ede69df4ce0d0e36f504ac66a3540cdc21665d023da50f6029af63872ef5e072

Analysis

max time kernel
178s
max time network
184s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ede69df4ce0d0e36f504ac66a3540cdc21665d023da50f6029af63872ef5e072.vbs
Size 1.3MB
Sample260809-3bx2ysz1ht
SHA256 ede69df4ce0d0e36f504ac66a3540cdc21665d023da50f6029af63872ef5e072
MD5 c26424b5373b614f97097fec5c44e62e
SHA1 45c90267c6359899fcdcb42f9548ba17b2fc27d7
SHA512 cdb8cf348286636e95a4a2bd64d3a72510f5af919c20d909c21a75900219bc2f80dec33fca84ab734e96754676c4a80644ee5b1e13554f0a28865b85e15a3cfb
SSDEEP 6144:eNPstGJ6bm3bRhd+M1PBDnhO6JSedd8dHApGMUh8sTd3GYZ7vJBlHHRgxA0c13oi:MNd+M1PBDnhfDc
TLSH
T1155568701AABDF87B09EDE497937040A8AADBC39020374F6D74D5952298BC4FF5A38D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2556	powershell.exe
6	2556	powershell.exe
12	2556	powershell.exe
13	2556	powershell.exe
15	2556	powershell.exe
17	2556	powershell.exe
18	2556	powershell.exe
19	2556	powershell.exe
20	2556	powershell.exe
21	2556	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2568	powershell.exe
2556	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchIndexerSvc = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Services\\Update\\AppResolver.vbs\""	WScript.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	icanhazip.com
18	icanhazip.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4824	WScript.exe
2928	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4644	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2568	powershell.exe
2568	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeIncreaseQuotaPrivilege	2556	powershell.exe
Token: SeSecurityPrivilege	2556	powershell.exe
Token: SeTakeOwnershipPrivilege	2556	powershell.exe
Token: SeLoadDriverPrivilege	2556	powershell.exe
Token: SeSystemProfilePrivilege	2556	powershell.exe
Token: SeSystemtimePrivilege	2556	powershell.exe
Token: SeProfSingleProcessPrivilege	2556	powershell.exe
Token: SeIncBasePriorityPrivilege	2556	powershell.exe
Token: SeCreatePagefilePrivilege	2556	powershell.exe
Token: SeBackupPrivilege	2556	powershell.exe
Token: SeRestorePrivilege	2556	powershell.exe
Token: SeShutdownPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeSystemEnvironmentPrivilege	2556	powershell.exe
Token: SeRemoteShutdownPrivilege	2556	powershell.exe
Token: SeUndockPrivilege	2556	powershell.exe
Token: SeManageVolumePrivilege	2556	powershell.exe
Token: 33	2556	powershell.exe
Token: 34	2556	powershell.exe
Token: 35	2556	powershell.exe
Token: 36	2556	powershell.exe
Token: SeIncreaseQuotaPrivilege	2556	powershell.exe
Token: SeSecurityPrivilege	2556	powershell.exe
Token: SeTakeOwnershipPrivilege	2556	powershell.exe
Token: SeLoadDriverPrivilege	2556	powershell.exe
Token: SeSystemProfilePrivilege	2556	powershell.exe
Token: SeSystemtimePrivilege	2556	powershell.exe
Token: SeProfSingleProcessPrivilege	2556	powershell.exe
Token: SeIncBasePriorityPrivilege	2556	powershell.exe
Token: SeCreatePagefilePrivilege	2556	powershell.exe
Token: SeBackupPrivilege	2556	powershell.exe
Token: SeRestorePrivilege	2556	powershell.exe
Token: SeShutdownPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeSystemEnvironmentPrivilege	2556	powershell.exe
Token: SeRemoteShutdownPrivilege	2556	powershell.exe
Token: SeUndockPrivilege	2556	powershell.exe
Token: SeManageVolumePrivilege	2556	powershell.exe
Token: 33	2556	powershell.exe
Token: 34	2556	powershell.exe
Token: 35	2556	powershell.exe
Token: 36	2556	powershell.exe
Token: SeIncreaseQuotaPrivilege	2556	powershell.exe
Token: SeSecurityPrivilege	2556	powershell.exe
Token: SeTakeOwnershipPrivilege	2556	powershell.exe
Token: SeLoadDriverPrivilege	2556	powershell.exe
Token: SeSystemProfilePrivilege	2556	powershell.exe
Token: SeSystemtimePrivilege	2556	powershell.exe
Token: SeProfSingleProcessPrivilege	2556	powershell.exe
Token: SeIncBasePriorityPrivilege	2556	powershell.exe
Token: SeCreatePagefilePrivilege	2556	powershell.exe
Token: SeBackupPrivilege	2556	powershell.exe
Token: SeRestorePrivilege	2556	powershell.exe
Token: SeShutdownPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeSystemEnvironmentPrivilege	2556	powershell.exe
Token: SeRemoteShutdownPrivilege	2556	powershell.exe
Token: SeUndockPrivilege	2556	powershell.exe
Token: SeManageVolumePrivilege	2556	powershell.exe
Token: 33	2556	powershell.exe
Token: 34	2556	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4644	4824	WScript.exe	88
PID 4824 wrote to memory of 2928	4824	WScript.exe	91
PID 2928 wrote to memory of 2568	2928	wscript.exe	92
PID 2568 wrote to memory of 4792	2568	powershell.exe	94
PID 4792 wrote to memory of 4592	4792	csc.exe	95
PID 2568 wrote to memory of 2556	2568	powershell.exe	96
PID 2556 wrote to memory of 3416	2556	powershell.exe	98
PID 3416 wrote to memory of 2440	3416	csc.exe	99
PID 4824 wrote to memory of 4280	4824	WScript.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ede69df4ce0d0e36f504ac66a3540cdc21665d023da50f6029af63872ef5e072.vbs"
1⤵
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\mxjk67157.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\srco71854.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s1m5wum3\s1m5wum3.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA5F.tmp" "c:\Users\Admin\AppData\Local\Temp\s1m5wum3\CSC1E7CF858B14A4488BEECF7FAEFD5F07A.TMP"
        5⤵
        
        PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\agent_1784154114.ps1"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j3nz1m5d\j3nz1m5d.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3416
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB617.tmp" "c:\Users\Admin\AppData\Local\Temp\j3nz1m5d\CSC310EB6AC854948D2B5D56521D06D9F5C.TMP"
        6⤵
        
        PID:2440
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc onlogon /tn "WindowsUpdate" /tr "wscript.exe //B C:\Users\Admin\AppData\Roaming\Services\Update\AppResolver.vbs" /f /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4280

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESAA5F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAA5F.tmp
Size 1KB
SHA256 0c8a7e1808299782cfeead96dcb2f342c75a7d661feb5e145b99cf17b83767ef
MD5 8190d563443972bbddb6718643eb61a9
SHA1 86712d45c71006a36419252fee9e019d36395f16
SHA512 35e8ce4b4bbe0d693b529c42d5db72502302da69b2192777e74968b847b251cd2740a0153d6259fa12085616e49ba1e4458ca74fd18b96a85e0a5fb34a917c32
TLSH
T19C21A60593EC470BF0735B3169F6176BA674FD55EFA2A35A844002292C41200EEE1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESB617.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB617.tmp
Size 1KB
SHA256 b5eb61b4e61d98fc5eddaaa7fadfdca1016d8c79ccb40926218c7f028fe4d53b
MD5 5652e9330ea31f891a34e47398044ab5
SHA1 15660f9a8edf47b7b9fb2308b847bee7505313dd
SHA512 f447106679e5274de4db792ba8e45f6ca5e4d0bb146d73ceeef0ef360e3cdc1fe58b423e446fd6d1541ee82323cd8e679f8dc1a1cab6e9bc9dfa7943e2150cae
TLSH
T18D21EB0493FC870EF0730732AAF6176FE235FCA5EFA2535A844002282C41604EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lcqkvul4.1ai.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lcqkvul4.1ai.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent_1784154114.ps1

Path C:\Users\Admin\AppData\Local\Temp\agent_1784154114.ps1
Size 37KB
SHA256 2b9926b1e8dd9a9588460f328ea91697f8411b2d0b484a0a81878d73456e5cd5
MD5 5d55030a9d6a58be4701b321ad5f9041
SHA1 85037580b837b2934cd9bcb2766160be60bd03fc
SHA512 31a3f550503b3f04f7f0e6ef7c61b629728606bd63764ce06903b0741e9218d38ab524f81fec4351a472f4b3ea681996f325ed70aedb31a6f7ad248bfbf5a1b4
SSDEEP 768:H4tJnI2qrpC4yq7joDeMfPbzHO50zc1I1P2MPcfnK3NxDG9y:H4zXqrp/ygjonzHBi9y
TLSH
T13403F8793D06B01435F7DB7E59AB8806F92B307763251465B2DCE1C01FF8998CE6ACA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

j3nz1m5d.dll

Path C:\Users\Admin\AppData\Local\Temp\j3nz1m5d\j3nz1m5d.dll
Size 3KB
SHA256 8bd4bbde1200fd6466aea1e13865fc7ae13a4e3658dbef9d2157deb88001ce46
MD5 a986baa1d0517be578b3410832c5d632
SHA1 1827435a8c0773761a0c9ce05c228c4a02877dfb
SHA512 274bafc5a9a5dc54905628a506d546d9fac3427ba66e8ae62ab235dee8c977c7a8ef8f5b3c2b63521883d733b728450e6a2ed053284757f0aad080ed66e88f01
TLSH
T1DB71DA1A93E8452BE4770B35AEF3471377F4BC609F72875E09800319AC216345E71BB4
MD5 SHA1 SHA512 TLSH

Submit Download

mxjk67157.vbs

Path C:\Users\Admin\AppData\Local\Temp\mxjk67157.vbs
Size 192B
SHA256 1fbcaffd1e3474a0acb9e5c678350b3d386f700ffcb78c908b5a36c64b57d906
MD5 2f5b9cf0695175c545dfb1ad4898759e
SHA1 55aa65b9099e05c670eb4dab3b81edf3f470847e
SHA512 01ba7cb2ca233727cf0c4f2ba9cfdfbdcd7c9d4f646d0e1bb8a5fb3784a215effaf3514d47359d045d2e63f394d058f17725a16ac265344a2e0efd6b69ef3c99
TLSH
T1A2C02222908EC32C1A03C46B00A2912C88AE5004221243116668C60C310A1BAC3B7282
MD5 SHA1 SHA512 TLSH

Submit Download

s1m5wum3.dll

Path C:\Users\Admin\AppData\Local\Temp\s1m5wum3\s1m5wum3.dll
Size 3KB
SHA256 221e5e2e04352ad0293d3d06fd264efc9ca95514314cd2635000d364052cef0b
MD5 77782a73b28c2a7522649d006dff8e40
SHA1 0b784c893ad81c7a9eacf2e0428e87c2e6192205
SHA512 ca38eefb05334e25a468dd4a1f8354789c02fa8f12502e9dc514e88a3c2f372041940d2882b1f98982e69cad049033a200c6a1e764b38d9433f6e6e928bdded3
TLSH
T15B51FB1B93E8462BE4774B306DE3072337B8F810AF33976E18804229AC617645E32BF1
MD5 SHA1 SHA512 TLSH

Submit Download

srco71854.ps1

Path C:\Users\Admin\AppData\Local\Temp\srco71854.ps1
Size 60KB
SHA256 d73c5f58aa2afff51cdb253ec8f5d1098998345fba8929c5bcf90098c2966d98
MD5 eaa44d5a2b39bd97ce101055e294e406
SHA1 5c4e4e250c0a6303ddaed9146004813255ee55c1
SHA512 496f60afb5c1d244250d7c748ac960f862ae463800c4b44d845535b44eed26946100f0a6da7587823513271045c8a5f5f9e8078e6aca743e26f9d2aa3d103455
SSDEEP 1536:dHFa4yxs9P2yp6V2VLNQtHHHI6YPjr7ZD:RFBZ2yoEVJMnHkPp
TLSH
T1C253DFD5C5B9A8D592652302B8CEC1F0361F7690CD6B25A523F9E453BD368BA01F38B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC310EB6AC854948D2B5D56521D06D9F5C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\j3nz1m5d\CSC310EB6AC854948D2B5D56521D06D9F5C.TMP
Size 652B
SHA256 9d50765a8109dfdb355c3e6684c774f0c1b58ea6e140c84a77417782ee6ebda7
MD5 32f74d8281680545b1985270f7683a04
SHA1 c6969399ec51b7de0fa686da800f5e0655b6f285
SHA512 c8612924e582570e92070abadefa4a088e446546849ad1607898a4c2b06e0cf6916ef857b727ba46e89a8cc6dfca4a28ece5c8a32d126457006e1df0b8ccaa4c
TLSH
T1A6F0540963F8520EF0F34B71BDF543A3E168BC65DE3253ED544003195C645149A61FB5
MD5 SHA1 SHA512 TLSH

Submit Download

j3nz1m5d.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\j3nz1m5d\j3nz1m5d.0.cs
Size 521B
SHA256 51a26f5ba24ff9a4bfb50fcd702131292c6977a55d782cf68c50a125942c9a9f
MD5 cc8fa00751ec1eb930c0951a85e23d0d
SHA1 88ffdf4b8b94e1e39b935c10056b2d66a88bb7e9
SHA512 765eb6cd079fccb2bd3ac34e10042c27101e0cb5780f81c65aabc7b886bfa2a88314b20cea3c8187ff9474f9170cf4279c49997606424c947b2a5a8dce2e765f
TLSH
T139F05939F306D6791A7201066C4655B9FA171121723B1E0475B93B32AF6323ABA38E5C
MD5 SHA1 SHA512 TLSH

Submit Download

j3nz1m5d.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\j3nz1m5d\j3nz1m5d.cmdline
Size 369B
SHA256 ad19bd195a65583e1ec8ea2afd1018e06c014c7695789c6ab1ac5ecd72553fdf
MD5 e6ad52bde7727559bf2862f5f0c38cb4
SHA1 b30241c7a38bfdee9ab8cc5a2ad3ad5ddecd0aea
SHA512 156667b1a9e244c904ce7875f6556fdd047d148c553f1707cce7f2811b8f2a6896ef362212271315020fcdde3695024b4da2f64fc9da701b37378555ace73ef3
TLSH
T1B2E0682EA646C2BD19D9110723A9E8AC8273074B29803F845050C4CDD0A70002BE1B41
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1E7CF858B14A4488BEECF7FAEFD5F07A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\s1m5wum3\CSC1E7CF858B14A4488BEECF7FAEFD5F07A.TMP
Size 652B
SHA256 0337b0b6e5409d0ff8e5a2fc489c5315cedc0f47762990df0f68cefbb3a6bbda
MD5 71a2c5a1519e680050367f6d962b6153
SHA1 127b0054b9fee568dcc725eb18070309da7e2751
SHA512 e63b63b9d4ffc6c00af8257ee26871c8a3abb106e853a8014af197e456e0d621b4ec0bea81dda43566917cdd8b71c8c13b70bc1bd1a08d9de8f7e9208532e3f2
TLSH
T1D1F03A0963FC020AF4F34B30B9F6436395A9BC65DE3393ED5440035A6864520C962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

s1m5wum3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\s1m5wum3\s1m5wum3.0.cs
Size 280B
SHA256 878b222250508e936d277f40df22f28d98140fa1849b42cb68c6227b48dfeea0
MD5 9939cd671f6c8c7ed0d372cdec510adc
SHA1 934fa099b6b512df59f439513ac484cec84728b6
SHA512 68516afebf7ce666ebc96cb7b1fe554fb9469242ede484c48697ad8d2d7f9407e396153a26be8b904116dc627159ce55fe75b7da8e274713cbaa96a06d4d15f9
TLSH
T18CD02B1477B3DE74106344168C47E4FCB607512626791A05BAE95310DF8F0099637A19
MD5 SHA1 SHA512 TLSH

Submit Download

s1m5wum3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\s1m5wum3\s1m5wum3.cmdline
Size 369B
SHA256 c02d1090b9552faf7830a4902ca9bc08e4a8aa28b7d3ae7e4f87ead49f15dabb
MD5 626b84e85b97c7195d5210f085c2f759
SHA1 fce31dc244ffeacb9bff73796ea8bd45b7d3d619
SHA512 9b04ff65304e315997afc5cd9404784e8c9d788ea97fd76deb221f76beeda74b4e6e10b6922f17f5d27149f08242ea60ea11e713c1aec300b0fa7a0c969eace4
TLSH
T165E0687FA246C27D01F96407216BD4ECA27206432B69BF947081C40ED41700027E1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2556-36-0x00000227EE100000-0x00000227EE108000-memory.dmp

Download

memory/2556-39-0x00000227EE3B0000-0x00000227EE3CE000-memory.dmp

Download

memory/2556-40-0x00000227EE3D0000-0x00000227EE482000-memory.dmp

Download

memory/2556-41-0x00000227EE490000-0x00000227EE49A000-memory.dmp

Download

memory/2556-42-0x00000227EE620000-0x00000227EE64A000-memory.dmp

Download

memory/2556-43-0x00000227EE620000-0x00000227EE644000-memory.dmp

Download

memory/2568-19-0x000001CE40890000-0x000001CE40898000-memory.dmp

Download

memory/2568-3-0x000001CE40850000-0x000001CE40872000-memory.dmp

Download