8d17183680e3ff46e1f0d10c9eb0efc1e0eaa6d1ee70a075963576

        • C:\Users\Admin\AppData\Local\Temp\RESEB26.tmp

          Filesize

          1KB

          MD5

          ce746cddde3067a04e670c41d773cff7

          SHA1

          f13d1e163208ff8f0ed79b6941e034f4f0402044

          SHA256

          edee22db4edea96fb880cf5463e33f7cdc3d6641bcfb5737cee357e8922d476a

          SHA512

          bcd51cda46bc730bac0e355655dd5e004c98b8e3cddaf7ac3d1f74b3bc727e896755122bffce0219ce6fbeb846887d1c241e57a1f4851ee517f511037b17e8fe

        • C:\Users\Admin\AppData\Local\Temp\RESEBA3.tmp

          Filesize

          1KB

          MD5

          cbd859daab5e33347611e5e958b903a0

          SHA1

          b2ac4929a9030054a0797a9f401b56316d8a1d7b

          SHA256

          655fc664de158f004c293468322336cb7c19a379f1c4ab3e30edf8fb224b59b2

          SHA512

          8d88df7b0b7e8966772aec4027d20204fc92f9b10e9235af0b197fa9c59375ec089b72e5ee0bad2f964679a159ca4f2c745863e617ca7302e372697c990445bc

        • C:\Users\Admin\AppData\Local\Temp\alg0cxn6.0.vb

          Filesize

          287B

          MD5

          9cc0fccb33a41b06335022ada540e8f9

          SHA1

          e3f1239c08f98d8fbf66237f34b54854ea7b799a

          SHA256

          b3007d9bef050c2dd5b7c6376ccfc00929cd51f23fcd6cbc254b139ddaf81a49

          SHA512

          9558ae7a93851c901293c8971d141915ed99bbe98c23855e8d4584936bf3b793904ff452d61e620614cd90c7dc2f385f86fee73cfbe4e6ddf6ee9f71b8e2f6eb

        • C:\Users\Admin\AppData\Local\Temp\alg0cxn6.cmdline

          Filesize

          180B

          MD5

          457167fe9357b44c91b2da0b3030fab1

          SHA1

          1d2b696251a878efa0c18d7b6b34d57c5dde9a17

          SHA256

          ecdb5308ae4164371f109ee7c2c566ad8791ee8490b37c4a06c585f0faf503fb

          SHA512

          a612b9a3df6582c01b24099126b37e1e6e821c8eb5a88d0bc8a98e55f6fc6a61e7d1c59cd4af279a6d945e614d7f21f8da5e798379a7a0219b1b964b67f2762e

        • C:\Users\Admin\AppData\Local\Temp\eudsqps7.0.vb

          Filesize

          145B

          MD5

          61413d4417a1d9d90bb2796d38b37e96

          SHA1

          719fcd1e9c0c30c9c940b38890805d7a89fd0fe5

          SHA256

          24c081f2f8589c160e6c556507f9a9590983445b933ce6a73f889b5096c211d7

          SHA512

          9d8ef98bcae56a7abe678f08ba4ef76a135a14f6ca63c02a6e1ea2ddda233802e2aad6c4fc309026e16cd3a8e87a04fe6d4a0acfb9736cca6d670926c83d6cd4

        • C:\Users\Admin\AppData\Local\Temp\eudsqps7.cmdline

          Filesize

          195B

          MD5

          4deeabad33ce68d52c3b956811d87d8d

          SHA1

          24a41e01d5375d181cf2d71ada737f23d459d198

          SHA256

          7cc9f1f2a95129c8f62e1efe1befbfcbcf426a79966724a8cdce5dbdfac21032

          SHA512

          b64c5f25504486c50fa30d07aa699474fd0952cb30ac055e288de1ee05cd969d3ef329e24f97fd997133e8be369e8adf68842672819570acd8015f381cf5501f

        • C:\Users\Admin\AppData\Local\Temp\i64zfqhq.0.vb

          Filesize

          284B

          MD5

          6989ad9512c924a0d9771ce7e3360199

          SHA1

          1bcc5312adf332719db83156f493ad365f5bdec6

          SHA256

          f80c2d143ea239ba9c96fda416193860cd3d3216e264b856466375bb14618168

          SHA512

          13a0b21b94c5865ec82e4d3d4fca50f2a1948428acc696601ced1f1bf1044338eb5aeee504ca645bd0f6e6c20b2869b832a7fb693618baea756e740af86d5536

        • C:\Users\Admin\AppData\Local\Temp\i64zfqhq.cmdline

          Filesize

          177B

          MD5

          aec1835ad6c7c1a222abfe29b2fe5dca

          SHA1

          429de15cea03e3483032d51a1d4f5cab625294b0

          SHA256

          6d527c847522136f2df931d6790c0cceca2dbcf664246cbbcfc3ba9cb5a518bf

          SHA512

          503664097b3d208e708b0a962bff81986b5eb52cc3423f3f694a4dfe846fc9f7fa2daa0916b1670ac24d9295f745fe565973d33247861e4556e16561859ec5e2

        • C:\Users\Admin\AppData\Local\Temp\iil-khh1.0.vb

          Filesize

          285B

          MD5

          b34b98a6937711fa5ca663f0de61d5bb

          SHA1

          c371025912ab08ae52ff537aaa9cd924dbce6dcc

          SHA256

          f1dbc184336bf86e88e1cbc422009ff85febd6bc887ae483bc10109f30ebf69a

          SHA512

          2c27a72d8a2d120a222add219a0e4f11af38421433210ced930c37ccb9a0cc419fe01e45c874aee2c99613785fa4d44a66fa73c41e4dce9810d4deb24476b98f

        • C:\Users\Admin\AppData\Local\Temp\iil-khh1.cmdline

          Filesize

          178B

          MD5

          36ca4dd4461fdb5b170dbc14c788b43d

          SHA1

          0956f5785ce854c391bc2a1cfb50760991bf8412

          SHA256

          12444efb231ab5bee21d0c1a21ebfce22e3cbeecc4ea2496d7c94061efd0afc4

          SHA512

          7ba3eddbc5bd93dd9e54331d4bc378ef42fa491cbdbf5e0e9a2b7dbf93eafa61f9e5cbcca600d4b605c5a8073e24913dcb13c03c85869d508273109f60b34fa1

        • C:\Users\Admin\AppData\Local\Temp\lrapn3nk.0.vb

          Filesize

          288B

          MD5

          af52f4c74c8b6e9be1a6ccd73d633366

          SHA1

          186f43720a10ffd61e5f174399fb604813cfc0a1

          SHA256

          2d85e489480ba62f161d16a8f46fb85083ab53f2d9efe702ce2e49e0d68eca07

          SHA512

          c521dacb09ddfe56e326cf75f9f40adc269a9b48ea3217e55c6381e836d226066ecf9721650ce74aebb763cd1d22f3d1f06b4567ee7683ba83f5f00ef41ae99e

        • C:\Users\Admin\AppData\Local\Temp\lrapn3nk.cmdline

          Filesize

          181B

          MD5

          a70f79afeb4a4e02641822b9ee594ef0

          SHA1

          9aa608f8ef45e4115ba7948c128d784c6911e42a

          SHA256

          76a266c06bdcc71e67080386fbb54472c54e7f34d8a0f6ca1b1cc23f1b3988e8

          SHA512

          55b4e853b9c921ab2dc54d98e9f930081fcb0f96efafba28432e7380a47f9a3200cc993f8d4f9d192f8267b0521599513fbc4274d990bbf42ab8493ca766f8df

        • C:\Users\Admin\AppData\Local\Temp\szw2mvvg.0.vb

          Filesize

          284B

          MD5

          62caeb4021ea9d333101382b04d7ac1c

          SHA1

          ebe2bb042b8a9c6771161156d1abdce9d8d43367

          SHA256

          e466fcc723dfa8d713c6e7c2208581f1c94ecf06a5dd2e3b83d3a93636badbd7

          SHA512

          e283647c6e24d912833229ce80055d103359ace1e83c051227d40a672691491ef612ea639ebc896d01ff132c5f101132b5397e5c59a8ddbf11e58fdd2052247c

        • C:\Users\Admin\AppData\Local\Temp\szw2mvvg.cmdline

          Filesize

          177B

          MD5

          0fb9a9461fe3936914cecab56eec103d

          SHA1

          ea8f71689166770d10bb7a54d6dc933e93314640

          SHA256

          13f3d9e9343e02065aba5764cd6746c3662d74cd0ce192a5977be54aea12f712

          SHA512

          e9f7d918a774c1618698f5905d79ec9a975e61061fee432d9258fa4336183f3c7d80683a36fbf0911b4eaefaca96e483e82b398a365249bb77fb267b40545379

        • C:\Users\Admin\AppData\Local\Temp\tacbvfff.exe

          Filesize

          234KB

          MD5

          3d3e7a0dc5fd643ca49e89c1a0c3bc4f

          SHA1

          30281283f34f39b9c4fc4c84712255ad0240e969

          SHA256

          32d49dc703d8c827ca9ff7d5389debf7314b062a989db36d1360aae21a77db0e

          SHA512

          93ae1ac6739d91488b88f487a252a411d85dc52a409489a61315235e4a3ec6a178cceac207426b779a1494ab792422263652f1ad310b8bab7ad296d2e7222e68

        • C:\Users\Admin\AppData\Local\Temp\trbfpclz.0.vb

          Filesize

          285B

          MD5

          9a478476d20a01771bcc5a342accfb4e

          SHA1

          314cd193e7dae0d95483be2eae5402ce5d215daa

          SHA256

          e08019db10e6857bff648942f49ae96e3b9159b75e8e62643a8da0ff5b0f3a40

          SHA512

          56903e24de594dd009ee292ab91ba9333db2426c3da63ceba3242439a1fa5981f390f6185250cb53739e9cfd37dcec6e85bed5641d04f017e29016985cdd3f29

        • C:\Users\Admin\AppData\Local\Temp\trbfpclz.cmdline

          Filesize

          178B

          MD5

          d42b153691d2909445fb906d613aaccd

          SHA1

          2c7807edf945eb65189cf2b800d1249d2ed81028

          SHA256

          735bde59bbd01d29c0875fc676c847593ce344eb171d974c4456dbfbd0ffd848

          SHA512

          5e490539540682e9e31ab559b650c544301cfdbe6dee97a12f4665006fa007adf2f30a4d886ced52a79d58fe9f003c7ce20e47095258f3994b6dbeaae26ae8c9

        • C:\Users\Admin\AppData\Local\Temp\v0bduxs-.0.vb

          Filesize

          278B

          MD5

          6d569859e5e2c6ed7c5f91d34ab9f56d

          SHA1

          7bcd42359b8049010a28b6441d585c955b238910

          SHA256

          3352cf84b9c7b33c2dd6e2194ff24e6a5bd0da7bb829c6cadcf9b33c65f21e78

          SHA512

          accd61c856a1f862699566e9f0cea6a30ab0261fa5fd048a00a5a98bf827184ebfdf1c3c879987bb2210626e71c390f2f366bea02f9ec3219cce4c15ef7ea0d7

        • C:\Users\Admin\AppData\Local\Temp\v0bduxs-.cmdline

          Filesize

          171B

          MD5

          c210e6a86c3a43c8b814c0f0e9e56b6c

          SHA1

          1974c32d61e95d3a63a0800ac11dcb947d9dc987

          SHA256

          86524de14db7fc1a13e0f11ba29c793329560e9cc3b72e92b8c8cdca906cc73a

          SHA512

          d85272440489fca2ed13f5fbb9cd51384c195191c48285eee448b05594d4fe770f8db1718dacdda20a7a76bd923481cfff45d30ead65e2697e95d7f42f4b9c6a

        • C:\Users\Admin\AppData\Local\Temp\vbc2F1BE61061364E659B88B1592A1855A.TMP

          Filesize

          644B

          MD5

          dac60af34e6b37e2ce48ac2551aee4e7

          SHA1

          968c21d77c1f80b3e962d928c35893dbc8f12c09

          SHA256

          2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

          SHA512

          1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

        • C:\Users\Admin\AppData\Local\Temp\vbc48D81AE22F0A47539A7C805F218B8EB.TMP

          Filesize

          684B

          MD5

          8135713eeb0cf1521c80ad8f3e7aad22

          SHA1

          1628969dc6256816b2ab9b1c0163fcff0971c154

          SHA256

          e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

          SHA512

          a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

        • C:\Users\Admin\AppData\Local\Temp\vbc4A871F773DAE4F3FA9E2EAA6A3961ED.TMP

          Filesize

          676B

          MD5

          85c61c03055878407f9433e0cc278eb7

          SHA1

          15a60f1519aefb81cb63c5993400dd7d31b1202f

          SHA256

          f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

          SHA512

          7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

        • C:\Users\Admin\AppData\Local\Temp\vbc4D6B8D9B5EBD4C1DBDAAC06E4B567257.TMP

          Filesize

          668B

          MD5

          3906bddee0286f09007add3cffcaa5d5

          SHA1

          0e7ec4da19db060ab3c90b19070d39699561aae2

          SHA256

          0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

          SHA512

          0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

        • C:\Users\Admin\AppData\Local\Temp\vbcA9CEA52C52E6424F9D2314B78BD76686.TMP

          Filesize

          644B

          MD5

          55335ad1de079999f8d39f6c22fa06b6

          SHA1

          f54e032ad3e7be3cc25cd59db11070d303c2d46d

          SHA256

          e05c551536a5ee7a7c82b70d01f0b893db89b3dab1cd4c56ea9580e3901071ac

          SHA512

          ca8c2f680c3d6a61c8ad18b899f7d731f610dc043729a775fd6eade6e11332c1f32c7cf60464b6b3fd41aead9b0c65bc13934574740179931d931516c13027ca

        • C:\Users\Admin\AppData\Local\Temp\vbcED3C99422BCA4942A11CB1F73A1C817D.TMP

          Filesize

          684B

          MD5

          7a707b422baa7ca0bc8883cbe68961e7

          SHA1

          addf3158670a318c3e8e6fdd6d560244b9e8860e

          SHA256

          453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

          SHA512

          81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

        • C:\Users\Admin\AppData\Local\Temp\vpzlzbir.0.vb

          Filesize

          274B

          MD5

          05ab526df31c8742574a1c0aab404c5d

          SHA1

          5e9b4cabec3982be6a837defea27dd087a50b193

          SHA256

          0453a179e3926d451c45952c7704686fbe7f35ec91d2b3b4d9dc909f6b7a8430

          SHA512

          1575da9de9cc37d3fb9fdc2a14aeb56d1debfd09534f231a0eddec35cb20ed25032eb709cb907d5d504a450278fe810d6f297939f11b63935518a4bfeb1b4c40

        • C:\Users\Admin\AppData\Local\Temp\vpzlzbir.cmdline

          Filesize

          167B

          MD5

          91f8b5851f6c7d1fa7a082374bee4394

          SHA1

          1c545e94a0a933cec89f794e8c1aba7a438ff17b

          SHA256

          5981eda1222bc589bfd430b71414309d0236d332524340e940d5775808993abe

          SHA512

          a6801fbc8673ef557ecab5755f9fa5f5edd6a07fbe4bd2ac9102ca070d6f8a4690b29f3175d115a3aba653eb42db9f380f090fc4ee2a265aeb616e2c14517d38

        • C:\Users\Admin\AppData\Local\Temp\yqd0pmki.0.vb

          Filesize

          268B

          MD5

          fe8760874e21534538e34dc52009e8b0

          SHA1

          26a9ac419f9530d6045b691f3b0ecfed323be002

          SHA256

          1be68e1d0beb3861fd8a519cc4c4d0b4122cbea7109bcf3e08f294705579d439

          SHA512

          24c249972146048e134b86e909d51d04d3b821605cb08383921e80f6c3595dc65f9315abbd53704387bdda5c2691b5218658823f1de80e39d25152c9d367c6ed

        • C:\Users\Admin\AppData\Local\Temp\yqd0pmki.cmdline

          Filesize

          161B

          MD5

          0025b9f33671237be334f0ce87ac45a3

          SHA1

          59b0fb9e3cc562fd2e1598d8b43479530e391a06

          SHA256

          a9c174ee4e6e61f9a332685686c0b4b7148c95e18446b2bc45677c100018778d

          SHA512

          e38e9b37584d3278ca6d1d180b61428d803bd16c4af1f268a5a3d1184287e14d13e41dfa58fc21b74411846302c43e16f920b2521c6fad83c64d6c97f53bc695

        • memory/4540-15-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4540-11-0x00000000751C2000-0x00000000751C3000-memory.dmp

          Filesize

          4KB

        • memory/4540-24-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4540-12-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4540-13-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4540-14-0x00000000751C2000-0x00000000751C3000-memory.dmp

          Filesize

          4KB

        • memory/4812-25-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4812-16-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/4812-17-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/4812-20-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4812-22-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4812-23-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB

        • memory/4812-38-0x00000000751C0000-0x0000000075771000-memory.dmp

          Filesize

          5.7MB