revengerat | a4c7e0fa5387a8d4bf68638494b6a8c0b7299798cb87788edd70963256895e37

Analysis

max time kernel
143s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
14/05/2025, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Size 21KB
Sample250514-fx2wpstry2
SHA256 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
MD5 6fe3fb85216045fdf8186429c27458a7
SHA1 ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA512 d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
SSDEEP 384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat execution stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral26/files/0x001a00000002b1de-14.dat	revengerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe

Executes dropped EXE 1 IoCs

pid	Process
3948	MSSCS.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5340	powershell.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
File opened for modification	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
File opened for modification	C:\Windows\system32\MSSCS.exe	MSSCS.exe
File created	C:\Windows\system32\MSSCS.exe	MSSCS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5340	powershell.exe
5340	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Token: SeDebugPrivilege	3948	MSSCS.exe
Token: SeDebugPrivilege	5340	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3948	1968	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	79
PID 1968 wrote to memory of 3948	1968	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	79
PID 3948 wrote to memory of 5340	3948	MSSCS.exe	80
PID 3948 wrote to memory of 5340	3948	MSSCS.exe	80
PID 3948 wrote to memory of 3352	3948	MSSCS.exe	82
PID 3948 wrote to memory of 3352	3948	MSSCS.exe	82
PID 3352 wrote to memory of 5712	3352	vbc.exe	84
PID 3352 wrote to memory of 5712	3352	vbc.exe	84
PID 3948 wrote to memory of 4120	3948	MSSCS.exe	85
PID 3948 wrote to memory of 4120	3948	MSSCS.exe	85
PID 4120 wrote to memory of 5852	4120	vbc.exe	87
PID 4120 wrote to memory of 5852	4120	vbc.exe	87
PID 3948 wrote to memory of 4484	3948	MSSCS.exe	88
PID 3948 wrote to memory of 4484	3948	MSSCS.exe	88
PID 4484 wrote to memory of 5888	4484	vbc.exe	90
PID 4484 wrote to memory of 5888	4484	vbc.exe	90
PID 3948 wrote to memory of 3020	3948	MSSCS.exe	91
PID 3948 wrote to memory of 3020	3948	MSSCS.exe	91
PID 3020 wrote to memory of 5748	3020	vbc.exe	93
PID 3020 wrote to memory of 5748	3020	vbc.exe	93
PID 3948 wrote to memory of 4876	3948	MSSCS.exe	94
PID 3948 wrote to memory of 4876	3948	MSSCS.exe	94
PID 4876 wrote to memory of 3472	4876	vbc.exe	96
PID 4876 wrote to memory of 3472	4876	vbc.exe	96
PID 3948 wrote to memory of 4540	3948	MSSCS.exe	97
PID 3948 wrote to memory of 4540	3948	MSSCS.exe	97
PID 4540 wrote to memory of 5580	4540	vbc.exe	99
PID 4540 wrote to memory of 5580	4540	vbc.exe	99
PID 3948 wrote to memory of 5124	3948	MSSCS.exe	100
PID 3948 wrote to memory of 5124	3948	MSSCS.exe	100
PID 5124 wrote to memory of 2972	5124	vbc.exe	102
PID 5124 wrote to memory of 2972	5124	vbc.exe	102
PID 3948 wrote to memory of 1456	3948	MSSCS.exe	103
PID 3948 wrote to memory of 1456	3948	MSSCS.exe	103
PID 1456 wrote to memory of 3968	1456	vbc.exe	105
PID 1456 wrote to memory of 3968	1456	vbc.exe	105
PID 3948 wrote to memory of 2004	3948	MSSCS.exe	106
PID 3948 wrote to memory of 2004	3948	MSSCS.exe	106
PID 2004 wrote to memory of 5380	2004	vbc.exe	108
PID 2004 wrote to memory of 5380	2004	vbc.exe	108
PID 3948 wrote to memory of 768	3948	MSSCS.exe	109
PID 3948 wrote to memory of 768	3948	MSSCS.exe	109
PID 768 wrote to memory of 5048	768	vbc.exe	111
PID 768 wrote to memory of 5048	768	vbc.exe	111

C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\MSSCS.exe
  "C:\Windows\system32\MSSCS.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5340
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mewbvklt.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD51E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc14E943BF617F4C0F80A2DB33CAE3198E.TMP"
      4⤵
      PID:5712
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k7p05rpi.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5AA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3F1921E152A0475FB469B23859BA61CC.TMP"
      4⤵
      PID:5852
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hyxgik3h.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD637.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc564390B53B0B4FABB43B726249F78B6B.TMP"
      4⤵
      PID:5888
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\fplbnnej.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6A4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5B7D50036E5C42FB816A55F9BE9FF8D.TMP"
      4⤵
      PID:5748
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rqpz35g3.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD750.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD2FF77E483244941B2571C15EF5BDBAC.TMP"
      4⤵
      PID:3472
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lyv3vhjh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD7CD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD32F7F8EC28448608639C4554A39CB26.TMP"
      4⤵
      PID:5580
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8yx-j4tt.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD85A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9763871EC358403BBAB9953D87514431.TMP"
      4⤵
      PID:2972
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gicncnfh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8B7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc959696C3398D4E3A9473E08A49779059.TMP"
      4⤵
      PID:3968
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pxhgrah9.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD906.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc257333CF56E7472F8564B90791E2521.TMP"
      4⤵
      PID:5380
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nn0356dx.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD954.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB8AC51544E5F4252AA7D91265FD0A26A.TMP"
      4⤵
      PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8yx-j4tt.0.vb

Path C:\Users\Admin\AppData\Local\Temp\8yx-j4tt.0.vb
Size 264B
SHA256 e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed
MD5 5ce3977a153152978fa71f8aa96909e9
SHA1 52af143c553c92afc257f0e0d556908eaa8919cb
SHA512 eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77
MD5 SHA1 SHA512

Submit Download

8yx-j4tt.cmdline

Path C:\Users\Admin\AppData\Local\Temp\8yx-j4tt.cmdline
Size 164B
SHA256 3a7fc1aea47a2db09853249343897238740c080957a0918bb820e66ca1c57a73
MD5 14209b71d3c1eb87e461b1535c6c91e4
SHA1 684b7a6a5ab5468d5188ad0946e31e1c1becd5e9
SHA512 5bc4f7c4d18a18d6c057f072b630d7de73f3e3fea0c1311c3a87277c339f6c8bd77abebccabf9a65c97eb2cd7dd22cbd07d225df12135bd2727a45678ccbe85e
MD5 SHA1 SHA512

Submit Download

RESD51E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD51E.tmp
Size 1KB
SHA256 5596f1b3f7ef6ac7be2e051d272980f9918d3bd9d84d118b22a317595b1d2722
MD5 33ea59722e4be8b01e6ff04782a22929
SHA1 14e413ffb19fd410c0dba0be8c1df091de1d74de
SHA512 35e572325f9f5d8078ce0501e27f42c7464e6db0513bc3168189d3fd1dada7c00fec267102cd3f89b7560762e9fe19ba5cde206238aed98c3e227a3e84361849
MD5 SHA1 SHA512

Submit Download

RESD5AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD5AA.tmp
Size 1KB
SHA256 108cdc2248dc09adff769cfb481ed4e0edb911a85929186dff069d3a0a44125f
MD5 da443cb47a86de83803298b5cd0f7948
SHA1 aa813862c399a9a28db5b96bdc0c6a03ab0beda8
SHA512 38b1b9a2f044332619f6810b87e7d82b09dc4ad356bd8f041bd1874c773770bb0ec0f0d896abbf9fd3bd33088c995df834df17beca944ccf79022848367358dc
MD5 SHA1 SHA512

Submit Download

RESD637.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD637.tmp
Size 1KB
SHA256 16b1b6bf53a421d35594dc2d78d2acaa1081c58ab8e5a0dcf13c7c69e633ce1f
MD5 3e96d7a89ba110d7dabd135a4355e6cd
SHA1 30096f80a84c29ec4273a0f26fef000f2cb726f6
SHA512 94b90611d3764946bd56b0a4f2acd2939285c46d3f1db30e873e926832dcfc2fb100cc40bceb58eacfb541852741ec8178dca6a301c391a979ef77fc2ecd022d
MD5 SHA1 SHA512

Submit Download

RESD6A4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD6A4.tmp
Size 1KB
SHA256 d07c942b7cf15b4aa8329fc872b69fbad8ba6e1c7340e12a6feae1cfbc16c854
MD5 269ce4b51db7d9583c3d82f0f47f89b2
SHA1 94c59a1153e6e03f87e278f2a2801e9a7854205e
SHA512 5c23acce7a0b45825432c078a6230908a5e93036d312c8d233a91d654cad76d22152fedd42e31b11b4005a4551e2f80192ecc81860c3c8f6cf3c94131dbbc67a
MD5 SHA1 SHA512

Submit Download

RESD750.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD750.tmp
Size 1KB
SHA256 f2e079db5e0fb20b012657cd345953c992e478cb798dafab72b4745c94945a6a
MD5 e7e98b740b1e8cd67af4f6c2f608dfed
SHA1 7f3db12606985b674e47bdcdacaa119b54bc0258
SHA512 078ff837201c88ec0ddecf15f9cbeb9985b4588724c1db81908570a9f005c1f20168a8f66963a7c7113f6545818fd4c803070fe2330b8b5f34c6124614cca45d
MD5 SHA1 SHA512

Submit Download

RESD7CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD7CD.tmp
Size 1KB
SHA256 c359090179d970a1e070c4e4ba0e1a1a16dd5769c135bcb48fefe378c58fce66
MD5 4f805607de933e97d347dbef11149960
SHA1 b2c2f82dee839923560faf9e5ef821e7313b906c
SHA512 36787d6e4038804740d9a1d6353ccc920615132279a7bbe7a254e5ad1af926408ee53e4c76c3df9b071ef072083544163e549bdb80ec0a891f065c2bd42bb3b0
MD5 SHA1 SHA512

Submit Download

RESD85A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD85A.tmp
Size 1KB
SHA256 527ea77cc89f5d09a20f51cc0a20437337e10eb4d410c18161369cef6d969221
MD5 4776fb7ff84386ab479c893110c0ad1c
SHA1 c1cb3c7255250ae8e33ff42bc9b42bb3db9a6969
SHA512 48c5a0193422de68bb1672255922a5b492d613a8f48fa3385aef58e8537fdab01f043f386947f3b4a8ec240d1ceb6a2f168b9876ebbfd6f2827b8acc6d0a9e7c
MD5 SHA1 SHA512

Submit Download

RESD8B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD8B7.tmp
Size 1KB
SHA256 c9f39362b163d388b3501c0025d060abcc522b62f9ead89e8d701dab776d1895
MD5 9a28abe4086858281f312cfa93afb131
SHA1 b39f862479e72c42beefa40b96cf0c8fc3e205c6
SHA512 69f39a5c663692cf244272fca7719df3c089fd7c135447f55d3cb73bdb0a5cc4ad4ed843378edfa776ab80e2157936254595b42e77ecdc1e63f9b7f204ffb7cf
MD5 SHA1 SHA512

Submit Download

RESD906.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD906.tmp
Size 1KB
SHA256 35150f48c91b540a23abc94484cff67ba59452a4ee6c457f11f447e6563fd0d4
MD5 6d35173a606f6636ee10ef6703755714
SHA1 ceb9faea2466216bbbd360d99656484429ced9f5
SHA512 2d421b8a23162651998714fa06d5e9dbba81919f8fa2edfd957bf68c2e2eba3e1c6f91ef430b0cb9ac6a7a609859bd1ddb3907c1c724c284b41aa9bdb778ab21
MD5 SHA1 SHA512

Submit Download

RESD954.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD954.tmp
Size 1KB
SHA256 07637d0293157598b0d289d090f06eb08a7ee15875fdc4a7a574386adfb4c21d
MD5 b64c5255a4dcd20a62e88ea7b2280ddd
SHA1 f7fc4f8dd677887548af0113685857fb93b30d9d
SHA512 d1ebe9bfce39fed568d55d2eaaa4271dcb81f436b7b9d71bae2a1b4353893eabf8a1899f5c8b010f58681bc390f93e3ba53b257877a3476ead6b1cfb1789c4d2
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wtqgnq0r.i5u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wtqgnq0r.i5u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

fplbnnej.0.vb

Path C:\Users\Admin\AppData\Local\Temp\fplbnnej.0.vb
Size 272B
SHA256 b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89
MD5 2b3aac520562a93ebef6a5905d4765c9
SHA1 10ab45c5d73934b16fac5e30bf22f17d3e0810c8
SHA512 9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446
MD5 SHA1 SHA512

Submit Download

fplbnnej.cmdline

Path C:\Users\Admin\AppData\Local\Temp\fplbnnej.cmdline
Size 172B
SHA256 3041d4da9e51a1ec055b5f7d408bb307c37240c7457d2e1c10788a056b51903e
MD5 389e8666c41537288a64c690970460ec
SHA1 cd722bc0ac64d6cb2636ae3a04f99755e6b48d09
SHA512 8f699a71ba9159b94168f2519c97308f30c1dd94ac27ae603866d4a3a5f9c1d72c165a69a25bbb91aac8b00c3860314c3f5095a1c2fbd4b0344d83255e6d7c47
MD5 SHA1 SHA512

Submit Download

gicncnfh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\gicncnfh.0.vb
Size 270B
SHA256 c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607
MD5 658573fde2bebc77c740da7ddaa4634b
SHA1 073da76c50b4033fcfdfb37ba6176afd77b0ea55
SHA512 f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf
MD5 SHA1 SHA512

Submit Download

gicncnfh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\gicncnfh.cmdline
Size 170B
SHA256 f03f8ec4713bc899103f445e6a399f9fec44878bcb1cb236c174f7dec2808bb7
MD5 3095f2333c3f90bf87fc59076f0ba581
SHA1 4fb950b2d34b2ad2db5eab89c292a1046d61aa63
SHA512 54354bfe0a752a867b63c418481cb9318c14c2d04d4d910bf5bd0993d05bd03a472dad6a554f1c0b5b888cebead83a3e69e3ed1ca2b449e553368a52a324f578
MD5 SHA1 SHA512

Submit Download

hyxgik3h.0.vb

Path C:\Users\Admin\AppData\Local\Temp\hyxgik3h.0.vb
Size 271B
SHA256 fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7
MD5 ac972015bef75b540eb33503d6e28cc2
SHA1 5c1d09fcf4c719711532dcfd0544dfc6f2b90260
SHA512 36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83
MD5 SHA1 SHA512

Submit Download

hyxgik3h.cmdline

Path C:\Users\Admin\AppData\Local\Temp\hyxgik3h.cmdline
Size 171B
SHA256 77d443e23bf80747aa12676ba41b8e8354e331b039fb1e4fa0b034e6c81645bb
MD5 497c1b22f387c6ac8c284b9920237de8
SHA1 97fd339f1d73d7ec4c040666a151117c50fe4e7d
SHA512 ea54ea967c94ff92f50eb935d5caed9f62c78783e1dc2f192c723c45f31ce4f5c0c7c3862831140db6787e6ec4adcd91265db021d82d235db6c7652bebc1989d
MD5 SHA1 SHA512

Submit Download

k7p05rpi.0.vb

Path C:\Users\Admin\AppData\Local\Temp\k7p05rpi.0.vb
Size 262B
SHA256 08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020
MD5 88cc385da858aaa7057b54eaeb0df718
SHA1 b108224d4686b5ca3faaeb1c728dfba8740a6eca
SHA512 4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7
MD5 SHA1 SHA512

Submit Download

k7p05rpi.cmdline

Path C:\Users\Admin\AppData\Local\Temp\k7p05rpi.cmdline
Size 162B
SHA256 dd2c8993106b5dbf0e46722e03c9bac03e5d0e38a57fc9d585bf374869f91cfd
MD5 63ca0f9b373059d4ecbc5cf25af42aef
SHA1 d2bd739df8a2db501f9ac9dbca7a28051b6a0875
SHA512 b2a9c290097540b0743894a8df123191268261108baa5b9b29d95f2a5039f02cae2ef56540678e1331d61304a40ef0dae58c3930434a48787030c6f3190e07e8
MD5 SHA1 SHA512

Submit Download

lyv3vhjh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\lyv3vhjh.0.vb
Size 274B
SHA256 ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e
MD5 539683c4ca4ee4dc46b412c5651f20f5
SHA1 564f25837ce382f1534b088cf2ca1b8c4b078aed
SHA512 df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac
MD5 SHA1 SHA512

Submit Download

lyv3vhjh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\lyv3vhjh.cmdline
Size 174B
SHA256 ad21f6d40e1b706b896e5657b173064aec396fb53635b2441af583d40c00a6a5
MD5 f373e074b2fe04da025f8f0a0bde466c
SHA1 c860ee564dff037c1f447b3865adadf5a9a67aed
SHA512 e8eec73872ee5f38f9dab8f21c658bc53b49b6b4c975c814e081765da5809779a8e3547855b07da17fbc39d28e1586676c5a647ba4f2f1d3e915e347fd71a59a
MD5 SHA1 SHA512

Submit Download

mewbvklt.0.vb

Path C:\Users\Admin\AppData\Local\Temp\mewbvklt.0.vb
Size 256B
SHA256 5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3
MD5 076803692ac8c38d8ee02672a9d49778
SHA1 45d2287f33f3358661c3d6a884d2a526fc6a0a46
SHA512 cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d
MD5 SHA1 SHA512

Submit Download

mewbvklt.cmdline

Path C:\Users\Admin\AppData\Local\Temp\mewbvklt.cmdline
Size 156B
SHA256 3c9fd7d42b3b93b97cc536c7e35dac0691af2cfc8a125b36147a7510c81b4acf
MD5 7c91bbe4774067ef0960daf174d2bb6a
SHA1 dbbcf979177732bb5cca22316343141cfcffc838
SHA512 fb87ab3792559d94eba035a3a8692055d28bdfcb54e7503de48c4979871925f90ba33cc69a2124a7b88dade64dc228ad76a2200f70c5dcfc8d9912070fd8a415
MD5 SHA1 SHA512

Submit Download

nn0356dx.0.vb

Path C:\Users\Admin\AppData\Local\Temp\nn0356dx.0.vb
Size 273B
SHA256 5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd
MD5 3c3d3136aa9f1b87290839a1d26ad07a
SHA1 005a23a138be5d7a98bdd4a6cc7fab8bdca962f4
SHA512 fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60
MD5 SHA1 SHA512

Submit Download

nn0356dx.cmdline

Path C:\Users\Admin\AppData\Local\Temp\nn0356dx.cmdline
Size 173B
SHA256 c16244945d37e0fc0badd1af6885f328d61f8982ebafe25e98cc9bdbcf38b965
MD5 570f9726173971b07cf73247065eb5c2
SHA1 6904a70cdf3b93f3182256417fa8b0d4fc87ffe5
SHA512 025dcb5473c7176a1f18cf261456d68890a32edb5ae936be144e8fd7a88935b93838b389c1b46c63f6f198bdceb9a5d5f2a2ef9a3df436acfbd7f32f9f436780
MD5 SHA1 SHA512

Submit Download

pxhgrah9.cmdline

Path C:\Users\Admin\AppData\Local\Temp\pxhgrah9.cmdline
Size 171B
SHA256 4d0fa3686c63f9c46cf15e671a6d5536134d47c9b695f3764aecc71251dd4d31
MD5 61d24f0909d74f1e0c23ff555d3fdbf4
SHA1 725739486fa89cee77f24ea5a60bebaee44acb31
SHA512 df1ca1e6ad88151da70bee3c0a264e660c9d14bb19903d0230b4191eb36f1c33de4a1a8ded703304062b92cc4ea88f4df522a02537fb044cea3fa5f47836ff55
MD5 SHA1 SHA512

Submit Download

rqpz35g3.0.vb

Path C:\Users\Admin\AppData\Local\Temp\rqpz35g3.0.vb
Size 271B
SHA256 034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35
MD5 325f27ef75bebe8b3f80680add1943d3
SHA1 1c48e211258f8887946afb063e9315b7609b4ee3
SHA512 e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804
MD5 SHA1 SHA512

Submit Download

rqpz35g3.cmdline

Path C:\Users\Admin\AppData\Local\Temp\rqpz35g3.cmdline
Size 171B
SHA256 44fc13ca17ca151c471bd3643536739e930bc2a84146535a44f59030b48cc9e4
MD5 39cc052a589533785dc6473f3002b6e8
SHA1 637511020df4912fee166cd1dbbfefa5d13e8e06
SHA512 5b4a00ef5e105fe7292757f55a6053401a0ea1d3aeef2d524c6939381960d99b6ae1bfa2afdf7696a7020068f6c00667345bda1b63da2525e9a00abb6092d433
MD5 SHA1 SHA512

Submit Download

vbc14E943BF617F4C0F80A2DB33CAE3198E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc14E943BF617F4C0F80A2DB33CAE3198E.TMP
Size 644B
SHA256 2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
MD5 dac60af34e6b37e2ce48ac2551aee4e7
SHA1 968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA512 1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084
MD5 SHA1 SHA512

Submit Download

vbc3F1921E152A0475FB469B23859BA61CC.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3F1921E152A0475FB469B23859BA61CC.TMP
Size 668B
SHA256 0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
MD5 3906bddee0286f09007add3cffcaa5d5
SHA1 0e7ec4da19db060ab3c90b19070d39699561aae2
SHA512 0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0
MD5 SHA1 SHA512

Submit Download

vbc5B7D50036E5C42FB816A55F9BE9FF8D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc5B7D50036E5C42FB816A55F9BE9FF8D.TMP
Size 676B
SHA256 f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
MD5 85c61c03055878407f9433e0cc278eb7
SHA1 15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA512 7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756
MD5 SHA1 SHA512

Submit Download

vbcB8AC51544E5F4252AA7D91265FD0A26A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB8AC51544E5F4252AA7D91265FD0A26A.TMP
Size 684B
SHA256 453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
MD5 7a707b422baa7ca0bc8883cbe68961e7
SHA1 addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA512 81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9
MD5 SHA1 SHA512

Submit Download

vbcD32F7F8EC28448608639C4554A39CB26.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD32F7F8EC28448608639C4554A39CB26.TMP
Size 684B
SHA256 e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
MD5 8135713eeb0cf1521c80ad8f3e7aad22
SHA1 1628969dc6256816b2ab9b1c0163fcff0971c154
SHA512 a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.exe

Path C:\Users\Admin\AppData\Roaming\Random\Default\Microsoft Edge.exe
Size 6KB
SHA256 7f97cec23b939bf85a093259be88ff8a9376c28dac18d375ef348897d638655d
MD5 bfbd5e86de7d1c1e86cd9ecfd77d69ef
SHA1 7678abdf0fd2d60f93df7b93ed5fac0f212371ab
SHA512 9fcd318c51bf15bc0ce720cf0dbbb46335fc1b85c53f13ce9fd60770d27590ae07f57f835d1efb5b15d2dcd99138de2b2ba1311c930cc17655eeec1fb908ac29
SSDEEP 96:UYuQBurOkMqKTbLSWsWU58DZcE2VYlnlYJnLLPL0KffAtwwYv1VRXmmuuBs:UYugyOlTSWqouVInlYJLLLTCYun
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSSCS.exe

Path C:\Windows\System32\MSSCS.exe
Size 21KB
SHA256 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
MD5 6fe3fb85216045fdf8186429c27458a7
SHA1 ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA512 d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
SSDEEP 384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1968-0-0x00007FFE2BA05000-0x00007FFE2BA06000-memory.dmp

Download

memory/1968-3-0x000000001BBD0000-0x000000001BC76000-memory.dmp

Download

memory/1968-8-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/1968-7-0x00007FFE2BA05000-0x00007FFE2BA06000-memory.dmp

Download

memory/1968-6-0x000000001C620000-0x000000001C6BC000-memory.dmp

Download

memory/1968-5-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/1968-4-0x000000001BD60000-0x000000001BDC2000-memory.dmp

Download

memory/1968-9-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/1968-1-0x000000001B700000-0x000000001BBCE000-memory.dmp

Download

memory/1968-21-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/1968-2-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/3948-20-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/3948-22-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/3948-19-0x00007FFE2B750000-0x00007FFE2C0F1000-memory.dmp

Download

memory/5340-35-0x0000019EB81C0000-0x0000019EB81E2000-memory.dmp

Download