Resubmissions

20/05/2025, 20:23

250520-y572ss1qv8 10

20/05/2025, 20:10

250520-yx65jabr7v 10

14/05/2025, 08:25

250514-kbrwtsfk31 10

Analysis

  • max time kernel
    292s
  • max time network
    302s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2025, 20:23

General

  • Target

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

  • Size

    21KB

  • MD5

    6fe3fb85216045fdf8186429c27458a7

  • SHA1

    ef2c68d0b3edf3def5d90f1525fe87c2142e5710

  • SHA256

    905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

  • SHA512

    d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

  • SSDEEP

    384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1

Malware Config

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Revengerat family
  • RevengeRat Executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
    "C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Windows\system32\MSSCS.exe
      "C:\Windows\system32\MSSCS.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5516
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\my_e7wie.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA13C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc70D6C03FA7B45859EB3E83A9C2CCEE5.TMP"
          4⤵
            PID:1452
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xgin_q16.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1556
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA246.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC04241AB742C4A779E9940672A5EC3E1.TMP"
            4⤵
              PID:4380
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ux8awdwc.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1796
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2F2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc97CDECA4981B4D38AF3FD239AFF9148.TMP"
              4⤵
                PID:5976
            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xkm6pdnn.cmdline"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:6064
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA36F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD025059E95494C2689E83E1D4339C1C1.TMP"
                4⤵
                  PID:1760
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xmpdqexb.cmdline"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2708
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3DC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCAC9987E2AC54647AE1445749FF543AC.TMP"
                  4⤵
                    PID:5108
                • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bkwcmiec.cmdline"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:984
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA44A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDE8C5C4BD6CA44A0AB693C97B8556F25.TMP"
                    4⤵
                      PID:4656
                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xuel5tcj.cmdline"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1352
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4A7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8079A0594ED4218A84AD01EF32BCB33.TMP"
                      4⤵
                        PID:5540
                    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vuyfbv28.cmdline"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4804
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA515.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6BAA896957714F29A83225F050347F34.TMP"
                        4⤵
                          PID:5268
                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\49sfbp-m.cmdline"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3400
                        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA582.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc426471B1D536486B9513F0C4FB75069.TMP"
                          4⤵
                            PID:5032

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\49sfbp-m.0.vb

                            Filesize

                            273B

                            MD5

                            3c3d3136aa9f1b87290839a1d26ad07a

                            SHA1

                            005a23a138be5d7a98bdd4a6cc7fab8bdca962f4

                            SHA256

                            5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd

                            SHA512

                            fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60

                          • C:\Users\Admin\AppData\Local\Temp\49sfbp-m.cmdline

                            Filesize

                            173B

                            MD5

                            7946e3d1ff7f1e98c66f8f948feb0268

                            SHA1

                            f9093e1ef8391f5f1df220803c906c26276045d9

                            SHA256

                            1f91a6f1e155b210f5e59c15ebcdede17ad1040153d0c6ff1ed2bf35689552b4

                            SHA512

                            aa807230c5183ed76d2e26a266815537a2abf24a2aacb94b519611d130336c443f0b7871f8cd4d6bc7d5a1031540f60ca862f767af2ae20356e1e611307b54c2

                          • C:\Users\Admin\AppData\Local\Temp\RESA13C.tmp

                            Filesize

                            1KB

                            MD5

                            259f5312f1cd1ce2e150d9d67e72f6f9

                            SHA1

                            f8b33053f658a284bf9d7e73a687b4297b2d06e1

                            SHA256

                            a4c8f766ca141cf3c936b73b157a689c2dff90d846d032eb9f5651e782be0f5e

                            SHA512

                            97c175cc3449b0de49718840f1a0b6ef3eb442559a05561facfe182755cdc08962a344ecef024e5825d351cef6ea1b7073a8c8c3903b51b322138a44f8d6871a

                          • C:\Users\Admin\AppData\Local\Temp\RESA246.tmp

                            Filesize

                            1KB

                            MD5

                            93f439e92d7091bffeef2a8764a35697

                            SHA1

                            d293db8adce389a3a2fc9c9bca124dcda6039c56

                            SHA256

                            cf7887ecabe909763e318904bfbefd4c6def2dc7d7b3e3d8501a175b6506dfd6

                            SHA512

                            010f68d12096c167a88d7d4e11560fcfefae775a259a2bdd983af960f56be245b0216fc4b99d0be0451cafa7654042037a5e48a4ca6a3f7d96c69770116299ae

                          • C:\Users\Admin\AppData\Local\Temp\RESA2F2.tmp

                            Filesize

                            1KB

                            MD5

                            b3eb610dab4438b6267927e2393f8026

                            SHA1

                            eddc2a63c3bad02607b66b26e6983a765fa2181d

                            SHA256

                            02670794e766ce24d9c4785b0e484ffc492df21d8f02ceb5a8a0aab1a5a400f7

                            SHA512

                            13adb8e70bfd6fdb33970f423625431c1d07ee507efb9ef35158cfd766f12bfefe5cfdddda5bf25ff1988c0180dc75a5c1a34988df17d359243c1a07b0b5a35f

                          • C:\Users\Admin\AppData\Local\Temp\RESA36F.tmp

                            Filesize

                            1KB

                            MD5

                            c1a880109302e7b4f1c1388efdc2be2e

                            SHA1

                            479872cd18f4e65ce30e7a6249e13c4385d6bcfb

                            SHA256

                            04832b6423a72812707ea043b550f0c7aae158c6978fb9af528d6714588a6ef4

                            SHA512

                            6812fe5f9569e0d163b921aaf3f9c34f153aef50ea4934de458835ad6dac6fc380f661a103880d45c41659cd92e2586f2e737dde1b35588f46a67ac7fe9e7ecf

                          • C:\Users\Admin\AppData\Local\Temp\RESA3DC.tmp

                            Filesize

                            1KB

                            MD5

                            d82e8412a6b8bd9299d06b70ad7abeb6

                            SHA1

                            2ef8f4a927f72bf372aadd58840e2e7989620715

                            SHA256

                            e09ecfde2d4d68ca8a2a07196d285c31e83baba4e284a1dcabb0764e3d166e8c

                            SHA512

                            67f480184153f06cc8faa7e7b768070a1c96d41afe008edf322ac7197579cb7a1555713088cecbef610b75d5f774cc1596b28ddab2f9973804ae7b5585d02593

                          • C:\Users\Admin\AppData\Local\Temp\RESA44A.tmp

                            Filesize

                            1KB

                            MD5

                            aaf152076064d66535128ec2c160258a

                            SHA1

                            8d396200f182d47ec40e0ae6a21c1a3a0db3b843

                            SHA256

                            479ba45097437752db9a8df2c7a13af9c62a8c54c5811ee88d103e1e5a4f9e7f

                            SHA512

                            f73918fb75ecdcbf6762ef88a9780fed1d4c5dca58560c913f20d000d828ae5b7e92f794adc99ec31a56608e013d532358830babeddf1070d4e85fca0c831d05

                          • C:\Users\Admin\AppData\Local\Temp\RESA4A7.tmp

                            Filesize

                            1KB

                            MD5

                            84e0c7d02cf646abcea98420417f9592

                            SHA1

                            5cc2c90ce3b1a0cdebf03ed377a15c9fe3958906

                            SHA256

                            6c8cccac661315ffc7b2ede6c65da14f530d250ca108b59734ef7dd754aac25b

                            SHA512

                            4d7cfd1baf4bd956a2ea72936d312b5d29524f22141c1f0d0539876f84a6fc60c278176e6464bec446757b0045af7bb83b48a486503ae871da0fb9af9dc69f62

                          • C:\Users\Admin\AppData\Local\Temp\RESA515.tmp

                            Filesize

                            1KB

                            MD5

                            70d3c014679d6439e368ddebb0e9f108

                            SHA1

                            73d8ee8595918be4e749e23a7ba802eca16c326f

                            SHA256

                            4e95aa4b238c613cfb0a0e8aef6f99c74fc47b8768bca40d1eac4ef604541a12

                            SHA512

                            9ef9e23340218b60ea3a0b8a9f5d24c2f838322b5b227eedfaf9a28c44fa78536b245ec8b295a78ecb6b82eb027814827fe334d531043ea537d72386aab560e4

                          • C:\Users\Admin\AppData\Local\Temp\RESA582.tmp

                            Filesize

                            1KB

                            MD5

                            053a6470b6f165dabdbef6832134054e

                            SHA1

                            56701ac15f34dcf7203a3d1bfe42f418f325a20c

                            SHA256

                            88f98372eda8411a5c39c9ed17b7ae920ad8df6d3adac09ca084d8877e208416

                            SHA512

                            446ea2df851362a7b26d6b45fdef7a645dbb2ec6ec79b5c7c0a817dbc07eb5f5f86bee864a70ca5c64d4f7851a5b57ea4553b0e648a55e3277b8aa30332165a1

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fwhalisa.upm.ps1

                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                          • C:\Users\Admin\AppData\Local\Temp\bkwcmiec.0.vb

                            Filesize

                            274B

                            MD5

                            539683c4ca4ee4dc46b412c5651f20f5

                            SHA1

                            564f25837ce382f1534b088cf2ca1b8c4b078aed

                            SHA256

                            ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e

                            SHA512

                            df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac

                          • C:\Users\Admin\AppData\Local\Temp\bkwcmiec.cmdline

                            Filesize

                            174B

                            MD5

                            5db813922e2042acf3091845617b8de3

                            SHA1

                            5fa89cd9a3d8c77838169ac87368b93ecdd48c23

                            SHA256

                            5e06857140b33285877b8ca18a3d854fcc4e755b0cec784e15b0fa013f943a86

                            SHA512

                            002f0abd8bbafd2fd1bb802198691bfc1134304bb935c14220591ec66f29cdbf10b825e3a98b91bef06d447b27728a117ecca9cce8153fd7ac2afcc080324c2e

                          • C:\Users\Admin\AppData\Local\Temp\my_e7wie.0.vb

                            Filesize

                            256B

                            MD5

                            076803692ac8c38d8ee02672a9d49778

                            SHA1

                            45d2287f33f3358661c3d6a884d2a526fc6a0a46

                            SHA256

                            5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3

                            SHA512

                            cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d

                          • C:\Users\Admin\AppData\Local\Temp\my_e7wie.cmdline

                            Filesize

                            156B

                            MD5

                            36437907f497350eafa3c4ef4ba405f7

                            SHA1

                            a2f3d0f2a44b6564ddb647ebcc234d43d848c906

                            SHA256

                            d4df221a4240bcbf0dc578d26c583087a00a65fc528a070191fd5f39b3a24d45

                            SHA512

                            3982aa7336ab16c239482b1bcd0a9db2cb14a812192c3942b58f9dfd4314744802dc0e7b63a0740925f93926d7eecad6c7cce4070ba40e1991a723deb5dec73a

                          • C:\Users\Admin\AppData\Local\Temp\ux8awdwc.0.vb

                            Filesize

                            271B

                            MD5

                            ac972015bef75b540eb33503d6e28cc2

                            SHA1

                            5c1d09fcf4c719711532dcfd0544dfc6f2b90260

                            SHA256

                            fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7

                            SHA512

                            36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83

                          • C:\Users\Admin\AppData\Local\Temp\ux8awdwc.cmdline

                            Filesize

                            171B

                            MD5

                            d1bc958934c07af066d9cd1cead7293c

                            SHA1

                            98e55315bceeed750c90ae4ce233a4bd2d0d415c

                            SHA256

                            25b1b886eab846619c2141622c1be8a772669809875122eeba40b1500362486d

                            SHA512

                            0fbe0e6a18d73c9b47d0f94e787d79d2419c43be2c2664f9952ad0edba914dd9e7cd475d39f6fcb3ceb2022f4a3048a077485ddf6ae5ed94637e67bff9abe2a0

                          • C:\Users\Admin\AppData\Local\Temp\vbc426471B1D536486B9513F0C4FB75069.TMP

                            Filesize

                            684B

                            MD5

                            7a707b422baa7ca0bc8883cbe68961e7

                            SHA1

                            addf3158670a318c3e8e6fdd6d560244b9e8860e

                            SHA256

                            453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c

                            SHA512

                            81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9

                          • C:\Users\Admin\AppData\Local\Temp\vbc70D6C03FA7B45859EB3E83A9C2CCEE5.TMP

                            Filesize

                            644B

                            MD5

                            dac60af34e6b37e2ce48ac2551aee4e7

                            SHA1

                            968c21d77c1f80b3e962d928c35893dbc8f12c09

                            SHA256

                            2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                            SHA512

                            1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

                          • C:\Users\Admin\AppData\Local\Temp\vbcC04241AB742C4A779E9940672A5EC3E1.TMP

                            Filesize

                            668B

                            MD5

                            3906bddee0286f09007add3cffcaa5d5

                            SHA1

                            0e7ec4da19db060ab3c90b19070d39699561aae2

                            SHA256

                            0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                            SHA512

                            0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                          • C:\Users\Admin\AppData\Local\Temp\vbcD025059E95494C2689E83E1D4339C1C1.TMP

                            Filesize

                            676B

                            MD5

                            85c61c03055878407f9433e0cc278eb7

                            SHA1

                            15a60f1519aefb81cb63c5993400dd7d31b1202f

                            SHA256

                            f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

                            SHA512

                            7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

                          • C:\Users\Admin\AppData\Local\Temp\vbcDE8C5C4BD6CA44A0AB693C97B8556F25.TMP

                            Filesize

                            684B

                            MD5

                            8135713eeb0cf1521c80ad8f3e7aad22

                            SHA1

                            1628969dc6256816b2ab9b1c0163fcff0971c154

                            SHA256

                            e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a

                            SHA512

                            a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4

                          • C:\Users\Admin\AppData\Local\Temp\vuyfbv28.0.vb

                            Filesize

                            270B

                            MD5

                            658573fde2bebc77c740da7ddaa4634b

                            SHA1

                            073da76c50b4033fcfdfb37ba6176afd77b0ea55

                            SHA256

                            c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607

                            SHA512

                            f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf

                          • C:\Users\Admin\AppData\Local\Temp\vuyfbv28.cmdline

                            Filesize

                            170B

                            MD5

                            290d1535f647fc248845597f4bc566be

                            SHA1

                            f3bad33242bdd4ea6d1835f5dfbcb540d375bfa9

                            SHA256

                            bbddc35c33360f199e39d4bcf2a0c249578e0ad63e0641a1296f5aa75ee95bba

                            SHA512

                            00137ec71e4e575fd80b905955d543435e29e9e50164ebf63ede29530256331f423e6e1a1cfe9d3a3656fb61367816b437950158af04d3fdceea60ef4655fbdd

                          • C:\Users\Admin\AppData\Local\Temp\xgin_q16.0.vb

                            Filesize

                            262B

                            MD5

                            88cc385da858aaa7057b54eaeb0df718

                            SHA1

                            b108224d4686b5ca3faaeb1c728dfba8740a6eca

                            SHA256

                            08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020

                            SHA512

                            4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7

                          • C:\Users\Admin\AppData\Local\Temp\xgin_q16.cmdline

                            Filesize

                            162B

                            MD5

                            3aee907e895d95e531bbcaf7eeeb31d7

                            SHA1

                            6ad82f10443492a9c569a313faf7d33724802bdf

                            SHA256

                            4fb05ead774085ccf17270f6c4d737713432a6fa57b2ade51ce5b09c65ca6846

                            SHA512

                            47f325205b70aae1a6f018b34eeff687b0c85e3f57b852782750ecad6488d0e5f85361647cbe187b5c1b67b7cd76e8064fecfc6f488e825919fe8c7372b43c6b

                          • C:\Users\Admin\AppData\Local\Temp\xkm6pdnn.0.vb

                            Filesize

                            272B

                            MD5

                            2b3aac520562a93ebef6a5905d4765c9

                            SHA1

                            10ab45c5d73934b16fac5e30bf22f17d3e0810c8

                            SHA256

                            b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89

                            SHA512

                            9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446

                          • C:\Users\Admin\AppData\Local\Temp\xkm6pdnn.cmdline

                            Filesize

                            172B

                            MD5

                            31cf069bbb77a1a3b7d23a4789f2ddad

                            SHA1

                            be776aed11e97739036f7147961fb43db2b8ef96

                            SHA256

                            9bb5b4d2bc858403f455f6eac6c9e464a158f55c3ae266ce24998c6712ce1838

                            SHA512

                            3285e19f5c49447a92d027da46ad1e31a9de51496e7cb622c5bd5b99dcfb73b624a54b06dba4ba0b6abe4a017647ca523b9b53b75774adb5d2fc2f0b8012a9cd

                          • C:\Users\Admin\AppData\Local\Temp\xmpdqexb.0.vb

                            Filesize

                            271B

                            MD5

                            325f27ef75bebe8b3f80680add1943d3

                            SHA1

                            1c48e211258f8887946afb063e9315b7609b4ee3

                            SHA256

                            034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35

                            SHA512

                            e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804

                          • C:\Users\Admin\AppData\Local\Temp\xmpdqexb.cmdline

                            Filesize

                            171B

                            MD5

                            04bf03e0717be630294419b71ddd18a4

                            SHA1

                            72f868900c79cd3bc4a9d5176fbbdb5d3bed829c

                            SHA256

                            486b5a8bc7e3cf268df8dbdaaec2d95fa28bffd5fed84c863ce8129627a49724

                            SHA512

                            5c49c54103e9d919b9242a3cac2ac16e7d6bf0931b38acfcf1f1b3f4ceed425f22dce1c2f89daeb71119c510eebac6f30df8100c23a6c254ddda0260254ca021

                          • C:\Users\Admin\AppData\Local\Temp\xuel5tcj.0.vb

                            Filesize

                            264B

                            MD5

                            5ce3977a153152978fa71f8aa96909e9

                            SHA1

                            52af143c553c92afc257f0e0d556908eaa8919cb

                            SHA256

                            e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed

                            SHA512

                            eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77

                          • C:\Users\Admin\AppData\Local\Temp\xuel5tcj.cmdline

                            Filesize

                            164B

                            MD5

                            172457ab9bf76a4d5536888bbd9f0871

                            SHA1

                            c4b1c39aa79d0b6b5bcf4db747c136e0d7763d85

                            SHA256

                            da381a759706e229886ca915c945e9ba40cad5729bce1e7abbdc05afc0b7e086

                            SHA512

                            5a0d02329ab0077e7b17140b2688d0ce5ec381ebb05cf89fb66d4d249d20f94bb91e679cf687e546843e48d8e0d8218f1292d37024c9cd51464b03f980cbe330

                          • C:\Windows\System32\MSSCS.exe

                            Filesize

                            21KB

                            MD5

                            6fe3fb85216045fdf8186429c27458a7

                            SHA1

                            ef2c68d0b3edf3def5d90f1525fe87c2142e5710

                            SHA256

                            905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550

                            SHA512

                            d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c

                          • memory/1136-20-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/1136-19-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/1136-23-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/1136-21-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/4160-7-0x00007FF879A15000-0x00007FF879A16000-memory.dmp

                            Filesize

                            4KB

                          • memory/4160-8-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/4160-22-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/4160-6-0x000000001CC30000-0x000000001CCCC000-memory.dmp

                            Filesize

                            624KB

                          • memory/4160-9-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/4160-0-0x00007FF879A15000-0x00007FF879A16000-memory.dmp

                            Filesize

                            4KB

                          • memory/4160-5-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/4160-4-0x000000001C300000-0x000000001C362000-memory.dmp

                            Filesize

                            392KB

                          • memory/4160-3-0x000000001C190000-0x000000001C236000-memory.dmp

                            Filesize

                            664KB

                          • memory/4160-1-0x00007FF879760000-0x00007FF87A101000-memory.dmp

                            Filesize

                            9.6MB

                          • memory/4160-2-0x000000001BCC0000-0x000000001C18E000-memory.dmp

                            Filesize

                            4.8MB

                          • memory/5516-33-0x0000017ED9040000-0x0000017ED9062000-memory.dmp

                            Filesize

                            136KB

                          • memory/5516-166-0x0000017EC0310000-0x0000017EC0DD1000-memory.dmp

                            Filesize

                            10.8MB