ffb0aa5af7b463161b622c3e07a0ffc9eae9c276b0b8c405746f4a1e450be07c

Analysis

max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install_Task_KMSServersManager.cmd
Size 2KB
Sample260930-clq4aat19j
SHA256 ffb0aa5af7b463161b622c3e07a0ffc9eae9c276b0b8c405746f4a1e450be07c
MD5 78ea96b349c55050f0aee8581bb4b3eb
SHA1 fb5dd1af205bba01f0416f6fe7f9a35d9f319812
SHA512 b9a5b1247379ded2864d64369cc21d3f08cf1a4f399420fd463fa1fadfb22a7d5e1d700d17bdc16e0130474ef09f156edcad5bb835a5652820ce0bbc2eacc8bd
TLSH
T133514346216682870075B377AB013D67BF8D81BF2B68D39833A5147D32DF10593E97D9
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3608	vlmcs.exe
5452	vlmcs.exe

Loads dropped DLL 5 IoCs

pid	Process
3608	vlmcs.exe
3608	vlmcs.exe
3608	vlmcs.exe
5452	vlmcs.exe
5452	vlmcs.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe
4056	cmd.exe
2516	cmd.exe
3496	cmd.exe
4976	cmd.exe
888	cmd.exe
4136	cmd.exe
1888	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vlmcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vlmcs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlmcs.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1160	PING.EXE

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings\Enabled = "1"	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1160	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2480	schtasks.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	5332	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5332	WMIC.exe
Token: SeSecurityPrivilege	5332	WMIC.exe
Token: SeTakeOwnershipPrivilege	5332	WMIC.exe
Token: SeLoadDriverPrivilege	5332	WMIC.exe
Token: SeSystemtimePrivilege	5332	WMIC.exe
Token: SeBackupPrivilege	5332	WMIC.exe
Token: SeRestorePrivilege	5332	WMIC.exe
Token: SeShutdownPrivilege	5332	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5332	WMIC.exe
Token: SeUndockPrivilege	5332	WMIC.exe
Token: SeManageVolumePrivilege	5332	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	5332	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5332	WMIC.exe
Token: SeSecurityPrivilege	5332	WMIC.exe
Token: SeTakeOwnershipPrivilege	5332	WMIC.exe
Token: SeLoadDriverPrivilege	5332	WMIC.exe
Token: SeSystemtimePrivilege	5332	WMIC.exe
Token: SeBackupPrivilege	5332	WMIC.exe
Token: SeRestorePrivilege	5332	WMIC.exe
Token: SeShutdownPrivilege	5332	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5332	WMIC.exe
Token: SeUndockPrivilege	5332	WMIC.exe
Token: SeManageVolumePrivilege	5332	WMIC.exe
Token: SeRestorePrivilege	3608	vlmcs.exe
Token: SeBackupPrivilege	3608	vlmcs.exe
Token: SeDebugPrivilege	3608	vlmcs.exe
Token: SeRestorePrivilege	5452	vlmcs.exe
Token: SeBackupPrivilege	5452	vlmcs.exe
Token: SeDebugPrivilege	5452	vlmcs.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2064	4800	cmd.exe	86
PID 4800 wrote to memory of 3272	4800	cmd.exe	87
PID 4800 wrote to memory of 6060	4800	cmd.exe	88
PID 4800 wrote to memory of 4964	4800	cmd.exe	89
PID 4800 wrote to memory of 2480	4800	cmd.exe	90
PID 4800 wrote to memory of 1104	4800	cmd.exe	92
PID 4800 wrote to memory of 2516	4800	cmd.exe	94
PID 4056 wrote to memory of 5600	4056	cmd.exe	96
PID 4056 wrote to memory of 3496	4056	cmd.exe	97
PID 4056 wrote to memory of 4976	4056	cmd.exe	98
PID 4056 wrote to memory of 888	4056	cmd.exe	101
PID 4056 wrote to memory of 4136	4056	cmd.exe	102
PID 4136 wrote to memory of 5332	4136	cmd.exe	103
PID 4056 wrote to memory of 1668	4056	cmd.exe	105
PID 4056 wrote to memory of 1160	4056	cmd.exe	106
PID 4056 wrote to memory of 1604	4056	cmd.exe	107
PID 4056 wrote to memory of 3964	4056	cmd.exe	108
PID 4056 wrote to memory of 3608	4056	cmd.exe	109
PID 4056 wrote to memory of 5452	4056	cmd.exe	117
PID 4056 wrote to memory of 4180	4056	cmd.exe	119
PID 4056 wrote to memory of 316	4056	cmd.exe	120
PID 4056 wrote to memory of 1192	4056	cmd.exe	121
PID 4056 wrote to memory of 5028	4056	cmd.exe	122
PID 4056 wrote to memory of 4972	4056	cmd.exe	123
PID 4056 wrote to memory of 5088	4056	cmd.exe	124
PID 4056 wrote to memory of 436	4056	cmd.exe	125
PID 4056 wrote to memory of 1004	4056	cmd.exe	126
PID 4056 wrote to memory of 2976	4056	cmd.exe	127
PID 4056 wrote to memory of 3316	4056	cmd.exe	128
PID 4056 wrote to memory of 1888	4056	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_Task_KMSServersManager.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" query "HKU\S-1-5-19"
  2⤵
  PID:3272
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /end /tn "KMSServersManager"
  2⤵
  PID:6060
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /delete /tn "KMSServersManager" /f
  2⤵
  PID:4964
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /create /tn "KMSServersManager" /xml "C:\ProgramData\KMSServersManager\KMSServersManager.xml"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2480
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn "KMSServersManager"
  2⤵
  PID:1104
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit /b 0
  2⤵
  - Executes a command shell one-liner
  PID:2516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\ProgramData\KMSServersManager\KMSServersManager.cmd" /e /l
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /b /s /a-d "C:\Program Files\Microsoft Office\ospp.vbs" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "wmic.exe Path Win32_OperatingSystem Get Caption /Value" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic.exe Path Win32_OperatingSystem Get Caption /Value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" query "HKU\S-1-5-19"
  2⤵
  PID:1668
- C:\Windows\system32\PING.EXE
  "C:\Windows\system32\ping.exe" -n 1 google.com
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1160
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies data under HKEY_USERS
  PID:1604
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "1" /f
  2⤵
  PID:3964
- C:\ProgramData\KMSServersManager\vlmcs.exe
  "C:\ProgramData\KMSServersManager\vlmcs.exe" -l 1 -p 192.168.100.2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\ProgramData\KMSServersManager\vlmcs.exe
  "C:\ProgramData\KMSServersManager\vlmcs.exe" -l 1 -p vlm.freemyip.com:43615
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5452
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f
  2⤵
  PID:4180
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f
  2⤵
  PID:316
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ"
  2⤵
  PID:1192
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ"
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD"
  2⤵
  PID:4972
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55C92734-D682-4D71-983E-D6EC3F16059F" /f /reg:32
  2⤵
  PID:5088
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0FF1CE15-A989-479D-AF46-F275C6370663" /f /reg:32
  2⤵
  PID:436
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /d "vlm.freemyip.com" /t "REG_SZ" /reg:32
  2⤵
  PID:1004
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /d "43615" /t "REG_SZ" /reg:32
  2⤵
  PID:2976
- C:\Windows\system32\reg.exe
  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v "UserOperations" /d "1" /t "REG_DWORD" /reg:32
  2⤵
  PID:3316
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c exit /b 0
  2⤵
  - Executes a command shell one-liner
  PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KMSServers.ini

Path C:\ProgramData\KMSServersManager\KMSServers.ini
Size 23KB
SHA256 8d13ef1bd4355df7d4c6139371b09b15ee13270d314acfa5420a8fe447c5e54d
MD5 71399732601f0087fa0561ea0a0bafee
SHA1 7ce58d6d12694914f08e5fe386be3e125b757fc9
SHA512 c5212336e2a90066e0a069895bfcfc429311918073ff22d172ae0fc5c4041ab625a898b45323fbc1230f68ed6b75d57f994090141d6fd43c9a0cdf4be37c1ccd
SSDEEP 384:fYnvSCi2Qp6iTSx+K4UWbZbjemdRho92mIHREHu3I/4mozYPWbp8Rd8o0s8hK6:A6i06iTSJQeKRho9A3I/OzYP7r07
TLSH
T1D8B23C8A47A251A141773ED5C88A6E83BF7B41374DA7A12206AE8433BDF1507B7F2DC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSServersManager.cmd

Path C:\ProgramData\KMSServersManager\KMSServersManager.cmd
Size 13KB
SHA256 ad9879857a02474a6b392a87376b8e8432068f26677416a92057581cf052c89e
MD5 fbdfc905c71a57f06c2b97b17d943229
SHA1 6de22867edc18beecc70b484ac7caae26f547da3
SHA512 65368e30a05525507f0bd602db1185d68a3c9df7ca7c73dae8fa626d5eb9d3767c7e1c92410c8c75cb24e8d80aa2b548fce828f7e5513e2288dbb14ee4979648
SSDEEP 192:wyxVcF3JBkW3bOZnZ8FYPJSDlXrCse77J4mFwQClajohL41hin40Cgi/U0+cNX/8:3IOZRxdYqWWin45/UMXnYoqoAz
TLSH
T1025295442C4982A710B8F3B26E0154477BDF41FF2A76CBE832915499B7DE62583BE3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMSServersManager.xml

Path C:\ProgramData\KMSServersManager\KMSServersManager.xml
Size 3KB
SHA256 bd3d0d72ea6d7eee0c7238da737b4627783b8363e3d1192377632bb1da3de3dd
MD5 aee44e9d4d9521ce65a8d6a14e0a864b
SHA1 dc2d5315fd8cfbd3a6474ee69ee5d8feba930ad0
SHA512 e8388d59562c19664857c452d2aa98818f7db320549bbbf172e6dff2afb898896d5792a16ca99b4c04575c0a5ad30a56e37e4a9bbe2c745a3acd1ca582144e50
TLSH
T19681584767EA1109F1F36B6CAEB750228E63BD415D39C86D00AC240DCBF3E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

cyggcc_s-1.dll

Path C:\ProgramData\KMSServersManager\cyggcc_s-1.dll
Size 108KB
SHA256 0aa9dba17c91e94178aef17953bca88db60e4b27afeceb2a3826a268e4bc0205
MD5 9ac4cda1b5082732d14b725fd28c7df4
SHA1 9e11a8308f6eeedf00be244bacd4e52b713bb151
SHA512 a09f7160fbe7c46751a639c8762ffa737e767ce9c95b1c28d59c07f7dc66f8bf75a716da1fbd4f02cc6282be6afbf4986a865c9a62daaca62d56a70369430d65
SSDEEP 1536:o4iwultju4/8/bIag/5UMInQ0MVnkY0OwXVv2Ve5xsBg:oqmt64/IIag/pTVnc2oHsBg
TLSH
T190B32950FA8B10E5D45779B051A7A73F9E343E160034EEB9FF89E75BE532702B12920A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\ProgramData\KMSServersManager\cygwin1.dll
Size 3.3MB
SHA256 7203f05765c21579807d425714d29a3022e6e045a5e1925c62fbb6f670baa420
MD5 a51d350f4b983320cd6a9c85009da952
SHA1 3b3d4722081ea9513c318874ac06cda44c0bd3a5
SHA512 d06b26105884b9e671ee338ff907c82c8611366ac0b3c3a0565745dd79c9acb20b8af4c4cdf52fa34cdcca64c650146ecdcfb2edecd1f2d78a04b465fa57552b
SSDEEP 98304:cy8gHq7TRGKZrJj//xJjaeBtfklfMdgYLe1u4CUb8bA/PRbRLhAZ:cy8hDHB+lfM3
TLSH
T13FF57B4CE6CB54F6DD5B5AB0A19BF32F13346B10C275CF97EA4859A2EE23F825502B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slmgr.vbs

Path C:\ProgramData\KMSServersManager\slmgr.vbs
Size 139KB
SHA256 979f47658a89e046ce53de7dda6546f875e28c64baf062259c2081dc528ac1ec
MD5 dcd756179438b61e424d8d004d54322e
SHA1 34d1a689dcbea063289f81c34d989864a2522b44
SHA512 1102a227981da0a8c9e8d5297813ce40c12362fe54f365766dcb113ec3ff33534bcd22ca812b9a39dd69f6f26007adb57c3356153a991b7ffb4201b44cfd966d
SSDEEP 768:hJXCCUMrsH5J91uCY7EOtn4i7CWJiFNNpnd/gGwlypxIRjSXisSni/HvQiidK2:yCQf147Xt1wbsSXiMvQiih
TLSH
T117D34083FA07A0F5E8BA1673BD2B629EFFA4109704645800FE8D48491FB669DD37079D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlmcs.exe

Path C:\ProgramData\KMSServersManager\vlmcs.exe
Size 53KB
SHA256 21dda576a2f67c10f8c3e396e490cfd59d7b3c4578fe749adee81e4167009b0f
MD5 b25ebd521d647ac7eb4a8ac43f5032d3
SHA1 f6fe635d0dc2dcc0cd7e4852a497403fb6b3a998
SHA512 72458ca3a1261ec12c256833ab120acc3979fe21f2bb36a9ad71c9776df9504be000327b1c4fa909d8b0e756f419d26712d13cd75d9a9c0457f913c26b51c394
SSDEEP 768:noAN+L2/NAk4Mrem9R+LZbHSsc+G/WRGHU3Kd1nVvd4yxBHooooooooooooooooZ:7NAw65ysNG/WRGftaPW
TLSH
T179334A8AB7D3E0B1E47B01F0049F9B3FD776B11461A2C712FA5D84549FC2663629BAC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wct999B.tmp

Path C:\ProgramData\KMSServersManager\wct999B.tmp
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
TLSH
T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3608-135-0x0000000000C60000-0x0000000001150000-memory.dmp

Download

memory/3608-134-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/3608-136-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/3608-137-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3608-138-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/3608-140-0x0000000000C60000-0x0000000001150000-memory.dmp

Download

memory/3608-145-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/3608-146-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

memory/5452-150-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/5452-152-0x000000006FC40000-0x000000006FC62000-memory.dmp

Download

memory/5452-151-0x0000000061000000-0x00000000614F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads