vjw0rm | 99ebda03950dec5b23b978df6d6d6cf254bd6781ed5d23b8ad8dfe3c230a9515

Analysis

max time kernel
178s
max time network
184s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
99ebda03950dec5b23b978df6d6d6cf254bd6781ed5d23b8ad8dfe3c230a9515.vbs
Size 1.3MB
Sample260806-snar3sysbz
SHA256 99ebda03950dec5b23b978df6d6d6cf254bd6781ed5d23b8ad8dfe3c230a9515
MD5 cf9b70f279147cc1e66b87981ec33ad1
SHA1 b9ba55d518ad7c19ad95a68d287098099dea7f43
SHA512 a0dd6e3186f3da67a9c5e69ae1dafe1785335d07c18264038bc52de8d667ea6674207527fd2ce53a261897665b413aca8401a45c8c0e8643ff4fe1283bdefbba
SSDEEP 3072:gAsDWTHSnxrYgY9tJscvjMtL55gaiBRKfYRf1l8FN9ymojvB9RjhNjv0lSQK8kFa:grOchXh/QDe
TLSH
T12B55FFB91F9818CBCCBA1345B127C061BE6FBE15C623B8EF5A1D4DD0254280698FE5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution vjw0rm persistence trojan worm

Malware Config

Extracted

Family

vjw0rm

http://nuevoooooo.duckdns.org:1111

Signatures

Family: Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4916	powershell.exe
3	4916	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1424	powershell.exe
4916	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\DeviceSetupManager = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Cache\\TaskHostW.vbs\""	WScript.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
3	ifconfig.me

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2840	WScript.exe
1484	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2096	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1424	powershell.exe
1424	powershell.exe
4916	powershell.exe
4916	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	taskkill.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe
Token: SeUndockPrivilege	4916	powershell.exe
Token: SeManageVolumePrivilege	4916	powershell.exe
Token: 33	4916	powershell.exe
Token: 34	4916	powershell.exe
Token: 35	4916	powershell.exe
Token: 36	4916	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe
Token: SeUndockPrivilege	4916	powershell.exe
Token: SeManageVolumePrivilege	4916	powershell.exe
Token: 33	4916	powershell.exe
Token: 34	4916	powershell.exe
Token: 35	4916	powershell.exe
Token: 36	4916	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe
Token: SeUndockPrivilege	4916	powershell.exe
Token: SeManageVolumePrivilege	4916	powershell.exe
Token: 33	4916	powershell.exe
Token: 34	4916	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2096	2840	WScript.exe	89
PID 2840 wrote to memory of 1484	2840	WScript.exe	92
PID 1484 wrote to memory of 1424	1484	wscript.exe	93
PID 1424 wrote to memory of 5236	1424	powershell.exe	95
PID 5236 wrote to memory of 1164	5236	csc.exe	96
PID 1424 wrote to memory of 4916	1424	powershell.exe	97
PID 4916 wrote to memory of 5900	4916	powershell.exe	99
PID 5900 wrote to memory of 6028	5900	csc.exe	100
PID 2840 wrote to memory of 4940	2840	WScript.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99ebda03950dec5b23b978df6d6d6cf254bd6781ed5d23b8ad8dfe3c230a9515.vbs"
1⤵
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\ny98825.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\h0r48173.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\prfxjmks\prfxjmks.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5236
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E0D.tmp" "c:\Users\Admin\AppData\Local\Temp\prfxjmks\CSC3834AA3DC73D4677951E186D62692FA7.TMP"
        5⤵
        
        PID:1164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\agent_1783533926.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2v2y4njs\2v2y4njs.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5900
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2793.tmp" "c:\Users\Admin\AppData\Local\Temp\2v2y4njs\CSC28726958D85A4D5099C21DE94A54E38.TMP"
        6⤵
        
        PID:6028
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc onlogon /tn "WindowsUpdate" /tr "wscript.exe //B C:\Users\Admin\AppData\Roaming\Microsoft\Cache\TaskHostW.vbs" /f /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4940

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2v2y4njs.dll

Path C:\Users\Admin\AppData\Local\Temp\2v2y4njs\2v2y4njs.dll
Size 3KB
SHA256 588cbf06f1a5d60cf7746af8f6367de3f26027a3feda8101dd6ed5de2340ef24
MD5 c8ee7bcd502b206fb1080f39529bfaaa
SHA1 cce728f95c86cbbc978c3f588136ba1e28820b38
SHA512 88fb58c1fa19d557f33ec10f3d61f2c1155c8d4a1ba58a564be2c27eda78baec78d37f4386817e1e60c1328595f66cf4f36b450aa0a34ea5d8f02796bd1a3060
TLSH
T12071DA1A93E8466BF4774B38BEB3471627F4BD609FB2875E0980031DAC216345931FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES1E0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1E0D.tmp
Size 1KB
SHA256 e0ec3364de2b7603bf9a1d421701645ed6038c875d2cd7a0875d61074db97ab0
MD5 a8073473813ff0201965c3955eb17cf9
SHA1 6f87e5aa2387cb13f416c10dd74a9c91fe6da39f
SHA512 8a250075f0c78de35d9c9cfd558d48df04e48e6cbbd0a9bc667915c7a13b4590ea5bb45d221fbeafcb3180df92edcb4248753ccb73863bbd814f8cf1dce38a81
TLSH
T1EF21CC05A3E9470EF0730731A9F6031FA274FD64EFA2935B844002292C52504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES2793.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2793.tmp
Size 1KB
SHA256 41240f5d438985499458a352dabd8ef592e0492eaca3f60cba43a2d2b4fab6bc
MD5 1501fe74f5f91bf34bb64331cfbe5f48
SHA1 837367b673193a18bec43b7f9990cb6ed16f223f
SHA512 9d86a36f2aca35be857b1da368d24a0b2c694923c551885f3e8e0867de0f70f31353dd997497dca33f4cbe93758f4e8be8333fac7994ec402204098fef036d88
TLSH
T1CC218C0593E9470FF0B3473269F5175F9274FDA4EFA1935A944142282C51504EEF0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gci3psui.n42.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gci3psui.n42.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_1783533926.ps1

Path C:\Users\Admin\AppData\Local\Temp\agent_1783533926.ps1
Size 38KB
SHA256 d398bc52d93382d73f8033492e32bb4825ccdbc83a0de9621d606e50621ee51e
MD5 8bf8413a07fff5d1f39fa1b6f464e9f5
SHA1 69fc2f0104cddf9e15139244df3f425630802f6e
SHA512 19603936ce1459fa78613ce41aa88e5fae7cd0314b28c595087ebad5382dedbded17186d995881c23dd6cbbcf1d00f168693a70d9a0ecbbc024a8a1602f3f253
SSDEEP 768:QIVkJcTfsRqUJQ5rHxxl22TlzjE9NAep8P8BkUW17Ms8Hnw:QskJCfsyxZTlzjyBe1nMw
TLSH
T1F203F77C3E46B00035F69B7E69AB8901ED2B306763651451B2DCB2C01FFC9ACCD69DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h0r48173.ps1

Path C:\Users\Admin\AppData\Local\Temp\h0r48173.ps1
Size 61KB
SHA256 4b595ca6db7d8460a286ec997e23909b747f2806e9c5788b8b9e3df52203de92
MD5 e5e3065441c78a989946879f61c7f6ed
SHA1 68e876140544e87d752e549ebc78c98c2e6759d2
SHA512 58a7f13313d425f66b59710702e5c97c37c03d9b96f212521a9dbcb717c205a64631a8ae3063bbb769830709a2090d104fb672088034e1606cc1cb699ba4ce28
SSDEEP 1536:ECcmWEmOOGJufvLk/ayRRCohLrOU7KgZaTmshfPv1:EfEmOOgufvwyyR48LqqvZ2//1
TLSH
T10053C0D5A970A8E2D68937C858DBDBF969C333399AF31763A318720028F516125E703B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ny98825.vbs

Path C:\Users\Admin\AppData\Local\Temp\ny98825.vbs
Size 199B
SHA256 07de7b076607a677f8966f7652390612edeb705022c59509556fe799151fa08d
MD5 de28b2638f2d6b1cf1bfa365b72c2ed5
SHA1 a41f2a201d6446643e19e10f209087b19b0dd704
SHA512 d5896759bd66471b055f64e1ce2cae1eaf137941a9afb6dae6ca42f54d3de88430857d00fe3244570fc122df8e4355c9a02ec674fc99beb85d2c4edbba30492a
TLSH
T161D02206E44AC36C2923D86B04B292AC88AAF40423184312B7A0C60C328B2A9C3E72C2
MD5 SHA1 SHA512 TLSH

Submit Download

prfxjmks.dll

Path C:\Users\Admin\AppData\Local\Temp\prfxjmks\prfxjmks.dll
Size 3KB
SHA256 c94aefd52a8f0c6df6fb571a24a65ce5296e9448b91a379b2cb8f4b6a0e68ded
MD5 88fc926d8a841336841d4a35fd1d6470
SHA1 12ddaf3eaa2d11e395b0e62a76013d75b02eacdc
SHA512 771dc035c9c96e16cb617f26ffec83914e7fb3ddc022f7e45646d22effa639f6d3700710c5dd215065931ac21cd460ddf1760253c7fae4992cbe773654e6fdaf
TLSH
T1AB51EF1A67E84627E8B70731ADF3431637B8FC209F73671E4980425DAC722545D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

2v2y4njs.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2v2y4njs\2v2y4njs.0.cs
Size 521B
SHA256 2a9921801b42f12e9f8a8c78c5a2319f5da6d74f4986a208ec7c705022366078
MD5 96019fb06dd5de74a626a35f731feae3
SHA1 9fbaed5566ea0278069e926f2c3c950d42c738f6
SHA512 649f0ceeae31b03fbb3a7ce3cb0d478f6b240c34b748d6746d79f6a953d2122cfa4d7cb4ac487d7309f626aa07da0e1acf7ecbb798558a38309eb7fe3767f50b
TLSH
T164F05938F206C7791A7201066C4359B9FA171121B23B1E0479B92B32AF6713ABA38E5C
MD5 SHA1 SHA512 TLSH

Submit Download

2v2y4njs.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2v2y4njs\2v2y4njs.cmdline
Size 369B
SHA256 090a4fedd39753ed3f9b2541150d5081499bf93ac353836a72726e311ab95d08
MD5 f29bb36d1a2daa707fc3154d67fb40ea
SHA1 f896993dc9ae7d2e8e75067b3fb203fd309bce00
SHA512 3136392ac88d79aeca073d468e55a95a9cbb08ca6850c65bfaaa6f9d970e02d02639b125a92cc1fb829b93bb9cd440bfb8e93bf95fbd656ef9acaea5ec2ff901
TLSH
T1A4E0C07A526AC67E05ED300F21ADC4ECC27217C72940FF8C5450840DD01B00027E1B5A
MD5 SHA1 SHA512 TLSH

Submit Download

CSC28726958D85A4D5099C21DE94A54E38.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2v2y4njs\CSC28726958D85A4D5099C21DE94A54E38.TMP
Size 652B
SHA256 f127163692196c375a909188b2be0033c28911fa1521a42bfa19a022fb5b38b6
MD5 f33a2aa2f6fbee24cfacaafb04452358
SHA1 b98cd6aeb1c946b6aa3416bd5d9d2e5eb503a09c
SHA512 45818a1c20a2c1d40810264febf9276025b506a383e1865170517a1d450382ee725fa240222a05972f846e1ce118ab863b7db6a1caa8a8309a3b7d9159d85b4c
TLSH
T1B3F05E0963F8020EF0F38B30BDF643A791A8BC64DE7293ED5885432928649149972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3834AA3DC73D4677951E186D62692FA7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\prfxjmks\CSC3834AA3DC73D4677951E186D62692FA7.TMP
Size 652B
SHA256 92ccbb96bba528387aa0864b4bcd59d9ec9607e314630d53b540a8591a707182
MD5 bac2152168a93b4929658e4936c2a477
SHA1 7b6a211c0fffd706d321622d555d0a796ae94cee
SHA512 ca8ce2151a2757f1c1426b892522cef17ee75af36bd2e9e7fdcd83d51fd540109f81cfcda86ed4a2eea271af8a7a92fc6c7aa281843e0918c3b98c9e29f1cddd
TLSH
T10BF05E4973F8020EF4F34B70BDF6436391A9BC64DE3293EE155443592864510C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

prfxjmks.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\prfxjmks\prfxjmks.0.cs
Size 282B
SHA256 4fb9af2ac2e8010be000d8d63a22019723133cae467119e4c4820ecc9bd29c39
MD5 0a37c465443cb0c804a2465d63951879
SHA1 2b1bf1c60817b05dcdc3d2c353d5baada28c9c52
SHA512 943cb34427c7b3add6ff8d5025f4fa2e8ee811abbc88f11ac8ee5bbffee52f4f2741454dd06c75ac5199cef397dbaff2a23c742ec10a56370ba9679dae4e3f46
TLSH
T123D02B1477B3DE34002344168C86F0FCB607512626791A04B6A91721DF8F00E9536A5A
MD5 SHA1 SHA512 TLSH

Submit Download

prfxjmks.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\prfxjmks\prfxjmks.cmdline
Size 369B
SHA256 80d23b19ae2707d11b7cdf83f3ac296eb23dce5e6e962567136e21ae193f51ef
MD5 09313028d298098a3389b68571f01d2c
SHA1 be8ff6dadcbab042a115dd3be6670fe6879eb6df
SHA512 5a3f45e469336306fccd8d4282941aa04043a928b9aedf5ce2f4fc6e0145a0980727da5075e77053b196c5a8afc7e484e1e53d31e9e90ab3db820eda9d1286d4
TLSH
T118E0C62A5347CBBD81ED100B226AC4BCC3B687872D8A3FC4A040940EE6270002BD2792
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1424-19-0x0000026980700000-0x0000026980708000-memory.dmp

Download

memory/1424-3-0x00000269E7EC0000-0x00000269E7EE2000-memory.dmp

Download

memory/4916-36-0x000001871A040000-0x000001871A048000-memory.dmp

Download

memory/4916-39-0x000001871A0A0000-0x000001871A0BE000-memory.dmp

Download

memory/4916-40-0x000001871A0C0000-0x000001871A172000-memory.dmp

Download

memory/4916-41-0x000001877FFA0000-0x000001877FFAA000-memory.dmp

Download

memory/4916-42-0x0000018780000000-0x000001878002A000-memory.dmp

Download

memory/4916-43-0x0000018780000000-0x0000018780024000-memory.dmp

Download