revengerat | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

max time kernel
143s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
27/06/2025, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Size 21KB
Sample250627-v1z9lsstdw
SHA256 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
MD5 6fe3fb85216045fdf8186429c27458a7
SHA1 ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA512 d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
SSDEEP 384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

revengerat execution stealer trojan

Malware Config

Signatures

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
Revengerat family
revengerat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral11/files/0x001a00000002b022-23.dat	revengerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MSO.exe	MSSCS.exe

Executes dropped EXE 1 IoCs

pid	Process
1096	MSSCS.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1468	powershell.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
File opened for modification	C:\Windows\system32\MSSCS.exe	MSSCS.exe
File created	C:\Windows\system32\MSSCS.exe	MSSCS.exe
File created	C:\Windows\system32\MSSCS.exe	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1468	powershell.exe
1468	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Token: SeDebugPrivilege	1096	MSSCS.exe
Token: SeDebugPrivilege	1468	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1096	4024	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	79
PID 4024 wrote to memory of 1096	4024	905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe	79
PID 1096 wrote to memory of 1468	1096	MSSCS.exe	80
PID 1096 wrote to memory of 1468	1096	MSSCS.exe	80
PID 1096 wrote to memory of 4436	1096	MSSCS.exe	82
PID 1096 wrote to memory of 4436	1096	MSSCS.exe	82
PID 4436 wrote to memory of 5828	4436	vbc.exe	84
PID 4436 wrote to memory of 5828	4436	vbc.exe	84
PID 1096 wrote to memory of 1292	1096	MSSCS.exe	85
PID 1096 wrote to memory of 1292	1096	MSSCS.exe	85
PID 1292 wrote to memory of 4904	1292	vbc.exe	87
PID 1292 wrote to memory of 4904	1292	vbc.exe	87
PID 1096 wrote to memory of 2260	1096	MSSCS.exe	88
PID 1096 wrote to memory of 2260	1096	MSSCS.exe	88
PID 2260 wrote to memory of 5084	2260	vbc.exe	90
PID 2260 wrote to memory of 5084	2260	vbc.exe	90
PID 1096 wrote to memory of 3480	1096	MSSCS.exe	91
PID 1096 wrote to memory of 3480	1096	MSSCS.exe	91
PID 3480 wrote to memory of 2752	3480	vbc.exe	93
PID 3480 wrote to memory of 2752	3480	vbc.exe	93
PID 1096 wrote to memory of 2072	1096	MSSCS.exe	94
PID 1096 wrote to memory of 2072	1096	MSSCS.exe	94
PID 2072 wrote to memory of 1508	2072	vbc.exe	96
PID 2072 wrote to memory of 1508	2072	vbc.exe	96
PID 1096 wrote to memory of 1232	1096	MSSCS.exe	97
PID 1096 wrote to memory of 1232	1096	MSSCS.exe	97
PID 1232 wrote to memory of 2444	1232	vbc.exe	99
PID 1232 wrote to memory of 2444	1232	vbc.exe	99
PID 1096 wrote to memory of 6044	1096	MSSCS.exe	100
PID 1096 wrote to memory of 6044	1096	MSSCS.exe	100
PID 6044 wrote to memory of 5844	6044	vbc.exe	102
PID 6044 wrote to memory of 5844	6044	vbc.exe	102
PID 1096 wrote to memory of 4008	1096	MSSCS.exe	103
PID 1096 wrote to memory of 4008	1096	MSSCS.exe	103
PID 4008 wrote to memory of 3520	4008	vbc.exe	105
PID 4008 wrote to memory of 3520	4008	vbc.exe	105
PID 1096 wrote to memory of 4764	1096	MSSCS.exe	106
PID 1096 wrote to memory of 4764	1096	MSSCS.exe	106
PID 4764 wrote to memory of 1160	4764	vbc.exe	108
PID 4764 wrote to memory of 1160	4764	vbc.exe	108
PID 1096 wrote to memory of 1596	1096	MSSCS.exe	109
PID 1096 wrote to memory of 1596	1096	MSSCS.exe	109
PID 1596 wrote to memory of 1448	1596	vbc.exe	111
PID 1596 wrote to memory of 1448	1596	vbc.exe	111

C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
"C:\Users\Admin\AppData\Local\Temp\905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\system32\MSSCS.exe
  "C:\Windows\system32\MSSCS.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('Isto abriu lol','Rekt!',0,64)
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\vi8p5_ap.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBD4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF91687C2F0824D24A2593A648E6472D.TMP"
      4⤵
      PID:5828
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jzpegbtm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC71.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCD6A4F134198488783C3FCE17C928361.TMP"
      4⤵
      PID:4904
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2hnfdvn_.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCFD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7353C2D45DB1430F931CBBEC1365CA98.TMP"
      4⤵
      PID:5084
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r2f5gsor.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD7A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc27FF0C8ED6A4CE6B3EEE47053F5A4C.TMP"
      4⤵
      PID:2752
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kj4sv_4y.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDD8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFB8D5B404F4E4D8A963BCAA3B226F88E.TMP"
      4⤵
      PID:1508
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k7frfdqn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE84.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB33665D8CB994FBE90B3DDAB6F901EC6.TMP"
      4⤵
      PID:2444
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wpd9mkjx.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDEE2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDC8D592368B24EA7B1FD116AB9E46348.TMP"
      4⤵
      PID:5844
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lgu35wsb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF3F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc43800176A62D47E8A83717806582E73.TMP"
      4⤵
      PID:3520
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xw53mz-1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF8D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc321B6A88DE84D2C9766F974EEB1F5F5.TMP"
      4⤵
      PID:1160
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\br7kfwyv.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDFDC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1C30911966F45ABBDA6AA7E37F4FF9.TMP"
      4⤵
      PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2hnfdvn_.0.vb

Path C:\Users\Admin\AppData\Local\Temp\2hnfdvn_.0.vb
Size 271B
SHA256 fa445cc76cde3461a5f1f1281fefcb0c7db69b2685f8a67a06a0f33a067e74e7
MD5 ac972015bef75b540eb33503d6e28cc2
SHA1 5c1d09fcf4c719711532dcfd0544dfc6f2b90260
SHA512 36b2e1f7b7a6f2c60788f88d95bfdc53b7d261c203eb637a36fbd07d81bc46edc87e528f1987df73963cb75ca2f19c3a4b3df9ade52d5768ecec23753099cc83
MD5 SHA1 SHA512

Submit Download

2hnfdvn_.cmdline

Path C:\Users\Admin\AppData\Local\Temp\2hnfdvn_.cmdline
Size 171B
SHA256 8841e0981e4daf149ce23c81e66b5676384f3eb5ddce970cb248dbd4aa528c25
MD5 cdd31401e729a9831ada737b493f9401
SHA1 e23f8c3bf9526eba325d81753d9c1ff2081a658c
SHA512 f73163e8f9ad63f68c7099058fb669c1ba74756d3babaddce8847f45956e42049b9821da3fddd169311e142aeb566e567585bfdf87d0857a74c7a6580be8fdd9
MD5 SHA1 SHA512

Submit Download

RESDBD4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDBD4.tmp
Size 1KB
SHA256 546251e5c4bc90b75acc1418236f10b13e3a6cf5e4212bf68815822b7b5ef861
MD5 47263bee1ee9efb057178b42a10de6dd
SHA1 34abb33360a6f3653149474e2dc654509bc1da01
SHA512 d65529b14d61653e16227c015b201a7d285699b3b0ed76d7f98e8721a1b00d7b9f02e12e76bd752f487d7c958a9fb91938cf7b168aec2549f3481960e91627b7
MD5 SHA1 SHA512

Submit Download

RESDC71.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDC71.tmp
Size 1KB
SHA256 eea00bfc91345b9ad73505e3f3df9d6bcdd6a6d81e0a454cdf52b87e6447fd36
MD5 fa32dc0bdebba54c0ee2828577667484
SHA1 0bb2e95785e34fd0a2c7f25a1cd3a59348d1b10b
SHA512 6547e96e7f0b368b3b2e3a656a89f77dc955342e75d70b2eaa038cc9ad7e454c51173aaf070a4153fb1ba728931c082450d788ece7a3392bf1f551ea6d5c8e7c
MD5 SHA1 SHA512

Submit Download

RESDCFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDCFD.tmp
Size 1KB
SHA256 cacd487bf4a5a9e56ef419cb0537a57ae492966372498e075f9fc8577810f8ec
MD5 03672247f1f3b99e453a1fe212dfdda5
SHA1 aa36036b2a8b72821e3a45d3ea32d00958c1c58a
SHA512 9e459b9136cee4cc8c11d5e89e810b5d7eadf76408b271a62fb362a2fdd56ffdb2d49c4012b494d233d6edb6c0cf9386d532c90326a1aa77b9a5c5c44a8a3242
MD5 SHA1 SHA512

Submit Download

RESDD7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDD7A.tmp
Size 1KB
SHA256 a65bc79e96326741aff99efb975932a575d742769b5ad078fcd13617a0e10c66
MD5 24a0910f05419f2f0240d81a82761792
SHA1 ab62bf81fa7f0eeed29d333a40113b0647241465
SHA512 7621c56179a28b1ad61dff6ff00e3267912fa24a7555f30af89b1df9388f126e03b9be1d0595cbae37931014f0f6176c4c8e138f70bc3720cb9d226a8d567c0a
MD5 SHA1 SHA512

Submit Download

RESDDD8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDDD8.tmp
Size 1KB
SHA256 6f89370076f9228f086a901843bca52bca410f57c7446ce40ad76deb22afc6fb
MD5 5cc07eea78bda5d30edc2c0ea7d7cc3b
SHA1 97f661b56ab42abca09f0552a18a6db5078157a0
SHA512 1d066ac6fbb4d16db06d53b887a20ede5dcdf8f5f5c04875ecbd663920b30c2b14fb90713ad65b9b5f9bbe2bddd48cb1354c8fd79ee50aafcfbf7c9a734f0b2f
MD5 SHA1 SHA512

Submit Download

RESDE84.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDE84.tmp
Size 1KB
SHA256 39fde647285aae0f23eb5b0e4655a056cf780d0ce8f93f084683dc3b19026d58
MD5 2df29a92cf3d9668c7d8b9f01b3d68b5
SHA1 624d065da70d24b8abfadfda55093eddd810c932
SHA512 769113704825234474979e04f4300ae14a3237b45c9e4d93559ed7415b679fa0df593feb3de228323866cf68f1bdbf82e6d800251a55d04fc5e7462a4c1f0055
MD5 SHA1 SHA512

Submit Download

RESDEE2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDEE2.tmp
Size 1KB
SHA256 7b500da9542e81da980c91ca7e25d369963e475d7adf863ace1ab81dfe4639a8
MD5 eedcb24ee45732ade14a3a869e4e48e0
SHA1 ff54905d7097739a8e09a58b8b069ff08d543b33
SHA512 490a49a12153c8fe1bb50c9fb2014137c9275eee9bdaa65318cd5136052efcc59dabb6cdaf52f528eb4f4082b542d1a0fa6317a018eaf47b6e951ba4292972e8
MD5 SHA1 SHA512

Submit Download

RESDF3F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDF3F.tmp
Size 1KB
SHA256 9d10855ac9638246449ecf798c1c06de54c7bdc71edb5aab7e46e740b4e12546
MD5 d15906916802290a012b014fca5ee44a
SHA1 3035804dc0f4663cc2737588d0d315906df838cb
SHA512 3c5c695f2827d45c712be0679e722246a88057b0489472dea4f5e721f03610fbeb37a8be1754162f1b4eb2e5897b9a883bf07ff7338eef8774c148c271669f60
MD5 SHA1 SHA512

Submit Download

RESDF8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDF8D.tmp
Size 1KB
SHA256 b2abcba912cd0be1758bd4cc16697d47b58b8c6ae8a1486660c7fe994dcd245f
MD5 2f93d1154584fc18ba8711690859c57d
SHA1 518004f483d6a69267a26c6c8a245b9c81ecb256
SHA512 23f63d0d85edfc5047e889af64cb0fbbc3c0c890ef965661da3183e6687d29268bcaa6d0e8a75c9e3edc15eb82a1d048478480abe0aa3071b2b28c2c068d1246
MD5 SHA1 SHA512

Submit Download

RESDFDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDFDC.tmp
Size 1KB
SHA256 22e48a4e8d156778a0c03b344b77b1f24b9eab65a4ddbfc894f67cc094a548c4
MD5 bf741f79360f2e8576d857b0dd6b4a89
SHA1 b95f58541f05dda6e27bf65eb5bfaaf46b91a7d1
SHA512 4f006b1dd1e8d66db8e9319b60d408517fced074bdbcc56595134ee4d4cd1655043684aee9f50adb976e045a513f952cb409f5a4cc3158e3208a428f62b46f7d
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fjwrwm3w.e35.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjwrwm3w.e35.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

br7kfwyv.0.vb

Path C:\Users\Admin\AppData\Local\Temp\br7kfwyv.0.vb
Size 273B
SHA256 5b745f85a39312bfa585edbd7e3465371578b42fa639eded4cdad8c9f96b87fd
MD5 3c3d3136aa9f1b87290839a1d26ad07a
SHA1 005a23a138be5d7a98bdd4a6cc7fab8bdca962f4
SHA512 fbb085ffcd77ac96c245067fd96a0c20492d55331161f292975b0c11386424a96534a500133217f84d44455e16139d01230455bce5db3d472271620c29381f60
MD5 SHA1 SHA512

Submit Download

br7kfwyv.cmdline

Path C:\Users\Admin\AppData\Local\Temp\br7kfwyv.cmdline
Size 173B
SHA256 4f1e4220283b5a2afb3a94907df6b2e221942cca02a3cfe25ae0bfa34bebafd4
MD5 10578e4366379a75a4b29a6edd112196
SHA1 e5c90c0587c84c2a3beab7c2052b4166314de5b1
SHA512 4e320877989022b8fe427c914c849588354a11f8a2e770cd23b7a08fd41dd7eac149fe5a922c81308131029b3bf68f113e082fc898d7d6abf798ac1a92dfce74
MD5 SHA1 SHA512

Submit Download

jzpegbtm.0.vb

Path C:\Users\Admin\AppData\Local\Temp\jzpegbtm.0.vb
Size 262B
SHA256 08a30db98d970e3b6819d5ecff6eab2211ce93f4cd000c09db96ffb294d05020
MD5 88cc385da858aaa7057b54eaeb0df718
SHA1 b108224d4686b5ca3faaeb1c728dfba8740a6eca
SHA512 4787835240c3e2364172ac2e7649ec8fecb907c7006c38734e59aa65509f360b4596d5db8de20e0c7388a022e1c2f4f9ba75acabba798bea1d40f688539b7df7
MD5 SHA1 SHA512

Submit Download

jzpegbtm.cmdline

Path C:\Users\Admin\AppData\Local\Temp\jzpegbtm.cmdline
Size 162B
SHA256 e00b7b7677251eeab77744a4c0e4b36e67b37d5252dcc02a9468dbf1cebcc1a3
MD5 161144fb80cfd7d2c514d50fa411411c
SHA1 185be17afc2e641958bb1614cbbead768b37d33c
SHA512 eb95f996ad2742b108be547a751bb7b7922517e2a13e69d3ce5ccedee0c4f2ee21e8f3e1895f556ad6a15f4ca2ed74b9e2acd3f143443ee5236657a3302af9d1
MD5 SHA1 SHA512

Submit Download

k7frfdqn.0.vb

Path C:\Users\Admin\AppData\Local\Temp\k7frfdqn.0.vb
Size 274B
SHA256 ec2210924d5c1af6377ef4bdf76d6ca773aaa1ae0438b0850f44d8c4e16ef92e
MD5 539683c4ca4ee4dc46b412c5651f20f5
SHA1 564f25837ce382f1534b088cf2ca1b8c4b078aed
SHA512 df7c1a55e53f9b9bf23d27762d2d1163c78808e9b4d95e98c84c55ca4ecb7009ed58574ae6ddede31459f300483a1dc42987295a04f6c8702f297d3f1942f4ac
MD5 SHA1 SHA512

Submit Download

k7frfdqn.cmdline

Path C:\Users\Admin\AppData\Local\Temp\k7frfdqn.cmdline
Size 174B
SHA256 2eabca77cfaaa242c5cfe4c0161a070f0216e015cd8b9500bd3ffe5b3496019f
MD5 2c67127376b0566472167d75206bf90a
SHA1 b1c5e82f819863f0fb6d32db75ca021ec3ac4347
SHA512 3e711be0dde28fabbee2cba68d422209cf3624a11030d8cb2b362ba0fead336138305acab10d96901d90b47aea324d79906dc35a8e7e2e0a29fb7c55b166f68b
MD5 SHA1 SHA512

Submit Download

kj4sv_4y.0.vb

Path C:\Users\Admin\AppData\Local\Temp\kj4sv_4y.0.vb
Size 271B
SHA256 034c75813491d628a1a740b45888fc0c301b915456aaa7ba6433b4f1368cda35
MD5 325f27ef75bebe8b3f80680add1943d3
SHA1 1c48e211258f8887946afb063e9315b7609b4ee3
SHA512 e2165b425558872897990953c26e48776f45751a53da035f1ad86ac062ec23a2923b984d84f992de5c0170f6e192feb155ffff25f51bc76ab273b996daacb804
MD5 SHA1 SHA512

Submit Download

kj4sv_4y.cmdline

Path C:\Users\Admin\AppData\Local\Temp\kj4sv_4y.cmdline
Size 171B
SHA256 c3350e5ac35820f66b3083be86e84f9cab830b1cb9d81fa2235fb33dfe0b2c08
MD5 6fa481722600feb84e423dfadfe2b30c
SHA1 4ced1e8a93d8d00f972bdf8d9d5ca09732b16cde
SHA512 1ea0cae7b270ad57498b24a4a5ba8d99b2a57410df7625687d485d66c32499f33985dd06dba214a0cc2aeb4f1c42e2d10d2097bd11dbbe5d7fb446cb3a459632
MD5 SHA1 SHA512

Submit Download

lgu35wsb.0.vb

Path C:\Users\Admin\AppData\Local\Temp\lgu35wsb.0.vb
Size 270B
SHA256 c07206283d62100d426ba62a81e97bd433966f8b52b5a8dd1451e29a804a1607
MD5 658573fde2bebc77c740da7ddaa4634b
SHA1 073da76c50b4033fcfdfb37ba6176afd77b0ea55
SHA512 f93c7f4378be5eca51161d1541d772a34c07884c9d829608c6fa21563df5691920394afe9da1174ad5c13f773a588b186d1d38a9d375a28562eb58ca4a8b8fbf
MD5 SHA1 SHA512

Submit Download

lgu35wsb.cmdline

Path C:\Users\Admin\AppData\Local\Temp\lgu35wsb.cmdline
Size 170B
SHA256 b4ddba7d38eae6be49863fcd40e42a58c2b4e0d768cffb2d5e6ff7ef82d6dc9e
MD5 12c37a04903fb8db4d4c8705999d65d3
SHA1 bd313e075db08b23cd85e5073845adba5410f90b
SHA512 5b62aca9f3bd96c80c7e4eea5a87d7a24544fac66a60596ea127113682be2937991e49b5b83b785e79e6a14dae1f33b049e72d4c2bd6fee99b95320bddde1720
MD5 SHA1 SHA512

Submit Download

r2f5gsor.0.vb

Path C:\Users\Admin\AppData\Local\Temp\r2f5gsor.0.vb
Size 272B
SHA256 b9f0edf067faaaa7da2d47e3d22b957cd302eb25e01e08ea79c664868f328f89
MD5 2b3aac520562a93ebef6a5905d4765c9
SHA1 10ab45c5d73934b16fac5e30bf22f17d3e0810c8
SHA512 9514934ed12d93ea3ad4e6873cf294bafa114bc7a784a93b14dd2410d07fae3a2c00308035a5c129c57e283de8b94ed36fd9f9de35b08eb79a82a0c732e50446
MD5 SHA1 SHA512

Submit Download

r2f5gsor.cmdline

Path C:\Users\Admin\AppData\Local\Temp\r2f5gsor.cmdline
Size 172B
SHA256 0fa52b86634183dadacfaffaabb9e5b7863846c6fec2f94e76b7d0b47067ee76
MD5 f6548770cbb89b85aea2c5bb101da69b
SHA1 80ed5f447b1e6f890c5b45f52c5c8df8c1ab7af0
SHA512 397dab9189506d558898cb9f29f6779b8540b74e133a62d84d9002bdf175002b759c807223264ceec4b1804fdd98d4ce6c09a8fb9f7dbb7dd069303287098bee
MD5 SHA1 SHA512

Submit Download

vbc1C30911966F45ABBDA6AA7E37F4FF9.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1C30911966F45ABBDA6AA7E37F4FF9.TMP
Size 684B
SHA256 453ad1da51152e3512760bbd206304bf48f9c880f63b6a0726009e2d1371c71c
MD5 7a707b422baa7ca0bc8883cbe68961e7
SHA1 addf3158670a318c3e8e6fdd6d560244b9e8860e
SHA512 81147c1c4c5859249f4e25d754103f3843416e3d0610ac81ee2ef5e5f50622ea37f0c68eeb7fa404f8a1779dc52af02d2142874e39c212c66fa458e0d62926a9
MD5 SHA1 SHA512

Submit Download

vbc27FF0C8ED6A4CE6B3EEE47053F5A4C.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc27FF0C8ED6A4CE6B3EEE47053F5A4C.TMP
Size 676B
SHA256 f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b
MD5 85c61c03055878407f9433e0cc278eb7
SHA1 15a60f1519aefb81cb63c5993400dd7d31b1202f
SHA512 7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756
MD5 SHA1 SHA512

Submit Download

vbcB33665D8CB994FBE90B3DDAB6F901EC6.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcB33665D8CB994FBE90B3DDAB6F901EC6.TMP
Size 684B
SHA256 e14dd88df69dc98be5bedcbc8c43d1e7260b4492899fec24d964000a3b096c7a
MD5 8135713eeb0cf1521c80ad8f3e7aad22
SHA1 1628969dc6256816b2ab9b1c0163fcff0971c154
SHA512 a0b7210095767b437a668a6b0bcedf42268e80b9184b9910ed67d665fba9f714d06c06bff7b3da63846791d606807d13311946505776a1b891b39058cfb41bd4
MD5 SHA1 SHA512

Submit Download

vbcCD6A4F134198488783C3FCE17C928361.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcCD6A4F134198488783C3FCE17C928361.TMP
Size 668B
SHA256 0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00
MD5 3906bddee0286f09007add3cffcaa5d5
SHA1 0e7ec4da19db060ab3c90b19070d39699561aae2
SHA512 0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0
MD5 SHA1 SHA512

Submit Download

vbcF91687C2F0824D24A2593A648E6472D.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcF91687C2F0824D24A2593A648E6472D.TMP
Size 644B
SHA256 2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6
MD5 dac60af34e6b37e2ce48ac2551aee4e7
SHA1 968c21d77c1f80b3e962d928c35893dbc8f12c09
SHA512 1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084
MD5 SHA1 SHA512

Submit Download

vi8p5_ap.0.vb

Path C:\Users\Admin\AppData\Local\Temp\vi8p5_ap.0.vb
Size 256B
SHA256 5b3ab23bcadaeb54a41bdb1636bcaf7772af028d375f42baeb967de6579ef2a3
MD5 076803692ac8c38d8ee02672a9d49778
SHA1 45d2287f33f3358661c3d6a884d2a526fc6a0a46
SHA512 cc9126384a287ccb99d10d5c2d3034cdbc8a45e94f1cec48dd95f2aa08ebbe3053ffd6d6effa31f2d84164edbb6136398cd02c08b05f027a6a777dffd1daea5d
MD5 SHA1 SHA512

Submit Download

vi8p5_ap.cmdline

Path C:\Users\Admin\AppData\Local\Temp\vi8p5_ap.cmdline
Size 156B
SHA256 d8bd1a55d3c7018611018e9ef822e8b4b7d70624ae482d7d98dcd11cb4fe30f2
MD5 e5a9e639345ef843d46ef4fc9fb59dda
SHA1 e204e4ff2ed5438454fb2daad3fbc42f6a468219
SHA512 4adc92023b70679a7e4b9bb5717f64fca22d4bd5fb42b10dee077cd7fb4d2f8dfe93ecdfa1c2289573af2cf2eeeab80c5c4da01d83a9dc4e92c80bc1d2265dd0
MD5 SHA1 SHA512

Submit Download

wpd9mkjx.0.vb

Path C:\Users\Admin\AppData\Local\Temp\wpd9mkjx.0.vb
Size 264B
SHA256 e07a7bd0c2901d3a349ab55e936b34de2d0abb5f2dc555cc128773b8045d3eed
MD5 5ce3977a153152978fa71f8aa96909e9
SHA1 52af143c553c92afc257f0e0d556908eaa8919cb
SHA512 eaee02ceade0211be70a4710b28fdf043d5c540928e2095ead924a44c2edfca8fc6499395d1b7f5deee96394fb5309362fb87e45ee195094ec39d5fa11909d77
MD5 SHA1 SHA512

Submit Download

wpd9mkjx.cmdline

Path C:\Users\Admin\AppData\Local\Temp\wpd9mkjx.cmdline
Size 164B
SHA256 ec4c58a7d6120258505f67746cd5b3cfe72912945aa350237014b00ed9d42444
MD5 0e6f7aeba5d3bd01b9307831707e5464
SHA1 01cd3dec4f194eed2d8be9315f95cc532786227b
SHA512 88953ebd4dc62f3022a0ae2c23ea2526ba83bdeff6695835c00a21bf9ae54a31b8f569aa3880441a831d7e11331dfff2503c089921cf3715868f613451eda214
MD5 SHA1 SHA512

Submit Download

xw53mz-1.cmdline

Path C:\Users\Admin\AppData\Local\Temp\xw53mz-1.cmdline
Size 171B
SHA256 6e2592c414fae19ac771da2e5d921a8a00765026980be263a2ccfad0f0c45309
MD5 b9239e5fc0dd8b24b9c8c81687370ba3
SHA1 591a894a68bf79342ff5ed92503d96d8520ee530
SHA512 6f16d859f7777c5a4419eea06252751613482c24afcf487e569276cb5621b28f372184182080f07553970b023be66bcaeaa254d99fd20e2089ed13c126cf1926
MD5 SHA1 SHA512

Submit Download

Microsoft Edge.exe

Path C:\Users\Admin\AppData\Roaming\Random\Default\Microsoft Edge.exe
Size 6KB
SHA256 1002353a95a9036b052d3808fa51be80301ead34225a2d6d1aaf4722e37643c4
MD5 d274a4a306ff4d00bf64205dccc16dff
SHA1 d95100f8771694e31b29fad791fa27dd5c139887
SHA512 08542ced96c930489891d5202e685d95541cd2401e5d902385be9d3e11f7081a34c2924086c41fcc6c1b5d9022d38f3bca4c4bcbb66bf57774c3a78ca78c7eb1
SSDEEP 96:wAYuQBurOkMqKTbLSWsWU58DZcE2VYlnlYJnLLPL0KffAtww8v1VRXmmuuBs:wAYugyOlTSWqouVInlYJLLLTCEun
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSSCS.exe

Path C:\Windows\System32\MSSCS.exe
Size 21KB
SHA256 905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550
MD5 6fe3fb85216045fdf8186429c27458a7
SHA1 ef2c68d0b3edf3def5d90f1525fe87c2142e5710
SHA512 d2180f2d7ca35362a2dc322801fb0eee22820f2ac317c0be4c788c31d3939d30c9b356bf8daf0746545fb66092471f46f5d47c40403ed68b09415fcca90a125c
SSDEEP 384:nPD9On5gIdjbvRPJnMacNj6FIlKrZbJsV5reQ+ys:b9On2nV6FIlKr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1096-33-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-34-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-32-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-35-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-30-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-29-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-28-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-36-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1096-37-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/1468-50-0x0000025EB6310000-0x0000025EB6332000-memory.dmp

Download

memory/4024-15-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-9-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-14-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-13-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-12-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-11-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-10-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-16-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-17-0x00007FFCDF625000-0x00007FFCDF626000-memory.dmp

Download

memory/4024-0-0x00007FFCDF625000-0x00007FFCDF626000-memory.dmp

Download

memory/4024-8-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-7-0x000000001C8B0000-0x000000001C94C000-memory.dmp

Download

memory/4024-6-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-18-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-31-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-5-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-4-0x000000001C1B0000-0x000000001C212000-memory.dmp

Download

memory/4024-2-0x00007FFCDF370000-0x00007FFCDFD11000-memory.dmp

Download

memory/4024-3-0x000000001C030000-0x000000001C0D6000-memory.dmp

Download

memory/4024-1-0x000000001BAB0000-0x000000001BF7E000-memory.dmp

Download