29cdc2cdc8ac68068d2acc5e92a310f62e9058ebc4083e8d0685d97d4c7c0975

Analysis

max time kernel
178s
max time network
181s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29cdc2cdc8ac68068d2acc5e92a310f62e9058ebc4083e8d0685d97d4c7c0975.vbs
Size 1.7MB
Sample260809-275agaxbra
SHA256 29cdc2cdc8ac68068d2acc5e92a310f62e9058ebc4083e8d0685d97d4c7c0975
MD5 c838b477158dde69b0bd7194535b1691
SHA1 496b9143b20e251273de03a387c6c047df675c6c
SHA512 ed2355ec12d862b62a5f0527f48390f6ee36ed9105afb93bae695db8ff3a81bec0be13e51247bc13ef9241953003cd0847c15853aa03dd664141fd7de8628cb6
SSDEEP 3072:b+BUN6kJqqHbZj0OQ5mH7R3csfFMw+n3JxeKawSb8u+yl71D+Qa4DWXB/JIAKs0D:b+BUN6kRs6OgRmtg
TLSH
T1538570602D8A644EC11B5042E35ECE93B61A7D11731278B156BC4B37EE1F83DEA8F7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5268	powershell.exe
9	5268	powershell.exe
10	5268	powershell.exe
11	5268	powershell.exe
13	5268	powershell.exe
15	5268	powershell.exe
16	5268	powershell.exe
18	5268	powershell.exe
19	5268	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3524	powershell.exe
5268	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Cache\\DllHost.vbs\""	WScript.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ifconfig.me
9	ifconfig.me

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3728	WScript.exe
4372	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3244	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3524	powershell.exe
3524	powershell.exe
5268	powershell.exe
5268	powershell.exe
5268	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	taskkill.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	5268	powershell.exe
Token: SeSecurityPrivilege	5268	powershell.exe
Token: SeTakeOwnershipPrivilege	5268	powershell.exe
Token: SeLoadDriverPrivilege	5268	powershell.exe
Token: SeSystemProfilePrivilege	5268	powershell.exe
Token: SeSystemtimePrivilege	5268	powershell.exe
Token: SeProfSingleProcessPrivilege	5268	powershell.exe
Token: SeIncBasePriorityPrivilege	5268	powershell.exe
Token: SeCreatePagefilePrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5268	powershell.exe
Token: SeRestorePrivilege	5268	powershell.exe
Token: SeShutdownPrivilege	5268	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeSystemEnvironmentPrivilege	5268	powershell.exe
Token: SeRemoteShutdownPrivilege	5268	powershell.exe
Token: SeUndockPrivilege	5268	powershell.exe
Token: SeManageVolumePrivilege	5268	powershell.exe
Token: 33	5268	powershell.exe
Token: 34	5268	powershell.exe
Token: 35	5268	powershell.exe
Token: 36	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	5268	powershell.exe
Token: SeSecurityPrivilege	5268	powershell.exe
Token: SeTakeOwnershipPrivilege	5268	powershell.exe
Token: SeLoadDriverPrivilege	5268	powershell.exe
Token: SeSystemProfilePrivilege	5268	powershell.exe
Token: SeSystemtimePrivilege	5268	powershell.exe
Token: SeProfSingleProcessPrivilege	5268	powershell.exe
Token: SeIncBasePriorityPrivilege	5268	powershell.exe
Token: SeCreatePagefilePrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5268	powershell.exe
Token: SeRestorePrivilege	5268	powershell.exe
Token: SeShutdownPrivilege	5268	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeSystemEnvironmentPrivilege	5268	powershell.exe
Token: SeRemoteShutdownPrivilege	5268	powershell.exe
Token: SeUndockPrivilege	5268	powershell.exe
Token: SeManageVolumePrivilege	5268	powershell.exe
Token: 33	5268	powershell.exe
Token: 34	5268	powershell.exe
Token: 35	5268	powershell.exe
Token: 36	5268	powershell.exe
Token: SeIncreaseQuotaPrivilege	5268	powershell.exe
Token: SeSecurityPrivilege	5268	powershell.exe
Token: SeTakeOwnershipPrivilege	5268	powershell.exe
Token: SeLoadDriverPrivilege	5268	powershell.exe
Token: SeSystemProfilePrivilege	5268	powershell.exe
Token: SeSystemtimePrivilege	5268	powershell.exe
Token: SeProfSingleProcessPrivilege	5268	powershell.exe
Token: SeIncBasePriorityPrivilege	5268	powershell.exe
Token: SeCreatePagefilePrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5268	powershell.exe
Token: SeRestorePrivilege	5268	powershell.exe
Token: SeShutdownPrivilege	5268	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeSystemEnvironmentPrivilege	5268	powershell.exe
Token: SeRemoteShutdownPrivilege	5268	powershell.exe
Token: SeUndockPrivilege	5268	powershell.exe
Token: SeManageVolumePrivilege	5268	powershell.exe
Token: 33	5268	powershell.exe
Token: 34	5268	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 3244	3728	WScript.exe	89
PID 3728 wrote to memory of 4372	3728	WScript.exe	92
PID 4372 wrote to memory of 3524	4372	wscript.exe	93
PID 3524 wrote to memory of 2892	3524	powershell.exe	95
PID 2892 wrote to memory of 2628	2892	csc.exe	96
PID 3524 wrote to memory of 5268	3524	powershell.exe	97
PID 5268 wrote to memory of 5944	5268	powershell.exe	99
PID 5944 wrote to memory of 244	5944	csc.exe	100
PID 3728 wrote to memory of 3160	3728	WScript.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29cdc2cdc8ac68068d2acc5e92a310f62e9058ebc4083e8d0685d97d4c7c0975.vbs"
1⤵
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\tfg10662.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\ex16156.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ndy5tj0r\ndy5tj0r.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB91.tmp" "c:\Users\Admin\AppData\Local\Temp\ndy5tj0r\CSCC86E26E55E9F4389A592AEC3AF9BECEE.TMP"
        5⤵
        
        PID:2628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\agent_1784154235.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5268
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lbdj2laa\lbdj2laa.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5944
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES296.tmp" "c:\Users\Admin\AppData\Local\Temp\lbdj2laa\CSCE30581D435004779A29BDC60CE2D5DC4.TMP"
        6⤵
        
        PID:244
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc onlogon /tn "WindowsUpdate" /tr "wscript.exe //B C:\Users\Admin\AppData\Roaming\Windows\Cache\DllHost.vbs" /f /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3160

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES296.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES296.tmp
Size 1KB
SHA256 5d58710c80edd6ab3d9a203bcdf2f6728a268cc9a2039e8d7f632098b17d1b94
MD5 cc866f0b09675b0d3a29db6734403a49
SHA1 5d450f2831803857c187fe8d45a055da1fd19939
SHA512 660d5e3b02da54f614d08253196db5c26ad8bea59e4bd98a17b1f019cbb42367c3a3b609ff014d00c3497a1b53be33f9076a25b76c12607cc276aedff82efdb6
TLSH
T1AE21CC05A3F8471EF0B347327DF5576F9274FD69EFB6935A498042282C51244EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RESFB91.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFB91.tmp
Size 1KB
SHA256 feaf3d42deecd6e66d0ad69a1324501b6ad895eb73a3e555fc0026233cacff85
MD5 34a26f12bd05a344199cb4a2f90e7ec5
SHA1 66aa81a548b3f2254e21a5532649a7546087a7d5
SHA512 2d041eb15970da7b9b4031dc9ae64f7620eed259257d23ef1a9fa2c3af5367f07a216c0112f29f39250b440a1489166ee517cc168523a26a6a9aa3d58aacef95
TLSH
T10E21AF0553E94B1FF0B34731A9F6071FA278FD68EFA6935A8541122C2C51644EFA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qnmtr24l.0r0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qnmtr24l.0r0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_1784154235.ps1

Path C:\Users\Admin\AppData\Local\Temp\agent_1784154235.ps1
Size 37KB
SHA256 c1e19c5e6dbd450170e7080ca6eebc8d8018b02ca42a2229b781e90d7694f609
MD5 fb3dc1e824b11b0c9d6d3b9e2173845c
SHA1 df25b070e4be6fa1886cf43e29374a6b8386b0fd
SHA512 d24cdc2b9db6e63bda1b0379e53b878610c1e913f467183e7616151497ed72a48b51ba59eeb0a2cf972faba797d463fd39f6410fca6352e1750fd11ba8dd8206
SSDEEP 768:14gsJgZcLtjYqmwk9jqvSAFnMwyqjyEDQ0:ugsJfLxYCk9jYS0nMwyqjyEDQ0
TLSH
T1B403E6393D06601475F6EF7E59A78852E92A3127B75A0890B2DCF3C01FFC994C929CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ex16156.ps1

Path C:\Users\Admin\AppData\Local\Temp\ex16156.ps1
Size 59KB
SHA256 e9f0620beda4f12b2db117a73f74b0a8ce8098c25b588078fc9d088036c1a7f2
MD5 9bedb701fb66d5db95dacecda07a5680
SHA1 23c45757d1601ec4bc5a85107e49aa64ab6ce9fb
SHA512 11bb96e56067cc0e93efe8175f0d5f7b1c0d1f1379f5a5fce5103ccd01a29da3bbc38d6871eecc11b62f9a4d479325c37f78ade11c8f95484df1fe8b4dfb53e4
SSDEEP 1536:qs2ARCeVeZmDXoOOht/QAMI/nGo6+ASvaXb0th8:qslHSmDX7AkwnGmA8K0Q
TLSH
T12353BFF25F3D1CC0D9992B322CEDE5F126C2B84988436C659FD7614A69B4134A3EB0B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lbdj2laa.dll

Path C:\Users\Admin\AppData\Local\Temp\lbdj2laa\lbdj2laa.dll
Size 3KB
SHA256 b2084524465e1f790a25097caa77d59dfb2fdc27b40312f580db237d7e1e90ed
MD5 bf4b070b5414b4e29ff10539d9a3ad7f
SHA1 318607335e1edbb10dae88e756a079d25d9d8f17
SHA512 51db4a5454f1b3cf124be44f6205e25752d1aa3237c73b55914ab33c230d710bda2dd74e2cb0613a90205fbabe2f7607382885ce826bf3dc4bd766d2f3a5d538
TLSH
T16B71DC5AA3F8492BE4770735AEE3472263B4F9509B72975E06800219AC216744D31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

ndy5tj0r.dll

Path C:\Users\Admin\AppData\Local\Temp\ndy5tj0r\ndy5tj0r.dll
Size 3KB
SHA256 ecb627862000ed23f258ac5d232d731190cfa26c85bc74c789fcb1360d15189d
MD5 35947660cc1335176141105d1b4f4ee9
SHA1 ea1b419c683d6d96351de5c2f885a439de7e3978
SHA512 162d94322775e7f1864762a12c71c0a12f738b5dab756486c72f82e3c22519d7f41c039fefb8b2a8954ecfb18746b860d05dd57c5e76d6abb5e8fbf58faab590
TLSH
T196519B1A57E94A2BE4B70730ADE3432677B8F8149B73531D5880422CAC607649E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

tfg10662.vbs

Path C:\Users\Admin\AppData\Local\Temp\tfg10662.vbs
Size 196B
SHA256 6c3c132bdc2cdf6d716dbf48b6b30e7a25d55cd854598d31fe81ff1e0e01ba3f
MD5 80a780a9de9f6fd540250728d89e9ac2
SHA1 318ebedfb5fd0b905988d63b1745fb3468b60f8a
SHA512 9bf2cc0c58f4b19dade0e39a1b485a841ef8973ea0127188b85bdd4e0caf3f790851d48d388c85bb51de95d18139f1a4cc3d2e44942f22f67244f8e0050009b7
TLSH
T174D02247E44AD7AC4D03C42E12A2A21C88A6680C22040B1067A0C50C30470A5C3AA1C2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE30581D435004779A29BDC60CE2D5DC4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lbdj2laa\CSCE30581D435004779A29BDC60CE2D5DC4.TMP
Size 652B
SHA256 405003fcc49b63fe29f6fcc2a4ca6570763e71a17536dd5a1bb202b468c99440
MD5 696caf1728414cffca6ff874107bcf15
SHA1 d2aaca1de709b4188d9f94b71633c5098a3ac763
SHA512 06f0a9ef97c56f2b2adeea9db7144bc5bb8744c952e92c1b2b14d91ec3c247c528209b2a9602b812f5a858ec3937d0981ad133072d48d24e28743818cbb1adef
TLSH
T149F0540AB3F8020EF4F34B30BDF543A391A8BC65DE3653ED158003191C645109561F71
MD5 SHA1 SHA512 TLSH

Submit Download

lbdj2laa.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lbdj2laa\lbdj2laa.0.cs
Size 525B
SHA256 5c157c27bd111c07e46dcd7c61072ec5726cd7b3ed683cd77ad4b04832c1d13c
MD5 c6119087c13ec1c8f64e986596cdbdba
SHA1 b883af8eea176f1f3eb88b319bdfafb2395cad11
SHA512 8f4c67fe8a6eae0898f79a10bd80bffcaac29a81563c2fc398bd13c61ded4768dbb7f320cd4783e6147a6dfa73fb024e678316113efedfe22c2d4d28dfd90e0c
TLSH
T191F05938F206C6791A7201066C4255B9FA171122723B1E4475B92B32AF6313ABA38F5C
MD5 SHA1 SHA512 TLSH

Submit Download

lbdj2laa.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lbdj2laa\lbdj2laa.cmdline
Size 369B
SHA256 814471b1cbaed97349a1be8ebc751fdc74b42212d06d6b053e5b9a64bec60298
MD5 618cded03f29ba07e65751f15825480f
SHA1 bce4c3b699c505782b5b51fb188dc2fe1c8db5c9
SHA512 3168475983f7757ae20ce9abea1e75e8302048c52d13beda08e07dd3b5c398d8e25416ff630149deacc8b5857d15db358320adf039009a8f0ac9881c7ef12886
TLSH
T15EE0202E5256C77E15DD100B216DE5FCC2B307472981BF84915F449DE01742867D1756
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC86E26E55E9F4389A592AEC3AF9BECEE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ndy5tj0r\CSCC86E26E55E9F4389A592AEC3AF9BECEE.TMP
Size 652B
SHA256 6b80b67dc94960dcc51fe6748bcc118e73c3e12324fbe9af6b3f3c9eb4256f4d
MD5 fc336b2d601d874632a0b89ce365865d
SHA1 36725ee36b878cbdd02d620848fc5824a64413a9
SHA512 a53629860fb6359ca92d7881c9126d8814ed9805a3aa00d2130e42a787d75451b389056fef1c5dc9c540d55688bd40634ff789af85ddc0ad7d0298cdfbbd1662
TLSH
T16FF05E0A63F8060EF4F34B30BDF6436391A8BC64DE3293ED5441131D2C646208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ndy5tj0r.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ndy5tj0r\ndy5tj0r.0.cs
Size 277B
SHA256 fd48800ce3949cd7332feb588f1a8ef185f723eaf17ed367e618a87e1cfabf62
MD5 141ac18507313292238d14ed50bccd9e
SHA1 998eddab6a9c6faabb65305c31352afb700f215d
SHA512 63c8f84d2dc41e45d4723d1a95ef8b561b711e30ce20247298b61bdd521d5d586c97e28510f6f2d1c51dfe175e42858e1d6f3d353084c950b2237a7b23f178ec
TLSH
T18DD05B1477B3DE74506344268C46E0FCB617512626791B047AA95711DF8F00AA636B5A
MD5 SHA1 SHA512 TLSH

Submit Download

ndy5tj0r.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ndy5tj0r\ndy5tj0r.cmdline
Size 369B
SHA256 76847fec33109a1e84c06a8bbea9a141dc9339307322b5f5024ea0ddcf1b37ff
MD5 41efbe023ac66978d06566bd8dcfc15d
SHA1 e6b2eeaa083200fd8c04bc9017b5e8f116251bb2
SHA512 7efb44a40c918553977bb79d88542f1387eb7df450a864a11e407b69a5e763561330b30803aa59f4499c24f03cfaaa373e1297d08b20ed5e7862b7dd5f06ac31
TLSH
T184E0682A4E86C27D8ADA1C07396AC5AC8672074339423F845040444DEA17048ABD1762
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3524-19-0x000001AD53C00000-0x000001AD53C08000-memory.dmp

Download

memory/3524-5-0x000001AD53C80000-0x000001AD53CA2000-memory.dmp

Download

memory/5268-36-0x000001F965330000-0x000001F965338000-memory.dmp

Download

memory/5268-39-0x000001F965850000-0x000001F96586E000-memory.dmp

Download

memory/5268-40-0x000001F965870000-0x000001F965922000-memory.dmp

Download

memory/5268-41-0x000001F9653A0000-0x000001F9653AA000-memory.dmp

Download

memory/5268-47-0x000001F965BB0000-0x000001F965BD4000-memory.dmp

Download

memory/5268-46-0x000001F965BB0000-0x000001F965BDA000-memory.dmp

Download