Analysis
- geolocation tags
- user interaction
yes - max time kernel
168s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/02/2026, 01:32
General
- Target https://github.com/Da2dalus/The-MALWARE-Repo
- Sample260211-bx4m3set4c
Score
10/10
Malware Config
Extracted
Family
-
revengerat
Botnet
-
Guest
C2
-
0.tcp.ngrok.io:19521
Mutex
-
RV_MUTEX
Signatures
- Detects Sasser 3 IoCs
- RevengeRAT
Remote-access trojan with a wide range of capabilities.
- Revengerat family
- Sasser
Sasser is a Windows worm written in C.
- Sasser family
- RevengeRat Executable 1 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file 6 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Drops startup file 1 IoCs
- Executes dropped EXE 7 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of WriteProcessMemory 62 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb82eec728,0x7ffb82eec734,0x7ffb82eec7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,4061830322846226460,4860572536762601817,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2004 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,6465265866153333205,5707841315149136,262144 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1892 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,16704793480822463290,13914799761616580328,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2628 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2636,i,7444993095763265012,8738481333196729627,2097152 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,15459221202185852616,1701357853453505182,2097152 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3160 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,11094633508097962741,15445080342634574175,2097152 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4244 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,2389590656439330824,2529154762307191045,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,12856368850177711426,7267057346175485512,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5704 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,16571014939911996373,7837432179647415879,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5600 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,637677844382656874,7184313335802714597,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5776 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,13654056674374955062,3410050462853697516,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,1345771103088191937,16014942226934095881,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5300 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,12043082092292447502,8350337999336979835,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6020 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,4215170741378586859,14364881804384943818,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6120 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,15145244441952220087,5285184013046612306,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,16023687365344497861,9516416905382780606,524288 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Avoid.exe"C:\Users\Admin\Downloads\Avoid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\Sasser.A.exe"C:\Users\Admin\Downloads\Sasser.A.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 2363⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\rickroll.exe"C:\Users\Admin\Downloads\rickroll.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6084,i,17787472594967365728,15383414397973956125,262144 --field-trial-handle=1940,i,2043839579918090231,3291722805714538548,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6088 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\Trololo.exe"C:\Users\Admin\Downloads\Trololo.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im explorer.exe3⤵
- Kills process with taskkill
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im taskmgr.exe3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\Downloads\RevengeRAT.exe"C:\Users\Admin\Downloads\RevengeRAT.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\e-__eopq.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3143.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB7522148F9F24D6D9EE23F909D3A2BB7.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pmaakazx.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES31B0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc581BD63E5BE04EDB83835769FAA7C840.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\raunkatn.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES322D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEE14A3219C364272AB94DB702581FF28.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\sjgxdjc3.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES32BA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc547695535BFF43A5BC78635D3D8642F7.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-9r6-mrz.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3346.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc78FC038A896540828493F27460CAD03E.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6jcf5pmv.cmdline"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES33D3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7DBD76DC3824E2ABAD3E0AC356A259B.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\Downloads\Mabezat.exe"C:\Users\Admin\Downloads\Mabezat.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4808 -ip 48081⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4e4 0x51c1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XjtnxDp.ico
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe583709.TMP
Local State
Local State
Local State
Local State
Local State
data_1
RegSvcs.exe.log
-9r6-mrz.0.vb
-9r6-mrz.cmdline
6jcf5pmv.0.vb
6jcf5pmv.cmdline
RES3143.tmp
RES31B0.tmp
RES322D.tmp
RES32BA.tmp
RES3346.tmp
RES33D3.tmp
e-__eopq.0.vb
e-__eopq.cmdline
pmaakazx.0.vb
pmaakazx.cmdline
raunkatn.0.vb
raunkatn.cmdline
sjgxdjc3.0.vb
sjgxdjc3.cmdline
uRClgZblR.txt
uRClgZblR.txt
vbc547695535BFF43A5BC78635D3D8642F7.TMP
vbc581BD63E5BE04EDB83835769FAA7C840.TMP
vbc78FC038A896540828493F27460CAD03E.TMP
vbc7DBD76DC3824E2ABAD3E0AC356A259B.TMP
vbcB7522148F9F24D6D9EE23F909D3A2BB7.TMP
vbcEE14A3219C364272AB94DB702581FF28.TMP
Avoid.exe
Mabezat.exe
Unconfirmed 522920.crdownload
Unconfirmed 528558.crdownload
Unconfirmed 742549.crdownload
Unconfirmed 961929.crdownload
memory/368-723-0x0000000000400000-0x0000000000422000-memory.dmp
memory/916-698-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1308-713-0x0000000000400000-0x000000000040C000-memory.dmp
memory/1528-721-0x0000000002200000-0x0000000002201000-memory.dmp
memory/1528-643-0x0000000002200000-0x0000000002201000-memory.dmp
memory/1528-717-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/3888-696-0x000000001BB20000-0x000000001BB82000-memory.dmp
memory/4696-722-0x0000000001000000-0x0000000001026000-memory.dmp
memory/4808-651-0x0000000000400000-0x000000000041A400-memory.dmp
memory/4808-653-0x0000000000400000-0x000000000041A400-memory.dmp
memory/4900-718-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-680-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-700-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-712-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-687-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-686-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-685-0x000000001C450000-0x000000001C49C000-memory.dmp
memory/4900-684-0x00000000011B0000-0x00000000011B8000-memory.dmp
memory/4900-683-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-682-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-681-0x000000001C1F0000-0x000000001C28C000-memory.dmp
memory/4900-699-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-678-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-679-0x000000001BC10000-0x000000001C0DE000-memory.dmp
memory/4900-677-0x000000001B690000-0x000000001B736000-memory.dmp
memory/4900-676-0x00007FFB70EF5000-0x00007FFB70EF6000-memory.dmp
memory/4900-715-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-716-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-720-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-719-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-738-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-737-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-736-0x00007FFB70C40000-0x00007FFB715E1000-memory.dmp
memory/4900-735-0x00007FFB70EF5000-0x00007FFB70EF6000-memory.dmp