11feda943a94b282ac17c6baad22d80a71e8018909ad267e6b7970d035d995dd

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20251229-en
resource tags

arch:x64arch:x86image:win11-20251229-enlocale:en-usos:windows11-21h2-x64system
submitted
10/01/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 101KB
Sample260110-te14caev5f
SHA256 275e4633982c0b779c6dcc0a3dab4b2742ec05bc1a3364c64745cbfe74302c06
MD5 88dbffbc0062b913cbddfde8249ef2f3
SHA1 e2534efda3080e7e5f3419c24ea663fe9d35b4cc
SHA512 036f9f54b443b22dbbcb2ea92e466847ce513eac8b5c07bc8f993933468cc06a5ea220cc79bc089ce5bd997f80de6dd4c10d2615d815f8263e9c0b5a4480ccb4
SSDEEP 1536:fkSJkZlpqwZoMoG5XoZnOZBX7D/3BINVRX3FjBqa8D3tSYS9h:MXlpqwZoMz5XoZncB/3BINZjy9SYS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4220518935-1083122485-1008052776-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe"	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	file.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5028	4804	file.exe	77
PID 5028 wrote to memory of 4168	5028	vbc.exe	79
PID 4804 wrote to memory of 4264	4804	file.exe	80
PID 4264 wrote to memory of 3264	4264	vbc.exe	82
PID 4804 wrote to memory of 3696	4804	file.exe	83
PID 3696 wrote to memory of 680	3696	vbc.exe	85
PID 4804 wrote to memory of 5272	4804	file.exe	86
PID 5272 wrote to memory of 2300	5272	vbc.exe	88
PID 4804 wrote to memory of 3076	4804	file.exe	89
PID 3076 wrote to memory of 5468	3076	vbc.exe	91
PID 4804 wrote to memory of 5740	4804	file.exe	92
PID 5740 wrote to memory of 5656	5740	vbc.exe	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\bfgt3iac.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4885.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2AB5522F652F42028E63724A75F84AE3.TMP"
    3⤵
    PID:4168
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\j30y8wf5.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AF6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC832A89066AB4D4BBC78DD20A1942BDB.TMP"
    3⤵
    PID:3264
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\owr7x2n0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B54.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDB844AEEA4444B5E97F16A2E3457327A.TMP"
    3⤵
    PID:680
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dz3b1b6a.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BF0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD6E79C0928794F23AEFBCA1F46AE7916.TMP"
    3⤵
    PID:2300
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ceuw3coy.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C5D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7FFEEC946193488FA1DADCEC6C94CAC.TMP"
    3⤵
    PID:5468
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\izbhsl8o.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CEA.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcFD89EBAB5CC54C0487C76C722B68B2AB.TMP"
    3⤵
    PID:5656

C:\Users\Admin\AppData\Local\Temp\file.exe
C:\Users\Admin\AppData\Local\Temp\file.exe
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$Recycle.Bin.exe

Path C:\$Recycle.Bin.exe
Size 7KB
SHA256 c2c8ab6f06ae7837277a415bffb6f1f105f185f7f2de28e2367ec587764f6234
MD5 a30362cad9dcc1863c8245a980ea99ab
SHA1 b09cfaa760576f4e234022a2843ea7415704373a
SHA512 a7009e8197c76c4cc525c2ef70e91466eef8773db6e175a405708b37de4b4099adb63e34c9c50f8ee31dfa892e2eb55c3052746f8ac8d74fe9267ae8f608bcc5
SSDEEP 96:tPFk3uUkrBoiMM2WUp9OcE2VYlnlYJnLLPL0KffLThc1lv1VRXmm5FriT+ztT4Rf:tPFk3SrgbRVInlYJLLLTTuDPmCztTQR
TLSH
T1F0F1091A77F1437ACAAD07B30DF355465BB1ED04DF27AB6F0091B3639EA31488A12672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Documents and Settings.exe

Path C:\Documents and Settings.exe
Size 8KB
SHA256 174725239ca9a9c4722f4fe96a7f8e52dbef0a08fe6aaff4ce446b06542a675b
MD5 290caf65c2abf664dc027de446b1be45
SHA1 33276ec2a4956aca10c6df4f1117a9b258452aff
SHA512 c72a56f1ca0aba272f2d1371593c920d179d787510a6ea27de875e1378358bee255930bc22fb9cc62510b3f5a60df192100438091f045d6a88031f211ec6000c
SSDEEP 96:tttk3uw2rBoiMM2WUp9OcE2VYlnlYJnLLPL0KffLTqgcIv1VRXmm5F7K07T4RC8n:tttk3UrgbRVInlYJLLLTTW6PB7TQR
TLSH
T1E9F11A1573F1427ADBAE0BB309F342465BB1ED04DF27AB6F0084B3639E625448B62772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerfLogs.exe

Path C:\PerfLogs.exe
Size 7KB
SHA256 95a65605b436a6f78cfff6bc4583ed160f25a21e3bd504c329e91c886d05dbac
MD5 bed6dde5fb442cd9c9cae7991bda7128
SHA1 50afb0ad80e9ddc5d81ff1b8bab085450bac89f4
SHA512 e68f4fabde14d35053b643cb385754df416236b659786ae6d61053723a0e2acd65349e70371ac55c61cc9a75bca1945106a6a422e33dc8e9ed9251269f794c96
SSDEEP 96:Lst/1k3uWD4rBoiMM2WUp9OcE2VYlnlYJnLLPL0KffLTHJcKOv1VRXmm5F7oKvT6:o/1k3mrgbRVInlYJLLLTTAPtvTQR
TLSH
T10CF1F92A77F0427ADB9D07B349F3554657B1ED04DF23A76F0091B3639EB20548A62372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Program Files (x86).exe

Path C:\Program Files (x86).exe
Size 8KB
SHA256 261149d00d75cfadea5bb83a792db88134a6c9b113c5619d42a4df9ce9979d58
MD5 103fd2f8796fb1a7fda0bc595af82caa
SHA1 a8a18de49083bb71e3cfd70b9c4bd419aeefffbb
SHA512 40650b690ce0b2d9aead9192159ac556887f587762340639df9d77f4c1947a9b6b9a0c7542cea91f44f583bab7c5cf649f81bf6091f2a3ed75d8b3a66aba65af
SSDEEP 96:LstNdk3uo7rBoiMM2WUp9OcE2VYlnlYJnLLPL0KffLTie6v1VRXmm5FrrVHT4RCW:oNdk3RrgbRVInlYJLLLTTrSP1HTQR
TLSH
T114F1F91577F14276D69E07B309F3558217B2EE04DF37676F0085B3639EA30588622362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xblRvZwfR.ico

Path C:\ProgramData\RevengeRAT\xblRvZwfR.ico
Size 1KB
SHA256 84a41ba1d0f60c4097dd6921ea73781140c40c14a1872d4aa1872046203e6872
MD5 1e6c4b32205b72a32786ffcf143ffaed
SHA1 7a99df34d2d7d17e2e01272cd084fdae505bc8b0
SHA512 49ad851721e811be4b360819eaf55b5a1f572c536fcd86692c05533fa62e91efcf218ad60fa54ce5fc5bc476b04dae78c8ce59c22c7c1448980d430e288ab7f7
TLSH
T1A521464534B1B351D3ACD8B7959391ED3B910C91930282C561D7BF473B321F96F11290
MD5 SHA1 SHA512 TLSH

Submit Download

Recovery.exe

Path C:\Recovery.exe
Size 7KB
SHA256 0bf9a949c9bcf1b6a39102f4b0e54600e9eb4564283587bdb891242a8be70457
MD5 7fd10d51062918dda1af42e83671f17d
SHA1 28588bf7f42b15f46cf5219c4311c7795e0f84c4
SHA512 24e5c0627546c18de95d08230470909e8878018a2c758824619a68826853f603113f802979d6fca7aca66b6957408844ae3627c0f790d8fc71dfcd8ec66e11fe
SSDEEP 96:Lst/1k3uWD4rBoiMM2WUp9OcE2VYlnlYJnLLPL0KffLTvc9bv1VRXmm5F73KwT4h:o/1k3mrgbRVInlYJLLLTTOPuwTQR
TLSH
T11EF1092A77F08376DA9E077349F345465BB1ED04DF63AB6F0081B3639E720588A52372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES4885.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4885.tmp
Size 2KB
SHA256 eacf8e4c1e424bf747a35f76e758ba3694991cd7f2dea5537e37fb4d19db155e
MD5 490698d2c3795ad27749b5833760e2c5
SHA1 109b5966aab51c805d8afb07b0870bb962f9c42d
SHA512 192a84cf9aba4dee34af664d817017df6e9c9ec60cef0a9966fe3837d51fb81e3477ddd8bb21e0044515261929e3a04dd511635d841b3e56293f42c3ad6fa63c
TLSH
T10A51310437F46706F1B95B3364F7136ABB347CA0DB62835B8182731B2932190EF516B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES4AF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4AF6.tmp
Size 2KB
SHA256 898b991db52bb50ffe33e67dba2c6709e3cf0dc3bf6d17cef269cc4034ce7739
MD5 e7448aa7318c2f515dfc6691ac038df6
SHA1 a97774a83ef6ac5cf023c3d7a300a098645fef4a
SHA512 9ace603f6c0535612c1074ec1c741eafef8592c8cda2a3bdb7cc6c2b2f46a35a179ed8ef3cfe19334abd96113e88704faeba51a2de5aea2068a740bfd9f644e2
TLSH
T15B51010433F96306F1B58B3264F6575A6B31BC60DB62C38B9292731F2D32694EF61672
MD5 SHA1 SHA512 TLSH

Submit Download

RES4B54.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4B54.tmp
Size 2KB
SHA256 3f5a450bc28224e51423d63a206ac6e8aa831c418865bc86f9d7fabdd660198a
MD5 51827d13ccd033bd78f1a088ab8ed088
SHA1 10f243eb5bc29a7031db45f339dfbd17d0e18ece
SHA512 34c1e40ac70155244876663d18269538a8f0810b59901c98c5ab3c8999ac4aa7eda7ba8da4292d907f4d586438adcd424b1ea545cf9963c078c38f3160c7b7b9
TLSH
T19451330537F5671AF1B58B3254F6136F7735BC60EF62838B8192731B2832290EF51262
MD5 SHA1 SHA512 TLSH

Submit Download

RES4BF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4BF0.tmp
Size 2KB
SHA256 d9f33114d1149a5685796961f8adaff282beb3acf3e699bec73b038304c51a43
MD5 364eef919701015266c1b2645b6abd56
SHA1 ef458c905e521542aabb24fba6a72fecf8e9688a
SHA512 075c670ee30b4b4e077d7100a56d224e0be06b3a99e7c85196822f371b3757b4e698e557415b38191a7bd00e00e7953763265c0386e807620b79ebd182af463a
TLSH
T12B51210437F8671AF0BA4B3254F6276E7735BC50EB72838B8182731A2D32194EF51762
MD5 SHA1 SHA512 TLSH

Submit Download

RES4C5D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4C5D.tmp
Size 2KB
SHA256 2be556f878c3427179b7dc02469c919488a597b69063675d50e0b1e07e6cdcc5
MD5 60880bc463d6562f8d234aa2e3e87578
SHA1 fb2308b65d98787b1421563c3a39111a71e373cc
SHA512 1ed5b0a887a75122d5f3e6a9bd5ed6cff1d64eaeab26c2913313004d7ec0443f0bfeadf9ade1fe000288991ca1d9d7203fc975776bdb5b667b7e68d3c897afa9
TLSH
T12F51520537F9A706F1B5873254F2536A6B75BCA0DB62838F8182771B3D32190EF90672
MD5 SHA1 SHA512 TLSH

Submit Download

RES4CEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4CEA.tmp
Size 2KB
SHA256 5cd36623fbdd4f893d95cc180e3fed32ce00488015913057e21d40666633e86b
MD5 ef820e4be243de5e33275a629b72246b
SHA1 1bbecb17e9f69a7c9d8696f1d2e76e869214af88
SHA512 6c4d5701562d13a44d6eb2fffb2b1ad559f09c12c5d55422c607daa33078d6721c41a620837d69b74c02ab9b03b2e377873934b51a01604a8f103d1db7939621
TLSH
T1A751310433F8670AF1B5877264F6536E6735BC74EB62839B8182771B2932290EF506B2
MD5 SHA1 SHA512 TLSH

Submit Download

bfgt3iac.0.vb

Path C:\Users\Admin\AppData\Local\Temp\bfgt3iac.0.vb
Size 349B
SHA256 a615fea96d0b746bc79189352ba83103cdd3ee700f361ce0621ed4ff46aad4ad
MD5 7e8dc285e017cea4559ce6031c044024
SHA1 7e87c47b4441e938d993097906d0d78d321569c6
SHA512 c6e83f3bd083b0aeda81f08225732ba4952ddb479aa5c7923e1bccbb532832815c13b6ac264550b03b57d4ba0b0debd1a7d2c03acb41c31b317936d914c09950
TLSH
T15FE0C0B3702083124F5C3CA3C9D1590418BF0BF623941C0801CC2188CB17174DB2629B
MD5 SHA1 SHA512 TLSH

Submit Download

bfgt3iac.cmdline

Path C:\Users\Admin\AppData\Local\Temp\bfgt3iac.cmdline
Size 203B
SHA256 45141c5e79303b9ce31893ce73f55528bb63cff7521e7aec028ee44135696f26
MD5 a077c0991b364701263f6bb2893f41cf
SHA1 6fbdcdab2eef7646113cd6154f2b93facfb1fcb4
SHA512 66aad6d596eeb6dacdbf5d92988bd3486da1bdef1f5169b475b1a7f6f12440857e4c99d13725d238ded1d6958dbb5e1379e3cda5ce439d870851b613a755d5c8
TLSH
T1B7D02300134747C457FA501B42D9C15C4263DC2F354C27594541944C55625447631585
MD5 SHA1 SHA512 TLSH

Submit Download

ceuw3coy.0.vb

Path C:\Users\Admin\AppData\Local\Temp\ceuw3coy.0.vb
Size 345B
SHA256 401083c6f8135c71830c9fa258e49863523c1459e6c1e59a3e574cb0a8a41646
MD5 cd6c54181a29d34a9c388ae8b2bac97a
SHA1 842877924fe997161aad06beb122b4d7ad7025ff
SHA512 7d78bc9b75dadb1e69cd6fa3f529286f4fe4c240a76b7332a6df93e77a90d605d9012bda9b6b52b42cf7ee027d250afff53b74ca34fed01487220e74db68e199
TLSH
T10DE0C0B3702083024F4C3853C991580419BF0BF623941C4804CC21C8CB17170DB272AB
MD5 SHA1 SHA512 TLSH

Submit Download

ceuw3coy.cmdline

Path C:\Users\Admin\AppData\Local\Temp\ceuw3coy.cmdline
Size 199B
SHA256 df013aeeb213b8534700f16d8afd0c31b11b372f9e4558eb383901105514a8e6
MD5 7cc6aa58c3237b3ed7f5d09ba74cac9f
SHA1 5637065c62e49232031a23fd529df6986ba13dc2
SHA512 84ea714f473eb066d286c4d4c8d02f4624ead398bb0e75c3641ae924915f819f8a48e9087ddd4ebd6b7cd3bb4d826f1f1d8ff3444622e3d3c57e12cb1e2892d0
TLSH
T1F1D0221023478A844BEE600EC6EDC26C8323CC2F698C3A599D80888C96236043662589
MD5 SHA1 SHA512 TLSH

Submit Download

dz3b1b6a.0.vb

Path C:\Users\Admin\AppData\Local\Temp\dz3b1b6a.0.vb
Size 356B
SHA256 069e4022d9d8a43c9b2fd85a75458624f29235262ebc1efc889d2cd64ed18d27
MD5 86c68da5eca3f86e9afd81f7e9a34a23
SHA1 e0d5a1b459cc26d07f190de7c53adda1be1bd28e
SHA512 5c54931607ea8ab16c1ab3c36154b81e4ef66a30bb9d911e21ed1c0914b88f097f3e5d4056120daeb8c07698c41f8865e792c05673876ccc3aab419f9c9aa1b4
TLSH
T190E068B3602182424B4938939A91580418BF0FE633941C0901CC2289CA17170976A2A7
MD5 SHA1 SHA512 TLSH

Submit Download

dz3b1b6a.cmdline

Path C:\Users\Admin\AppData\Local\Temp\dz3b1b6a.cmdline
Size 210B
SHA256 3d97fc409708a6613e70a951c2ae0dbdbd5fe97212c3781765975f6660254810
MD5 4d9549223e2dd47976846f163c83a170
SHA1 5b24306f151894a09e14884fdfc267ddfb3702c1
SHA512 1f2022335ee9b8ece1be3ce21ad9a59120fd213973ef7c8a4d5d1dc63ac6a890433d95a062b89f2e0206eaf99f4721cfe0a7565cdbb2666ac1fbba2b511b076b
TLSH
T1F8D023011387C7C467EB200D43D9C55C4372DD2F758836295584994D9192A543665555
MD5 SHA1 SHA512 TLSH

Submit Download

izbhsl8o.0.vb

Path C:\Users\Admin\AppData\Local\Temp\izbhsl8o.0.vb
Size 349B
SHA256 f76e8960b34bb917632dc6cb47cf1c69b53a7b9b5e58a5ccbcf9a099cacc2c99
MD5 f1405abb8e9f89c7517c03f3ecec1564
SHA1 c37550afa9762b44f9c82c852d021ab3624e6ded
SHA512 90819d8cd3fa47e8ac2e79f8abff7ef4f4692185d7ca65fd45cb9144ea335dc92fca5308ae369407f288a40e6d488082a1e89fda5c59c5e5725a80ac76d04733
TLSH
T1F2E0C0F3702187024F4D3C639991580418BF1BF623941C4800CC2288CB17170D76B29B
MD5 SHA1 SHA512 TLSH

Submit Download

izbhsl8o.cmdline

Path C:\Users\Admin\AppData\Local\Temp\izbhsl8o.cmdline
Size 203B
SHA256 98f3d313e70c800c3784f1495ecd7951db1c48a20c07d201fd519d99d6c54fb5
MD5 07f122b3ac8bc77b3b9ce06480ae0986
SHA1 56f6c07d6f0f414234150ad7971da39db7729e83
SHA512 7119240796605b74e192b2e235b94881c1330eb9730946aeea219f937a30e3cc3a179699cb02be2562ea27df3c9662aee45f32e6c2093e4e9d8afafb050f2aa5
TLSH
T1F4D022111B478FC447FF202A42A9C1AC83328C2F28892B694881994CA5266443B72E45
MD5 SHA1 SHA512 TLSH

Submit Download

j30y8wf5.0.vb

Path C:\Users\Admin\AppData\Local\Temp\j30y8wf5.0.vb
Size 359B
SHA256 2bb58efd5e05b869678e245802cefdc4f9e24c8f1ff5c0d44fe12f398f7e045c
MD5 f2eb66522e81f5808c8794592b7d0cc3
SHA1 d10227a9de168dbb33ddd6663c14bae72ec45191
SHA512 a9bdbc6466c144d3867778260dc971dede176983c38c9b3bf1c2fd95c46f6dca25acbf42dd57f727fff2a29252eb63cdfcc44cba8ced86c672f42d00c2d45670
TLSH
T136E0C0F3712183064F4D3853D99259041DBF0BF633945C4800CC2188CF17270DB76297
MD5 SHA1 SHA512 TLSH

Submit Download

j30y8wf5.cmdline

Path C:\Users\Admin\AppData\Local\Temp\j30y8wf5.cmdline
Size 213B
SHA256 f5a51585106ba15b334ac183948bcd534ef8bf71c7b808f18fd0f6a868e396e4
MD5 26a19e740ed01fbbc7390e45529ad27d
SHA1 b654520cdc490c60bcae851f92f30b606e26986b
SHA512 5f7d175a4cb72f4adf5ba5302d775b3b030b57226e5158b3c2a862c088c1687856ba7697e6605d783b2786e4b85381819cbf4261f64fbdab8d86f028dca19b40
TLSH
T13ED0230113474ACC57EB100946BAC15C8332DC3F78443B6D0484858DDA227453BB1946
MD5 SHA1 SHA512 TLSH

Submit Download

owr7x2n0.0.vb

Path C:\Users\Admin\AppData\Local\Temp\owr7x2n0.0.vb
Size 345B
SHA256 412137881e3f3de959a2d007b4a2b49d052571353f8a974010255f4c0f044082
MD5 c8f33b81180ae953e6e8d5451208e55b
SHA1 14619702dbbda508a22d62240d7fe49aa3f1df0a
SHA512 3a23ba1d02585d081c3f9c95625fdf7bf2a0947ebe40ec6352b581b39171a9710f8934b4600954f658c957ff889f270af2cdf8dfccfca35a61ec408fc8eb5a96
TLSH
T18AE020B3B52187124F4D3857999159445DBF0BF623945C4901CC2189CF17574D776297
MD5 SHA1 SHA512 TLSH

Submit Download

owr7x2n0.cmdline

Path C:\Users\Admin\AppData\Local\Temp\owr7x2n0.cmdline
Size 199B
SHA256 c5413d77e8d180418231094d0d4533d8413ca2b8b2a9ae76119c7c5d59385ac9
MD5 70cb08c0e2a1832d6c3e0457a3970eb5
SHA1 67e5caf87af33bb2301c7a8562c50fb68f8a4d7b
SHA512 9a943caa1c3b27c24330d5ab1c7382794205fd55420bd12c3bd143ae6b317557efbe67294d30c10132dbceb335433a328109407aaf6746939610d355dd4a5537
TLSH
T15BD0220203878B845BEB610E4AA9C25CC3628C2F28882A1E0481894E9162B083622A45
MD5 SHA1 SHA512 TLSH

Submit Download

vbc2AB5522F652F42028E63724A75F84AE3.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc2AB5522F652F42028E63724A75F84AE3.TMP
Size 1KB
SHA256 17326f9a7681d321d1ffb868a2608ceebc95da15aab3869fdefe50b88b16e400
MD5 ec954fd8f0426f4fd224800a413142b8
SHA1 27780ee3ebc61049b25401793f5ea61ae102b221
SHA512 adfa6520ab823207830217235f0dd83409e0ff1265afcac15df9a681753f7917133789664f266fe523d8964b8830a28ebe64e86936927e0fd19e4ffbdb5c81ef
TLSH
T1FD41E00536F4B319F2FA9B72A5F283E766657C60DA3283DD61C27B4B39311209F216B1
MD5 SHA1 SHA512 TLSH

Submit Download

vbc7FFEEC946193488FA1DADCEC6C94CAC.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc7FFEEC946193488FA1DADCEC6C94CAC.TMP
Size 1KB
SHA256 90879bd72a7f353afeb7b135366b1044b1aae95c5c6cb2608121bdfad26e8508
MD5 6763fb02b3877e53946428f4ef80c3f6
SHA1 c6b25fa830076f8a1bf5ed721cfcfd3536fd9586
SHA512 5027003a4eac6eedb396c4bd70ce242880507fd66ecb5f78ef78586b945dc4bfbbe57116ab8d60e45de591419ebd0b7902a5cc9b8d4063a7a9f0e037431344a4
TLSH
T17741E00536F4B215F1FA8B72A5F283E726A57C50DA7283DD60C2774B39311209B517B2
MD5 SHA1 SHA512 TLSH

Submit Download

vbcC832A89066AB4D4BBC78DD20A1942BDB.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcC832A89066AB4D4BBC78DD20A1942BDB.TMP
Size 1KB
SHA256 797a044e94d371d7c548803014d4a4bdcf2bf91879d8612d2f19231a7b97aede
MD5 d62356f88962aa44331d21b308f7491a
SHA1 f36af3e97d4439248790a128ab88204fa41465ac
SHA512 fa907e5be22f6e88c114046d36e35f6aaf1b18cb22ade85939b682351cf7a72148c4c11a9d877b34c77817d4f1bdac19b7fd06b80cc40d618bef7900b0c388d9
TLSH
T1AD41BE0532F8A21AF2FA8F72A5F643A726657C60DE3382DD6196770B29316109B21B71
MD5 SHA1 SHA512 TLSH

Submit Download

vbcD6E79C0928794F23AEFBCA1F46AE7916.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcD6E79C0928794F23AEFBCA1F46AE7916.TMP
Size 1KB
SHA256 affef6474e9aa94d7a81c0265ccfdf54cf264bd0e444e911c03de4638ceac488
MD5 36aa7894aa5906f8b99f57b816a09670
SHA1 252d7229b8e406aaeaf946c77c812099a8f470dc
SHA512 48011b3cb598ac2ebdb148e91eb3391975d1a70941100cc7c7366076209b4c99d488f14495c6c836659d70445ff4bffc632621e4b1281bf565d2f15336d3a6db
TLSH
T11D41F00436F4B219F1FA9B72A5F293E736667C50DB3283DD5186774B39311209B21BB1
MD5 SHA1 SHA512 TLSH

Submit Download

vbcDB844AEEA4444B5E97F16A2E3457327A.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcDB844AEEA4444B5E97F16A2E3457327A.TMP
Size 1KB
SHA256 b08d18a414c023a863cb593aca25e050def189404386646f8684332d83c2853d
MD5 c8c69478de668f25e7cd1c4da542be5a
SHA1 5c39d9a75db8da357dc5395ab54097b42587c18a
SHA512 a1387dac9b18aa304fde3baeeef540c39f2ee595b8f4cca49974551cafac63f1d542fffe665a602003a8c98eaf2956a8aa2b487a5853754c4ea7b1b532ee27e2
TLSH
T1AE41CE0536F4B219F2BA8B72A5F283E72665BC60DA3383DD61D2774B28311209B217B1
MD5 SHA1 SHA512 TLSH

Submit Download

vbcFD89EBAB5CC54C0487C76C722B68B2AB.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcFD89EBAB5CC54C0487C76C722B68B2AB.TMP
Size 1KB
SHA256 8b2c03c87bd392f3f5d6b5a4345f2eca8e81b283cf8023afe868afeaf7a84fbd
MD5 7d1167f15b2a43361bf0f23b45696e75
SHA1 2e2dc9f6b8a19ce2f0f6c7f66b88cdb389427671
SHA512 634afaf4b692c465a392a5e8c6e0579ee7d68c4cbcbbd69d2c660a69138c2b8417b41a3b7d7f62b7915e6d2c549edeada2b22ecc67091df9fd3e9be2ce42b3b3
TLSH
T19F41F00432F4B319F1BA8BB2A9F683B72765BC60DA2383DD6192770B29311109B117B1
MD5 SHA1 SHA512 TLSH

Submit Download

$RECYCLE.BIN.exe

Path F:\$RECYCLE.BIN.exe
Size 7KB
SHA256 4fb6c1e79417582535aa85194530709ad5ea46f4a116bd93e7453f8eea972c62
MD5 f1d78911ce7015c4ce0543bb9ad90f59
SHA1 17215b29c68ff9dfbd143e860efdb0a960edbe39
SHA512 1e76aeb955e1ac2879a0c3ae94c7c61780ecfe49f5e137532bcd539e7bda0b8ee0a7c83359a2dafefea25eaf004376607b5822a2072fc980daf6bebb0071c8ba
SSDEEP 96:LstPFk3uUkrBoiMM2WUp9OcE2VYlnlYJnLLPL0KffLThc11v1VRXmm5FriT+ztT6:oPFk3SrgbRVInlYJLLLTTuTPmCztTQR
TLSH
T141F1181A37F1537ACA9D07B309F345425BB1ED04DF63ABAF0091B3639EA31484B52672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-101-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4264-51-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-11-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-0-0x00007FFB989A5000-0x00007FFB989A6000-memory.dmp

Download

memory/4804-13-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-15-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-12-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-18-0x000000001DB80000-0x000000001DC1C000-memory.dmp

Download

memory/4804-22-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-10-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-8-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-9-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-7-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-14-0x00007FFB989A5000-0x00007FFB989A6000-memory.dmp

Download

memory/4804-6-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-99-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-2-0x000000001BA00000-0x000000001BECE000-memory.dmp

Download

memory/4804-4-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/4804-5-0x000000001C980000-0x000000001C9E2000-memory.dmp

Download

memory/4804-3-0x000000001B420000-0x000000001B4C6000-memory.dmp

Download

memory/4804-1-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/5028-35-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

memory/5028-30-0x00007FFB986F0000-0x00007FFB99091000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads