11feda943a94b282ac17c6baad22d80a71e8018909ad267e6b7970d035d995dd

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 101KB
Sample260110-te14caev5f
SHA256 275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06
MD5 88dbffbc0062b913cbddfde8249ef2f3
SHA1 e2534efda3080e7e5f3419c24ea663fe9d35b4cc
SHA512 036f9f54b443b22dbbcb2ea92e466847ce513eac8b5c07bc8f993933468cc06a5ea220cc79bc089ce5bd997f80de6dd4c10d2615d815f8263e9c0b5a4480ccb4
SSDEEP 1536:fkSJkZlpqwZoMoG5XoZnOZBX7D/3BINVRX3FjBqa8D3tSYS9h:MXlpqwZoMz5XoZncB/3BINZjy9SYS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1017923329-3442370593-12565554-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe"	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	652	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1764	652	file.exe	97
PID 1764 wrote to memory of 2820	1764	vbc.exe	99
PID 652 wrote to memory of 1428	652	file.exe	100
PID 1428 wrote to memory of 3788	1428	vbc.exe	102
PID 652 wrote to memory of 2792	652	file.exe	103
PID 2792 wrote to memory of 1360	2792	vbc.exe	105
PID 652 wrote to memory of 6060	652	file.exe	106
PID 6060 wrote to memory of 1276	6060	vbc.exe	108
PID 652 wrote to memory of 5132	652	file.exe	109
PID 5132 wrote to memory of 3188	5132	vbc.exe	111
PID 652 wrote to memory of 2912	652	file.exe	112
PID 2912 wrote to memory of 5996	2912	vbc.exe	114

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\5niikz_c.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCCF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFA74DF9B33BF454D9889A74CBD37F2.TMP"
    3⤵
    PID:2820
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\cuzbicte.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD2C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcAF1E64C9C2674333A53C50138F2D41D0.TMP"
    3⤵
    PID:3788
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\axwnc7at.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD7A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8D7208B529A4B468F806A3478CBDB8E.TMP"
    3⤵
    PID:1360
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0vhjtaqy.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDD8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc50D6B1825FC46B2833BB4B316B4ED27.TMP"
    3⤵
    PID:1276
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6t_hcyx3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE26.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8E18D0C1A4CE490C958B5EED1CEF98BE.TMP"
    3⤵
    PID:3188
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4knowrtj.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFEA3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3CB2BC71FFC4CD097E4357FE4C8E3.TMP"
    3⤵
    PID:5996

C:\Users\Admin\AppData\Local\Temp\file.exe
C:\Users\Admin\AppData\Local\Temp\file.exe
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$Recycle.Bin.exe

Path C:\$Recycle.Bin.exe
Size 7KB
SHA256 889d8461563be9081eb1cbca932f256b55ffdb85f3a2bd093163c7050183bc1a
MD5 099c0b675aab39d81ba5d7e751f0e149
SHA1 e273456eebc7fce808990e6e327ceb84ae349b18
SHA512 05a4bd577ac95aa3bd862f1405338ebf7514131da20e2c23853e2af5d0f3f0455a68efdce03a499c544f920e4f151361e22a36f348342a0416eca02986a6d24f
SSDEEP 192:3PFk3SrgbRVInlYJLLLTTuBPmCzt16+gQ+Mn:3PFkCrUR7PLTkx1
TLSH
T138F1E61677E086EAC5590B7358E3440A5BA0FD2CDE279B7F14A0F3B29EB205446627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Documents and Settings.exe

Path C:\Documents and Settings.exe
Size 8KB
SHA256 6dc6281f86501728fcdb6f273e6d91b1c2e6ba4bccc64ff7af8c4bc79d3535eb
MD5 e21b1a564e4d3db8096a6416fc183d2d
SHA1 468d454eafd0a31bed0c4de161e44f9e937e62bc
SHA512 5aa7bb5951db3ae84fec8975c02c7b8349f03634ff373738b9e601bbaaa8d2b0fa69e1a34705d1145888cf5a36a26be1e26751d7187574c8f7ff305e96293744
SSDEEP 192:3ttk3UrgbRVInlYJLLLTTWSPBj16+gQ+Mn:3ttkkrUR7PLT9j1
TLSH
T18EF1E61677F086EAC55A0B7354A3410B5760FD2CDE67AB3F24A0F3B25DB245046A2B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfLogs.exe

Path C:\PerfLogs.exe
Size 7KB
SHA256 a5251ba528413349c085243eef80eb10a30c18942c575e7505d02912db9a2fe3
MD5 c3a35f72a4ef3fc7347e47f20a5297ae
SHA1 2ed28de902b4e13034f13a21e4bd9eaea54dcbba
SHA512 a58dbc8e81c2bccf8c6300b83fe34e0dbe58e7b822734a0741f4dba2071681431a2ee463ef389a27cd400db2ef914ed182ec899f1dac9caf6a918140c1e2d243
SSDEEP 192:3/1k3mrgbRVInlYJLLLTTVDPtX16+gQ+Mn:3/1kWrUR7PLTJhX1
TLSH
T17AF1F72A77E086FAC55A0B7359B3414B57A0FD28DE23AB7F14A0F3B25DB20504662773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Program Files (x86).exe

Path C:\Program Files (x86).exe
Size 8KB
SHA256 c3564cc2324fed324285023186ee092ba209cacc58ecaa34fa0da2a9f6d709ff
MD5 3b5137709365cf37be7645207d83f4dd
SHA1 57eefe50d4480f6e359415ff26e4de1a9b22a1c1
SHA512 b180fbe12433a85b7ed1082dc72f89cb702158ca4fe5d30d5840651437a7a804ba9e3db42c049eee46ba109edced8de4372862d04a8c5681c441e5531461c8b4
SSDEEP 192:3Ndk3RrgbRVInlYJLLLTT3P1v16+gQ+Mn:3NdkBrUR7PLTRv1
TLSH
T1B7F1E6166BE086E9C15A0B7359E3040A1761FD28DF67AB7F10A0F3B25EB206446627B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xblRvZwfR.ico

Path C:\ProgramData\RevengeRAT\xblRvZwfR.ico
Size 1KB
SHA256 11b5a0730666935c78d22b379f83ea5fc30d1afdea09a796b4f18b38a1e1ef69
MD5 42d552558e7e6f7440b2b63a6cde217f
SHA1 9c8fa01060f667cf3b0caad33e91fa59e643cf76
SHA512 e6a6dc1239b9668e7ffc883b3cf46aff8c9f86ef11ae975f6fb65531d8b9313acd7608272042e322fad415a45c0cf767252d2c620ad066e6809656af0f09441b
TLSH
T1FD2128423BA099D8C0100E73B45B944E27487CFEDD4086A630B4FBBA2EB64B105A56B7
MD5 SHA1 SHA512 TLSH

Submit Download

Recovery.exe

Path C:\Recovery.exe
Size 7KB
SHA256 d0ea5bfc5c140a64a8e0efd7d95cd6968c4b1b6666b410782fb6ae9ccf6af8e6
MD5 0d83de8ba62c7675f114ae6f489f28aa
SHA1 c120546339292913fc9ccb5e470e68d6cf33ff34
SHA512 ba6aec57c56d924ab7e4ac2c2f5637f055a80f291e120d2a37fa14dba040ac17192e666157f2674e91a87bd054ea794ff87c72fda83c57c87967e46e26924441
SSDEEP 192:3/1k3mrgbRVInlYJLLLTTVPuk16+gQ+Mn:3/1kWrUR7PLTAk1
TLSH
T1D0F1E72677E086EAC55A0B7358F3410B57A0FD28DE539B7F24A0F3B25EB20644662773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0vhjtaqy.0.vb

Path C:\Users\Admin\AppData\Local\Temp\0vhjtaqy.0.vb
Size 356B
SHA256 069e4022d9d8a43c9b2fd85a75458624f29235262ebc1efc889d2cd64ed18d27
MD5 86c68da5eca3f86e9afd81f7e9a34a23
SHA1 e0d5a1b459cc26d07f190de7c53adda1be1bd28e
SHA512 5c54931607ea8ab16c1ab3c36154b81e4ef66a30bb9d911e21ed1c0914b88f097f3e5d4056120daeb8c07698c41f8865e792c05673876ccc3aab419f9c9aa1b4
TLSH
T190E068B3602182424B4938939A91580418BF0FE633941C0901CC2289CA17170976A2A7
MD5 SHA1 SHA512 TLSH

Submit Download

0vhjtaqy.cmdline

Path C:\Users\Admin\AppData\Local\Temp\0vhjtaqy.cmdline
Size 210B
SHA256 34bd1ddd434edc6f3a4128370600f49e7669728997bacb6b158a26e4d0179f94
MD5 0e99bc22bd2ebc1fe4df4ddff731287b
SHA1 b779e4f22a6a1dbad6d516fafc8256f713a9a513
SHA512 9848b2a52dd91592426d69f6cb2863c2dde586014332a743bf625edfc6506224ea6b1d578b505e22bb121e10376f6e79410ddb8b18dce3ef0d01d65037c70bdb
TLSH
T1CAD022001747CBC4ABAB600A43EDC1AC83A2CC2F79D83B2A15849E4ED1A2F153A62585
MD5 SHA1 SHA512 TLSH

Submit Download

4knowrtj.0.vb

Path C:\Users\Admin\AppData\Local\Temp\4knowrtj.0.vb
Size 349B
SHA256 f76e8960b34bb917632dc6cb47cf1c69b53a7b9b5e58a5ccbcf9a099cacc2c99
MD5 f1405abb8e9f89c7517c03f3ecec1564
SHA1 c37550afa9762b44f9c82c852d021ab3624e6ded
SHA512 90819d8cd3fa47e8ac2e79f8abff7ef4f4692185d7ca65fd45cb9144ea335dc92fca5308ae369407f288a40e6d488082a1e89fda5c59c5e5725a80ac76d04733
TLSH
T1F2E0C0F3702187024F4D3C639991580418BF1BF623941C4800CC2288CB17170D76B29B
MD5 SHA1 SHA512 TLSH

Submit Download

4knowrtj.cmdline

Path C:\Users\Admin\AppData\Local\Temp\4knowrtj.cmdline
Size 203B
SHA256 882fd6c6b64abb165888dc0510c51b16317697004054935e147131e46edb91a1
MD5 2735475d2df4d33b421e478a344551e0
SHA1 abb23fbdf6d36e8fb3da21639f45151df92674a7
SHA512 fa824f2d764fbd0a730212435f29c4e6f6e1ec6a47a531f75b3fc7d6fda31f1f9ccb078ed51ed1e1c642f458ba5e0c7b3204f3855e2c3727f521e0949defd049
TLSH
T1A2D02211234B8FC447FB301E82ADC26C83328D2F29892BA948818A4CA5226043762A45
MD5 SHA1 SHA512 TLSH

Submit Download

5niikz_c.0.vb

Path C:\Users\Admin\AppData\Local\Temp\5niikz_c.0.vb
Size 349B
SHA256 a615fea96d0b746bc79189352ba83103cdd3ee700f361ce0621ed4ff46aad4ad
MD5 7e8dc285e017cea4559ce6031c044024
SHA1 7e87c47b4441e938d993097906d0d78d321569c6
SHA512 c6e83f3bd083b0aeda81f08225732ba4952ddb479aa5c7923e1bccbb532832815c13b6ac264550b03b57d4ba0b0debd1a7d2c03acb41c31b317936d914c09950
TLSH
T15FE0C0B3702083124F5C3CA3C9D1590418BF0BF623941C0801CC2188CB17174DB2629B
MD5 SHA1 SHA512 TLSH

Submit Download

5niikz_c.cmdline

Path C:\Users\Admin\AppData\Local\Temp\5niikz_c.cmdline
Size 203B
SHA256 a9c851dfe218edd085ca3af5227f1628e340294613191755b4a1c932dc608772
MD5 0440a133820755621bce141a49d8c143
SHA1 37b26338ca8587e68ed44b517bae039178f118b6
SHA512 2c348c30255b83f73e6a2c8d1f4f2f25341aa7cdb4a3932135c780d02df64a33233927c6bedddbe8a6a1009efe2374f8a39909cab49c6fa8e998fb0d52eab37a
TLSH
T1F7D02300135747C447FA501B42E9C15C42639C2F159827198540884D65635547621585
MD5 SHA1 SHA512 TLSH

Submit Download

6t_hcyx3.0.vb

Path C:\Users\Admin\AppData\Local\Temp\6t_hcyx3.0.vb
Size 345B
SHA256 401083c6f8135c71830c9fa258e49863523c1459e6c1e59a3e574cb0a8a41646
MD5 cd6c54181a29d34a9c388ae8b2bac97a
SHA1 842877924fe997161aad06beb122b4d7ad7025ff
SHA512 7d78bc9b75dadb1e69cd6fa3f529286f4fe4c240a76b7332a6df93e77a90d605d9012bda9b6b52b42cf7ee027d250afff53b74ca34fed01487220e74db68e199
TLSH
T10DE0C0B3702083024F4C3853C991580419BF0BF623941C4804CC21C8CB17170DB272AB
MD5 SHA1 SHA512 TLSH

Submit Download

6t_hcyx3.cmdline

Path C:\Users\Admin\AppData\Local\Temp\6t_hcyx3.cmdline
Size 199B
SHA256 a6e862e9706256fa8e2df79013ac125092ab6ac8ad99f60b3ac4ed1e6d9c0595
MD5 ae07eba893b87a5ad84208cc790dc4b9
SHA1 950ec6074df72124a5f462b63fc0cd4a17517998
SHA512 2296a2fe52cfd0c27941d74e517d734663ccade1bd7733ec5fb0e49db0bccd2df4e8aed56e737d9a67c6225152ec4774f0f03d143c770f8ed4cfa41ecc69990f
TLSH
T1EAD02200234B8A844BEF201F82ADC26C8323CC2F6A8C3A195A81888D9622214362294D
MD5 SHA1 SHA512 TLSH

Submit Download

RESFCCF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFCCF.tmp
Size 2KB
SHA256 7d798c9d111809e8d48fb2a7d5334653991d875010b83a89e1e31b8e8d6c9056
MD5 847370d4f86d278f0eccfdf29e051da5
SHA1 f060bd5fabbd0aae8106646524337af670503e15
SHA512 095bd696a105ee260e0a422c475e9f95dafbc652c70348e155e04843e433b8da23c0e31493a272f61faa4fb03a2963b55937476f7dc7d1774ccae80e2a09a7f3
TLSH
T13E517D0637E48AC9D0210B33B4E7560F6714BCBCDD50836B64A0F77A2DB25A09A916B3
MD5 SHA1 SHA512 TLSH

Submit Download

RESFD2C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFD2C.tmp
Size 2KB
SHA256 93d3abb4a9dffdb3d3775a8a66e78b2921bba10379425c497be9f02167554bda
MD5 ca40d02d52283078391ee094219a685f
SHA1 5307efcfc8c977337225eba035024a58884cbdce
SHA512 35a59104ab423d9c833d9ccda499513dcf88b0980ecf5e2ab4f08440b56ac3745ac4521fc3d5fac55a17c67d6b8c53d8b82f93942684eaa9ad7bedcae98b9d24
TLSH
T135513C4637E489C9E0610B33B0A7560F6714BCBCDD51C36B65B0F7792D725A08A91BB3
MD5 SHA1 SHA512 TLSH

Submit Download

RESFD7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFD7A.tmp
Size 2KB
SHA256 3cc344c8291522aa9d869be895fe6019bd52ff4e69c7bc6f6c64a7b1f1725270
MD5 8511986adfe4eb453dc17563bcc93360
SHA1 00c79070542679ebe96771563d23ea318b86a127
SHA512 297c704dae95efa4c370dec492e1febf3999ad00655464a87a8ce91868c4608e2d16431b907d7f928745308da898fdd7f58174d6676d42db62c8b0c668e0acf5
TLSH
T171516D0637E489CDE0210B33B4A7560F6718BCBCDE51836B65B0F7792C725A05A916B3
MD5 SHA1 SHA512 TLSH

Submit Download

RESFDD8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFDD8.tmp
Size 2KB
SHA256 e98ae41fd920b71e9fbccaa20b70630f06e6a449e90da259fd6f2691b99cf110
MD5 50089e8981c6923e875fbbf1f8cd397a
SHA1 39ecbef90bd417b46ad675ca693e8148f92095ab
SHA512 53ea04b4e0615cdd16d76056baee2a0972dbb2a5e49d8a882e56557483108f07dadec1d2a2eab6c8e09d23cfcca6a728e4a6e5921ce0da8a7611fa967512d5cb
TLSH
T173516F053BE489D9E0310B33A4F7560F6714BCBCDE60836B64B0B7792D721A04AA17B3
MD5 SHA1 SHA512 TLSH

Submit Download

RESFE26.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFE26.tmp
Size 2KB
SHA256 3f1cc9f436bb881a3d77d134845438783a1ad3f87209a81e3c3ac6e2eb0f70b1
MD5 59e20087ff0603d1570dcc246cb3aa26
SHA1 4f5f3395daa3c512bbb0835f4851826c3e4548f9
SHA512 2a5629404b0d286f72f224cd929bc07377b4e5a6f0c9723dc677a7412424fd1851423de120851d6bd0cb97fd23c66127d2e45d3ad684d9db3b217b38f7f98cc2
TLSH
T122515D0637E489C9E0310B33A4E7560F6714BCBCDE51C36B64A1F7792D725A05A917B3
MD5 SHA1 SHA512 TLSH

Submit Download

RESFEA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFEA3.tmp
Size 2KB
SHA256 16935210cb4b0026094915b0c9a6a728a1c931cacbae7fb1aaaf7c8e7e90c8d7
MD5 db85346e4cfa4f0016ad40294b1586e7
SHA1 ac869f69a8f126f83024ff4053e946642aa51554
SHA512 86f0dc59e2ac121258cf62b7e83d3d4ef7637bb9fa319ef400f46a8250058c950a651744e00614ef67576da94814dd09fac35ed0c36face9553ffcc744504838
TLSH
T18F51600277E48AC9D0210B33B4E7561F6718BCBCDE50C36B65B0F7792D721A05A91AB3
MD5 SHA1 SHA512 TLSH

Submit Download

axwnc7at.0.vb

Path C:\Users\Admin\AppData\Local\Temp\axwnc7at.0.vb
Size 345B
SHA256 412137881e3f3de959a2d007b4a2b49d052571353f8a974010255f4c0f044082
MD5 c8f33b81180ae953e6e8d5451208e55b
SHA1 14619702dbbda508a22d62240d7fe49aa3f1df0a
SHA512 3a23ba1d02585d081c3f9c95625fdf7bf2a0947ebe40ec6352b581b39171a9710f8934b4600954f658c957ff889f270af2cdf8dfccfca35a61ec408fc8eb5a96
TLSH
T18AE020B3B52187124F4D3857999159445DBF0BF623945C4901CC2189CF17574D776297
MD5 SHA1 SHA512 TLSH

Submit Download

axwnc7at.cmdline

Path C:\Users\Admin\AppData\Local\Temp\axwnc7at.cmdline
Size 199B
SHA256 56510227d1ea6115d2e8986a0d2221ba53b090975ce43fc4d11cad3a4a6c53be
MD5 94c819fd34b4dd248dd14719ca2cd8a9
SHA1 2499f16c2f106ec6fb3e0087a0cd8bd6eee6cab0
SHA512 423fdb3ac08321f6297bcb22129f0c38c9166ac59df5e22059bfaf63d4b589ad0c216a8a5d7a4462d45ea26a08803e496bb7ef8da2451a7cff8b56339d9718f0
TLSH
T1C0D0221107878B845BFB202E47ADC25C83629C2F28883A5E08C1899E9522A083722945
MD5 SHA1 SHA512 TLSH

Submit Download

cuzbicte.0.vb

Path C:\Users\Admin\AppData\Local\Temp\cuzbicte.0.vb
Size 359B
SHA256 2bb58efd5e05b869678e245802cefdc4f9e24c8f1ff5c0d44fe12f398f7e045c
MD5 f2eb66522e81f5808c8794592b7d0cc3
SHA1 d10227a9de168dbb33ddd6663c14bae72ec45191
SHA512 a9bdbc6466c144d3867778260dc971dede176983c38c9b3bf1c2fd95c46f6dca25acbf42dd57f727fff2a29252eb63cdfcc44cba8ced86c672f42d00c2d45670
TLSH
T136E0C0F3712183064F4D3853D99259041DBF0BF633945C4800CC2188CF17270DB76297
MD5 SHA1 SHA512 TLSH

Submit Download

cuzbicte.cmdline

Path C:\Users\Admin\AppData\Local\Temp\cuzbicte.cmdline
Size 213B
SHA256 5b33c85e94ff61d5e668e2f5d0d58103c413e0d72169dcc3b47d8e111cc61c1c
MD5 8823116721dc55a835238f7b1430fe8e
SHA1 8003385cfba4ef5427356b26fbd964f299394f8f
SHA512 0d22ba7ea60e240a6225700a5beacf64d6dd4a113492fb108f7c5b661802b026d68df40798c2abc20ccc8245d099a3909642bc1d754784d92dbfd1e07a2179e8
TLSH
T15FD02301134756CC47EA60094AB9C25C4332CC3F3D843A5D0444D94D59227953761546
MD5 SHA1 SHA512 TLSH

Submit Download

vbc3CB2BC71FFC4CD097E4357FE4C8E3.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc3CB2BC71FFC4CD097E4357FE4C8E3.TMP
Size 1KB
SHA256 3bac257a86632110fff75cae8c9d784afdf9522706d397ae086ee6b19d4a955d
MD5 20ef8f695fed113f459624133aa73992
SHA1 f0aaf3ce1967b5ae8c7031fbe930b1a7e3142bda
SHA512 bd1c8d57ecff5a5dc3940307775f36771627ce0b4b228b6a6a56ef3b0659cb2f9cb1c9e754d4f805bfc094dc44cbe06072e8270363fbb7f43b246202049d1a5a
TLSH
T19B41DB4637E495D8D0620F73B4A7825F6248BCBCDD5183BE34B0BBBA2D7146145A1BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbc50D6B1825FC46B2833BB4B316B4ED27.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc50D6B1825FC46B2833BB4B316B4ED27.TMP
Size 1KB
SHA256 36ac27154a7c665d75d189b50f8f91bb705a9bd7fce0e467fe7b6852fc6e77b1
MD5 4cddbc51aa87a8da871ff6d3e264e11f
SHA1 8315122c35faeb53d9aee9043368cee0cb8ca91e
SHA512 f4bd8b62c5392ad9bcd567d5c7c63f6ca93d447482ec1c37bcd669f1af4b96c9c3d3466b0e1d7d82130fe18457b8e2d8ac6459d2b6d10f75b744a13b78c56716
TLSH
T1A5410A423BE485C8E0620F73B4B7524F6258BCBDDD6183AA34B0F7B92C714614565BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbc8D7208B529A4B468F806A3478CBDB8E.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc8D7208B529A4B468F806A3478CBDB8E.TMP
Size 1KB
SHA256 05cd4041b325837f2290bd65e2c160ea91241339e4c53fe29b243542df417ade
MD5 b7370f71606afbaf01745643bc55db56
SHA1 9cfc962aef724cfd27b4d0a1f9c9990fe840eb0b
SHA512 5591c8fc1a7ae23bfda9872fcc5c7c5c5d8b668996b280a027bd18dd930edc0d812548185bea1e426f71ec0783d75719066df345ec95d1f92af938f98887495d
TLSH
T10141C74637E495D8E0620F73B4B6424F6258BCBDDD6183AA34B0FBBA2C714604561BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbc8E18D0C1A4CE490C958B5EED1CEF98BE.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc8E18D0C1A4CE490C958B5EED1CEF98BE.TMP
Size 1KB
SHA256 61635a41485be5ef65a9cbf21e06501f2457f5382bd29ea9ce2901a5b7408774
MD5 cbff7107f47a4ac55a18af6c6710c34c
SHA1 65bec7fe045adc005d55dbcc3bf23179ea678cc6
SHA512 69a0c9e126cd7cda50da6366bf2f44da55e93b0d7f0c78e791ecc89d9e28d345e3c08b7292138fcb36aff0ac506f15f5d3262f8174b09909dc55a0e6405670fa
TLSH
T1D641D84637E485C8E0620B73B4B7424F6658BCBCDD6183AE34B0FBBA2C714604591BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbcAF1E64C9C2674333A53C50138F2D41D0.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcAF1E64C9C2674333A53C50138F2D41D0.TMP
Size 1KB
SHA256 5259fea78d4db203e2d10c628fd91519ac4e99b602753290889dba1ccec56c8d
MD5 1e1accabea11b2f2b119e3cd0dfb189f
SHA1 36f01d204ad1691c3b38d727bd6029f1ea4ed787
SHA512 3599231c75bce9cba236352af0bdc16c36e537e48812f0a4e0b0748d653f2e6860819952bf512b273bbcf3dd3939c6b129c283f31539d576a257ceafe9f53764
TLSH
T11241E94637E485C9E0720F73B4A6424F6654BCBDDD6183AE34B0B7BA2C715604661BB3
MD5 SHA1 SHA512 TLSH

Submit Download

vbcFA74DF9B33BF454D9889A74CBD37F2.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcFA74DF9B33BF454D9889A74CBD37F2.TMP
Size 1KB
SHA256 7e3353bb1fd38d66a53bfcecf5bebe8d9052916abccc7d96ea241541c9af8610
MD5 19ef61b3387a71ede7704efd63a111d8
SHA1 d6fc5831d1eb4e6ec09bbceac14d1858bf95108b
SHA512 658423fe5ea03091f5688c816d8a3a14e5b33fe9785c7d8112c1faa797bf73941e76c7682cc7b0a05a40770ff062a65d2798e64d401c47f80d90f2b1f286f88a
TLSH
T16241D8463BE485D8E0620F73B4A7425F66487CBDCD5183BE34B0BBBA2D714614561AB3
MD5 SHA1 SHA512 TLSH

Submit Download

$RECYCLE.BIN.exe

Path F:\$RECYCLE.BIN.exe
Size 7KB
SHA256 fdc9629f77ba6d903304f3c873fbb8b30ef786f8ecef12388366bb089a72609d
MD5 a7a60f04a9ffdb89faa16a4b4857fe03
SHA1 e82b46321c9855527ce6350b47f2a2c6eacf9778
SHA512 98b35a4601c55b533843be2320067988e12db797f8c19ec323eaa5aa2f995d464106d248f244e1f7e0669d67970c41ba55f7f6a2a97e2116870a030657d4d3a3
SSDEEP 192:3PFk3SrgbRVInlYJLLLTTuvPmCzt16+gQ+Mn:3PFkCrUR7PLTqx1
TLSH
T1FCF1E71637F086F9C5590BB368A3440A57A0FD2CDE57AB7F14A0F3B25EB205006A27B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/652-13-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-7-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-12-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-10-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-9-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-8-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-14-0x00007FF849CA5000-0x00007FF849CA6000-memory.dmp

Download

memory/652-0-0x00007FF849CA5000-0x00007FF849CA6000-memory.dmp

Download

memory/652-15-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-2-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-18-0x000000001D5A0000-0x000000001D63C000-memory.dmp

Download

memory/652-1-0x000000001BDF0000-0x000000001C2BE000-memory.dmp

Download

memory/652-20-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-5-0x000000001C3E0000-0x000000001C442000-memory.dmp

Download

memory/652-3-0x000000001C2C0000-0x000000001C366000-memory.dmp

Download

memory/652-99-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-11-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-6-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/652-4-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/1428-101-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/1428-51-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/1764-26-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

memory/1764-35-0x00007FF8499F0000-0x00007FF84A391000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads