revengerat | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2025, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Size 21KB
Sample250617-28f92aspx3
SHA256 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
MD5 6fe3fb85216045fdf8186429c27458a7
SHA1 ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA512 d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
SSDEEP 384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat execution stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral25/files/0x0004000000022b69-14.dat	revengerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe

Executes dropped EXE 1 IoCs

pid	Process
4112	MSSCS.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4908	powershell.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
File opened for modification	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
File opened for modification	C:\Windows\system32\MSSCS.exe	MSSCS.exe
File created	C:\Windows\system32\MSSCS.exe	MSSCS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	powershell.exe
4908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5340	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Token: SeDebugPrivilege	4112	MSSCS.exe
Token: SeDebugPrivilege	4908	powershell.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 4112	5340	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	91
PID 5340 wrote to memory of 4112	5340	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	91
PID 4112 wrote to memory of 4908	4112	MSSCS.exe	92
PID 4112 wrote to memory of 4908	4112	MSSCS.exe	92
PID 4112 wrote to memory of 4492	4112	MSSCS.exe	94
PID 4112 wrote to memory of 4492	4112	MSSCS.exe	94
PID 4492 wrote to memory of 5516	4492	vbc.exe	96
PID 4492 wrote to memory of 5516	4492	vbc.exe	96
PID 4112 wrote to memory of 4652	4112	MSSCS.exe	97
PID 4112 wrote to memory of 4652	4112	MSSCS.exe	97
PID 4652 wrote to memory of 3948	4652	vbc.exe	99
PID 4652 wrote to memory of 3948	4652	vbc.exe	99
PID 4112 wrote to memory of 1060	4112	MSSCS.exe	100
PID 4112 wrote to memory of 1060	4112	MSSCS.exe	100
PID 1060 wrote to memory of 1380	1060	vbc.exe	102
PID 1060 wrote to memory of 1380	1060	vbc.exe	102
PID 4112 wrote to memory of 5256	4112	MSSCS.exe	103
PID 4112 wrote to memory of 5256	4112	MSSCS.exe	103
PID 5256 wrote to memory of 5480	5256	vbc.exe	105
PID 5256 wrote to memory of 5480	5256	vbc.exe	105
PID 4112 wrote to memory of 5132	4112	MSSCS.exe	106
PID 4112 wrote to memory of 5132	4112	MSSCS.exe	106
PID 5132 wrote to memory of 4536	5132	vbc.exe	108
PID 5132 wrote to memory of 4536	5132	vbc.exe	108
PID 4112 wrote to memory of 860	4112	MSSCS.exe	109
PID 4112 wrote to memory of 860	4112	MSSCS.exe	109
PID 860 wrote to memory of 3228	860	vbc.exe	111
PID 860 wrote to memory of 3228	860	vbc.exe	111
PID 4112 wrote to memory of 5144	4112	MSSCS.exe	112
PID 4112 wrote to memory of 5144	4112	MSSCS.exe	112
PID 5144 wrote to memory of 2220	5144	vbc.exe	114
PID 5144 wrote to memory of 2220	5144	vbc.exe	114
PID 4112 wrote to memory of 1508	4112	MSSCS.exe	115
PID 4112 wrote to memory of 1508	4112	MSSCS.exe	115
PID 1508 wrote to memory of 1820	1508	vbc.exe	117
PID 1508 wrote to memory of 1820	1508	vbc.exe	117
PID 4112 wrote to memory of 2820	4112	MSSCS.exe	118
PID 4112 wrote to memory of 2820	4112	MSSCS.exe	118
PID 2820 wrote to memory of 2996	2820	vbc.exe	120
PID 2820 wrote to memory of 2996	2820	vbc.exe	120

C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Windows\system32\MSSCS.exe
  "C:\Windows\system32\MSSCS.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ppguksoh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA35.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDCB84630133B42DA85ED6655E4247EAF.TMP"
      4⤵
      PID:5516
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bqalps6v.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAE1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc85C18B71F13B4ED89965A54C7E86C4F4.TMP"
      4⤵
      PID:3948
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4cv1n4xu.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB6E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA63D7F5E5456418896BC7A184F2A3D4A.TMP"
      4⤵
      PID:1380
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pcfrur1m.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC29.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc30016564CB0C4CE1ABD25CC68545DBB1.TMP"
      4⤵
      PID:5480
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gdz8xffk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC97.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6A9E080D7FA404090EFD6536A5E5B71.TMP"
      4⤵
      PID:4536
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mxtowqxw.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACF4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcEDA9ABE36104392922AF3548DB4BF72.TMP"
      4⤵
      PID:3228
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mxdk7uq2.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD62.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6473D7965ED1458CB7B7B0BCDCB9F6D.TMP"
      4⤵
      PID:2220
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\92btflro.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADCF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc63BAD2CDE1FB4D27AEFA7C65DD739A22.TMP"
      4⤵
      PID:1820
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hj3tjdoy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE3C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD19041AAC7CE43AEAA80FECF6D425AD.TMP"
      4⤵
      PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4cv1n4xu.0.vb

Path C:\Users\Admin\AppData\Local\Temp\4cv1n4xu.0.vb
Size 271B
SHA256 fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7
MD5 ac972015bef75b540eb33503d6e28cc2
SHA1 5c1d09fcf4c719711532dcfd0544dfc6f2b90260
SHA512 36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83
MD5 SHA1 SHA512

Submit Download

4cv1n4xu.cmdline

Path C:\Users\Admin\AppData\Local\Temp\4cv1n4xu.cmdline
Size 171B
SHA256 1655f5d3abf174a3a5b4755ff6986ae2253361c0e44dc66f098e771f1361131c
MD5 3c9d5f03ff98063a5cbb89b8903246ba
SHA1 d4a5df0b04e10cbec8e7123b7176c91927b56658
SHA512 103c15af8edac8a3b1f7f39d0ff1ffdc2f4be88b170214ea39d8d0165feac050e15397bbb2a08f0470d5ef3b6d69ff2bf467f1ddf311e921005aa509654cbc34
MD5 SHA1 SHA512

Submit Download

92btflro.0.vb

Path C:\Users\Admin\AppData\Local\Temp\92btflro.0.vb
Size 271B
SHA256 034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35
MD5 325f27ef75bebe8b3f80680add1943d3
SHA1 1c48e211258f8887946afb063e9315b7609b4ee3
SHA512 e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804
MD5 SHA1 SHA512

Submit Download

92btflro.cmdline

Path C:\Users\Admin\AppData\Local\Temp\92btflro.cmdline
Size 171B
SHA256 6e42c5763f55df0c3a2c6162728506c5eb45c2dcb8dd9f7a24dd02bfc54137b4
MD5 fdfb7170dd912b0aa7abf9a48231c921
SHA1 9b97583bf111ea37a12fc3a66d53459d1b6260fe
SHA512 40746bf1516d0ea5fd647534c26eca24e9168a074ee9adf6215762e424fc9cb046187710f5413d80b0ef18385933c92d022bbb8db17c093431a2727340bb4d03
MD5 SHA1 SHA512

Submit Download

RESAA35.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAA35.tmp
Size 1KB
SHA256 3f79921ee8b8370a32de9d49724346c3b6e3b0990153565784a49815a0325c53
MD5 38b7cb7fb9635f48cd085d6e3357021b
SHA1 6b61d928f7966ec233fe938cd5ca739e6eab7e35
SHA512 6a5392109647b28eea7e87f2265cd9c7cc51a9fbfd7fa86ce6c31337709dc922584d84af6f25b7496ecfa2be701b3dccd9d0517cd5e07367c519030e4b408155
MD5 SHA1 SHA512

Submit Download

RESAAE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAAE1.tmp
Size 1KB
SHA256 530b8383a27f5315069b3b91da2cc75754748be29c510b071de728dd8e288750
MD5 53cbca60343846d704e29a23199669db
SHA1 b0434d759af8c3555c95ce7fefd506e82081c59f
SHA512 a43bda6cd1b7785f17e0be7d6160659991d2ef632c957a8181f2805a505a95fb965b909b01a706b17fa527ede9d983c0054d1c4484b39925e592fbe3c1b98672
MD5 SHA1 SHA512

Submit Download

RESAB6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAB6E.tmp
Size 1KB
SHA256 f5cc7b233175945b79f95b073f15a46aee5a78051e211a2bbde43ca03b961dbe
MD5 9ab1009f52ebf32f3dc259177f85a7f9
SHA1 57b2a317b244df9c9c73fc22fc3fba78159392f4
SHA512 ad299b94e6d2b3ac487e2098f38f92c9590b0b20a8a2ca9d79f4c374ddda974ca9e1c5d38e6f37010bf5445a8954616b49c058d61ea44d309405caf0be5db040
MD5 SHA1 SHA512

Submit Download

RESAC29.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAC29.tmp
Size 1KB
SHA256 a1369194d90293ad550257e22ce82d351c3eba5ea352abfdd16e2036355cb9c7
MD5 ae309424b27370b6875b1d4c68bff962
SHA1 7dff075cca032fe60179641251f3d65ad8513813
SHA512 e16d6a70131249c1fae430909ae458671820c6c2f4cfbb9c7ae7c4cce272904851ce642c8acc6bdc162b28777bec37c35cf5a576966f2a467fd2e362477622ff
MD5 SHA1 SHA512

Submit Download

RESAC97.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAC97.tmp
Size 1KB
SHA256 f3a94dcf9492ffda564df13d0fd486bc5a6a423855ce6fa52533ee86821fae5b
MD5 fe80a9f44d762bd37e4ea51fc8ea8b65
SHA1 1c2de4559b97b40d6dc7c206cfbab5de9fab1f2e
SHA512 b8ea1305707cb83e675b70a2eced088e390d7c75a7a22ee171b9a0a2fafd4029f3f47b93bf58861248e1d902f8166a0c70c0691d234e8f0511ae91615bcf074a
MD5 SHA1 SHA512

Submit Download

RESACF4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESACF4.tmp
Size 1KB
SHA256 ec5c0fc03b11106ea99433a40c896ad123b313340358c09ba880583c13f50b8a
MD5 939bd4fd4d475dbab545d041ff6838ea
SHA1 b646aae3dfb36fc10288d35b2479ab429976b1dd
SHA512 8dcc497df077334a47aa352dffaf219b848862784e8d194a6eb0bbfef205243211e84ec7cefae45a625e282fd0e65e7689bd30521820f162669bd44e829f86cb
MD5 SHA1 SHA512

Submit Download

RESAD62.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAD62.tmp
Size 1KB
SHA256 b0dd591e9b0aabbbf43f677cbc5901048b0aff37fed22c87be43409b64075e0d
MD5 26789f8d6ef13b3c5fb4230e4c2886d0
SHA1 a6535b3d9ae84feb42694af46d9b65b16c969d90
SHA512 ade8c86bb4e3cd6f14b4e2e94c778293b5e1b06863b88949ce8ed85df42e12e2e09fd63740adc1928fbccb0eae314e0a5b5d0a2e4a5fbd4c85587a8b600ec083
MD5 SHA1 SHA512

Submit Download

RESADCF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESADCF.tmp
Size 1KB
SHA256 5b2ef9e1d780b14ea86851c2cd0363f912bd5f381d1bc765eb09eb4ecc291355
MD5 9efd28549d6420e43689e2c44bbed3bf
SHA1 a7683824613b8fce29589c0c42d873d424f1141b
SHA512 39a67349581a70ccf539ec275294ff30337ddeb54889f7ff667a91ae69868544d0c0eb19c59d218930248d0c2ac2c046be32b3f4a4e32e79502c033c4da5ac07
MD5 SHA1 SHA512

Submit Download

RESAE3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAE3C.tmp
Size 1KB
SHA256 bd200c1452df50554745fd42a531a18e14ab32a3ec2f235f54c4797ac949b0fc
MD5 318fec5caffbd4bd2425074d79c7a001
SHA1 2caa4fc1f9a0daf6e1b88918e7b0594b3f7dc72a
SHA512 c9c7a48424b1e26da8932be5f749bec8572677736b20cfe37222023c54814d459b7c706501be41c988f819b28932aefbdf28c11fc0bb55fba1710ca30a2a0414
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xxegul11.lon.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xxegul11.lon.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

bqalps6v.0.vb

Path C:\Users\Admin\AppData\Local\Temp\bqalps6v.0.vb
Size 262B
SHA256 08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020
MD5 88cc385da858aaa7057b54eaeb0df718
SHA1 b108224d4686b5ca3faaeb1c728dfba8740a6eca
SHA512 4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7
MD5 SHA1 SHA512

Submit Download

bqalps6v.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bqalps6v.cmdline
Size 162B
SHA256 7eb1d6375cd71565452321836758b664db726e2616429a0df64e5c44438057ea
MD5 0a34d78a9abefb2a599a449e2a6ce0c8
SHA1 c939e24fe182d99911df8d9facc2da44c6283b3b
SHA512 0effbe824297ac0b5318d3ea9a41cfa89b603cbfc8d05941c9f03918134708e14762c4e5e2a0b704cfd9ac1f3d1a9357562518620b072522ffb2f2c6486fa085
MD5 SHA1 SHA512

Submit Download

gdz8xffk.0.vb

Path C:\Users\Admin\AppData\Local\Temp\gdz8xffk.0.vb
Size 274B
SHA256 ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e
MD5 539683c4ca4ee4dc46b412c5651f20f5
SHA1 564f25837ce382f1534b088cf2ca1b8c4b078aed
SHA512 df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac
MD5 SHA1 SHA512

Submit Download

gdz8xffk.cmdline

Path C:\Users\Admin\AppData\Local\Temp\gdz8xffk.cmdline
Size 174B
SHA256 17f8256b92e2ea3a694e8b7fe8d279c183a094885592887671da5e31b87fcd2d
MD5 272a4c73eee9f18045604eb45b655e4d
SHA1 bbc423f411fb059c22d2b9cd94f9c3fac6a1b300
SHA512 c0f7210c823b02669cd216febc20dbdcc09b3a1aaa2ef98baeff2ebbcf4087e5233fe7d8b6ef3d1797816640927069ba7d4a923237a28a84678263ea69059a89
MD5 SHA1 SHA512

Submit Download

hj3tjdoy.0.vb

Path C:\Users\Admin\AppData\Local\Temp\hj3tjdoy.0.vb
Size 273B
SHA256 5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd
MD5 3c3d3136aa9f1b87290839a1d26ad07a
SHA1 005a23a138be5d7a98bdd4a6cc7fab8bdca962f4
SHA512 fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60
MD5 SHA1 SHA512

Submit Download

hj3tjdoy.cmdline

Path C:\Users\Admin\AppData\Local\Temp\hj3tjdoy.cmdline
Size 173B
SHA256 7604e3cbdbd89bf7160328093d479c8358fad298d99a6aab0537281386d13d0b
MD5 04c586d66a1b0e3d0babac82f7c43bfa
SHA1 7092887f62e7bf54ddb12455887b2e358b972b6c
SHA512 82504f045cda47c2ac1497a56959ca28590dcc73f1a64fae554f5ea1978f62c46a89cc93590d33d218cd7e20bb2ef0445a47bdb3852091769501e566695c93e7
MD5 SHA1 SHA512

Submit Download

mxdk7uq2.0.vb

Path C:\Users\Admin\AppData\Local\Temp\mxdk7uq2.0.vb
Size 270B
SHA256 c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607
MD5 658573fde2bebc77c740da7ddaa4634b
SHA1 073da76c50b4033fcfdfb37ba6176afd77b0ea55
SHA512 f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf
MD5 SHA1 SHA512

Submit Download

mxdk7uq2.cmdline

Path C:\Users\Admin\AppData\Local\Temp\mxdk7uq2.cmdline
Size 170B
SHA256 5caa85345758848a73bcd5cd9bdaeb02f9d48f0359a4d72744c36dadea6161f6
MD5 1cf4b1f66e95804e97c7cd5145fe308e
SHA1 6358e48b5e749e2627ce17203960d7fde8e90b78
SHA512 7f8e4a2c1675356f2b8f19a1e84df8d4b01aaf67379daa29aed5fb935aeb5f6f58ff773c9239af7acda5cb7aed13a5926a439f08dc6b96d8c84995f311ec996c
MD5 SHA1 SHA512

Submit Download

mxtowqxw.0.vb

Path C:\Users\Admin\AppData\Local\Temp\mxtowqxw.0.vb
Size 264B
SHA256 e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed
MD5 5ce3977a153152978fa71f8aa96909e9
SHA1 52af143c553c92afc257f0e0d556908eaa8919cb
SHA512 eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77
MD5 SHA1 SHA512

Submit Download

mxtowqxw.cmdline

Path C:\Users\Admin\AppData\Local\Temp\mxtowqxw.cmdline
Size 164B
SHA256 1e31e3cdb574afc0b2aced71ef7ec6448b8f1f5956f18c9e2f4eb5623ee497a9
MD5 ba1e0e793d79b2964493ebc505061095
SHA1 2c1051c662531fb7098edc2667a189d9f301c7bc
SHA512 2d1ef76af8eb415225dfed9e7aeae40cbe9a70f60393da2a9c218c91d2e8dbcb95783ff2285ca199a2658c4b6f7b9342590383e78a136276936872e7366f1795
MD5 SHA1 SHA512

Submit Download

pcfrur1m.0.vb

Path C:\Users\Admin\AppData\Local\Temp\pcfrur1m.0.vb
Size 272B
SHA256 b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89
MD5 2b3aac520562a93ebef6a5905d4765c9
SHA1 10ab45c5d73934b16fac5e30bf22f17d3e0810c8
SHA512 9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446
MD5 SHA1 SHA512

Submit Download

pcfrur1m.cmdline

Path C:\Users\Admin\AppData\Local\Temp\pcfrur1m.cmdline
Size 172B
SHA256 f891a226e5fb06a80877d12f186c671105558079da92b7a7894a9b8603cb3fd1
MD5 d31f9ca51dc970df9d3e26b21e0a63d1
SHA1 039dd15973a1cbe6882204b1d31d9a1e22bcfc69
SHA512 f8edfe432ab429ca857d8fe1d61c3761e658261022cbb5b453d660e89c0e69abe769d978e2ebf26113f8d362caccecc45824453a12213acbd0e85cebb36d392a
MD5 SHA1 SHA512

Submit Download

ppguksoh.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ppguksoh.0.vb
Size 256B
SHA256 5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3
MD5 076803692ac8c38d8ee02672a9d49778
SHA1 45d2287f33f3358661c3d6a884d2a526fc6a0a46
SHA512 cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d
MD5 SHA1 SHA512

Submit Download

ppguksoh.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ppguksoh.cmdline
Size 156B
SHA256 c50448871d1fde8fb08f3742a1a2231a0a2520d46c736a3b71fd7071f65be22a
MD5 3c96d870ec423db0ed7205bff0fba1d9
SHA1 22feb39517c0b0aadfea7d09cf10db7083f43a3a
SHA512 ff4ad3630eef7e7eca91228078e8a014bbdeaf26368e33d33952a4bb986621fb9c3ba02e667bfe053bf65d5fc588f499245a5364dbdda4882dc83e0446d8585d
MD5 SHA1 SHA512

Submit Download

vbc30016564CB0C4CE1ABD25CC68545DBB1.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc30016564CB0C4CE1ABD25CC68545DBB1.TMP
Size 676B
SHA256 f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
MD5 85c61c03055878407f9433e0cc278eb7
SHA1 15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA512 7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756
MD5 SHA1 SHA512

Submit Download

vbc6A9E080D7FA404090EFD6536A5E5B71.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc6A9E080D7FA404090EFD6536A5E5B71.TMP
Size 684B
SHA256 e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
MD5 8135713eeb0cf1521c80ad8f3e7aad22
SHA1 1628969dc6256816b2ab9b1c0163fcff0971c154
SHA512 a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4
MD5 SHA1 SHA512

Submit Download

vbc85C18B71F13B4ED89965A54C7E86C4F4.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc85C18B71F13B4ED89965A54C7E86C4F4.TMP
Size 668B
SHA256 0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
MD5 3906bddee0286f09007add3cffcaa5d5
SHA1 0e7ec4da19db060ab3c90b19070d39699561aae2
SHA512 0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0
MD5 SHA1 SHA512

Submit Download

vbcD19041AAC7CE43AEAA80FECF6D425AD.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD19041AAC7CE43AEAA80FECF6D425AD.TMP
Size 684B
SHA256 453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
MD5 7a707b422baa7ca0bc8883cbe68961e7
SHA1 addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA512 81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9
MD5 SHA1 SHA512

Submit Download

vbcDCB84630133B42DA85ED6655E4247EAF.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDCB84630133B42DA85ED6655E4247EAF.TMP
Size 644B
SHA256 2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
MD5 dac60af34e6b37e2ce48ac2551aee4e7
SHA1 968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA512 1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084
MD5 SHA1 SHA512

Submit Download

MSSCS.exe

Path C:\Windows\System32\MSSCS.exe
Size 21KB
SHA256 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
MD5 6fe3fb85216045fdf8186429c27458a7
SHA1 ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA512 d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
SSDEEP 384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4112-23-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/4112-21-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/4112-20-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/4112-19-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/4908-33-0x00000192BB120000-0x00000192BB142000-memory.dmp

Download

memory/5340-9-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/5340-0-0x00007FFBF0DC5000-0x00007FFBF0DC6000-memory.dmp

Download

memory/5340-8-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/5340-7-0x00007FFBF0DC5000-0x00007FFBF0DC6000-memory.dmp

Download

memory/5340-6-0x000000001CB90000-0x000000001CC2C000-memory.dmp

Download

memory/5340-5-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/5340-4-0x000000001C310000-0x000000001C372000-memory.dmp

Download

memory/5340-3-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/5340-2-0x000000001C170000-0x000000001C216000-memory.dmp

Download

memory/5340-22-0x00007FFBF0B10000-0x00007FFBF14B1000-memory.dmp

Download

memory/5340-1-0x000000001BCA0000-0x000000001C16E000-memory.dmp

Download