Overview

overview

10

Static

static

1

lfbwxecb.bat

windows10-2004-x64

10

lfbwxecb.bat

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    115s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 07:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lfbwxecb.bat
  • Size 15.4MB
  • Sample260704-jtlxvscy2v
  • SHA256 ef07fd45a08d335cb014a643df38662d7ba5f6c4fca3fdb26111f8bbf2a223f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareexecutiondonutloaderloaderpersistenceransomwarespyware

Malware Config

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Detects DonutLoader 1 IoCs
    loader
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

    execution
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3724
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lfbwxecb.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -C "Unblock-File 'C:\Users\Public\lfbwxecb.bat'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5572
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\lfbwxecb.bat" /f
        3⤵
        • Adds Run key to start application
        PID:4468
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\lfbwxecb.bat" /f
        3⤵
        • Adds Run key to start application
        PID:1756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -C "Unblock-File 'C:\Users\Public\lfbwxecb.bat';Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoP','-C','iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5212
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p2y1zozh\p2y1zozh.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4580
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE9EE.tmp" "c:\Users\Admin\AppData\Local\Temp\p2y1zozh\CSC1711470786444FCBB551689A90EFFFA1.TMP"
              6⤵
                PID:4528
    • C:\Windows\System32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\lfbwxecb.bat" /f
      1⤵
      • Adds Run key to start application
      PID:5260
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -C "Unblock-File 'C:\Users\Public\lfbwxecb.bat';Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoP','-C','iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))'"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:360
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iq0pqnn0\iq0pqnn0.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4948
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF279.tmp" "c:\Users\Admin\AppData\Local\Temp\iq0pqnn0\CSC30A5856E8EB840F3A869B7BFFD26AE8.TMP"
            4⤵
              PID:3444
      • C:\Windows\system32\userinit.exe
        C:\Windows\system32\userinit.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1572
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3412
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Public\lfbwxecb.bat" "
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5832
            • C:\Windows\System32\reg.exe
              reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\lfbwxecb.bat" /f
              4⤵
              • Adds Run key to start application
              PID:4476
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoP -C "Unblock-File 'C:\Users\Public\lfbwxecb.bat';Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoP','-C','iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))'"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4372
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2876
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k053k0ti\k053k0ti.cmdline"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3596
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2AA0.tmp" "c:\Users\Admin\AppData\Local\Temp\k053k0ti\CSCE4B798CFD1BE44209EC36B433886FF6B.TMP"
                    7⤵
                      PID:5712
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2620
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5428
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3024
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Checks processor information in registry
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5928
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Public\lfbwxecb.bat" "
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5412
              • C:\Windows\system32\reg.exe
                reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "E" /d "C:\Users\Public\lfbwxecb.bat" /f
                4⤵
                • Adds Run key to start application
                PID:4144
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoP -C "Unblock-File 'C:\Users\Public\lfbwxecb.bat';Start-Process powershell -WindowStyle Hidden -ArgumentList '-NoP','-C','iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))'"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3316
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($env:B64)))
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:6032
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lnsodamy\lnsodamy.cmdline"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5936
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE76.tmp" "c:\Users\Admin\AppData\Local\Temp\lnsodamy\CSC1C5D34B4C7904D2E80F215A355CE54.TMP"
                      7⤵
                        PID:4788
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4980
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5180

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                IconCache.db
                • Path C:\Users\Admin\AppData\Local\IconCache.db
                • Size 12KB
                • SHA256 a4c6f072cfaeac24cd7f2cc9eae74b2eebe50e7d46b0ad1696b9d9785408e77f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DiscoverCacheData.dat
                • Path C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                • Size 1016B
                • SHA256 54277c8180c57b8d3312ef376ede289dfb54eccc4c7297b46e884f76598a4b95
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 61fa021e6fb9bf6e62c66160ca7f4e57206d1371e9779346630293e15afec314
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 0c0236308733cd437634732f61af1affd87d2d91e3c6a64130109a95b7ddb1b1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 144598ea87965a833e5c847b0c3725dee5fd45304ea32c04cc6080f73f537503
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 433e2ebbae61643de3ec2d4afd473a5484cf30f032e366ee653b01710c93ba5b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 3dfa24eadb59990efaa14de2b904b2be69762768dc33c92aeb636810937e6ba0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 eeca49f740c746bc6b274cc683414565f6ac67fb4fa9e4c677896696d5e05dbe
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                start2.bin
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin
                • Size 3KB
                • SHA256 843e2c1ce9180f30d8f1eac8a478bdb8e1ee31da02f10934ecede135d6655be6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 595B
                • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                microsoftwindows.client[1].xml
                • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\V4MNWCSO\microsoftwindows.client[1].xml
                • Size 96B
                • SHA256 8015849c195f71b876b56c6067072343dade366ca524df0409d8190af69fa73d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                RES2AA0.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RES2AA0.tmp
                • Size 1KB
                • SHA256 eb31d70c960cf04960b738d45f700a28c251eccde28aa649c8f2086da091b3b2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                RESAE76.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RESAE76.tmp
                • Size 1KB
                • SHA256 15284464320c278f75f6c2259c45e16b655d9a6b682c136b7402ff4b183e3b40
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                RESE9EE.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RESE9EE.tmp
                • Size 1KB
                • SHA256 8dfe5f07e43e2178823c1f77d25f02bc32a283379e1fee0adbee1aacda5cc9ad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                RESF279.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RESF279.tmp
                • Size 1KB
                • SHA256 e51c34eacafd490794a1588027534d325c16e07af3de7b5d37fd5252e7813024
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_4ds3bmvu.db3.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ds3bmvu.db3.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                iq0pqnn0.dll
                • Path C:\Users\Admin\AppData\Local\Temp\iq0pqnn0\iq0pqnn0.dll
                • Size 4KB
                • SHA256 adfc0a2f00ca5c3c60f319096683f590f6a59829b7a82ea49e2f33d430374ecd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                k053k0ti.dll
                • Path C:\Users\Admin\AppData\Local\Temp\k053k0ti\k053k0ti.dll
                • Size 4KB
                • SHA256 323c003d45c02727df525a434b32d4309955211c2d5c1acb1641156dcacf17d7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                lnsodamy.dll
                • Path C:\Users\Admin\AppData\Local\Temp\lnsodamy\lnsodamy.dll
                • Size 4KB
                • SHA256 69293f28cdc8d53f819008ece142a3d611319783c52400c5bd602fffad16072b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                p2y1zozh.dll
                • Path C:\Users\Admin\AppData\Local\Temp\p2y1zozh\p2y1zozh.dll
                • Size 4KB
                • SHA256 55e20c6a6fa81a475d177e4a64972ebc7b362c1748ab037350f3cc70680d2f55
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CSC30A5856E8EB840F3A869B7BFFD26AE8.TMP
                • Path \??\c:\Users\Admin\AppData\Local\Temp\iq0pqnn0\CSC30A5856E8EB840F3A869B7BFFD26AE8.TMP
                • Size 652B
                • SHA256 ab45e7d390f111eaf87115617f7293d725c756002b65a2c7450bcb019d3ebbb0
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                iq0pqnn0.cmdline
                • Path \??\c:\Users\Admin\AppData\Local\Temp\iq0pqnn0\iq0pqnn0.cmdline
                • Size 369B
                • SHA256 11e79707610148423ce4ad6e9dbe1fe3912908531746b0c809a33d349a5b8912
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CSCE4B798CFD1BE44209EC36B433886FF6B.TMP
                • Path \??\c:\Users\Admin\AppData\Local\Temp\k053k0ti\CSCE4B798CFD1BE44209EC36B433886FF6B.TMP
                • Size 652B
                • SHA256 97ddd669a9c854aa69e9e854e8e4bdd1aa586175afc77a82fc8e5941965fa8c4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                k053k0ti.cmdline
                • Path \??\c:\Users\Admin\AppData\Local\Temp\k053k0ti\k053k0ti.cmdline
                • Size 369B
                • SHA256 f189c6af39db7b6c2ebad7860f818b911d81766dc9fbcc78c5e48e8139899aaf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CSC1C5D34B4C7904D2E80F215A355CE54.TMP
                • Path \??\c:\Users\Admin\AppData\Local\Temp\lnsodamy\CSC1C5D34B4C7904D2E80F215A355CE54.TMP
                • Size 652B
                • SHA256 d483902dee0c4ee5286d80a24850df714190a7e9401838ae0e992be079b0f791
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                lnsodamy.cmdline
                • Path \??\c:\Users\Admin\AppData\Local\Temp\lnsodamy\lnsodamy.cmdline
                • Size 369B
                • SHA256 8ddd76624df742d1f587ea58bc1409f9977a798543057e9e6b64cff6f8e2a87b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CSC1711470786444FCBB551689A90EFFFA1.TMP
                • Path \??\c:\Users\Admin\AppData\Local\Temp\p2y1zozh\CSC1711470786444FCBB551689A90EFFFA1.TMP
                • Size 652B
                • SHA256 22388cfe1280808907df744440e8d5d0915c9742186e2f4af1da7b8a7634752b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                p2y1zozh.0.cs
                • Path \??\c:\Users\Admin\AppData\Local\Temp\p2y1zozh\p2y1zozh.0.cs
                • Size 964B
                • SHA256 5672a67ef31571d2d82ba04187ba9e3569ba39bb5b9a4e345a5b5f87275148b1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                p2y1zozh.cmdline
                • Path \??\c:\Users\Admin\AppData\Local\Temp\p2y1zozh\p2y1zozh.cmdline
                • Size 369B
                • SHA256 d8b132f738cfc6d26ca83e54c533a6c0cc3902797df249544ea9d6826278688d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/360-64-0x00000170CF8A0000-0x00000170CF8A8000-memory.dmp
                Download

                memory/2620-103-0x0000021C03E40000-0x0000021C03F40000-memory.dmp
                Download

                memory/2620-92-0x0000021C001E0000-0x0000021C002E0000-memory.dmp
                Download

                memory/2620-138-0x0000021C14260000-0x0000021C14280000-memory.dmp
                Download

                memory/2620-117-0x0000021C03CA0000-0x0000021C03CC0000-memory.dmp
                Download

                memory/2620-102-0x0000021C03C80000-0x0000021C03CA0000-memory.dmp
                Download

                memory/2876-268-0x00000184C1950000-0x00000184C1958000-memory.dmp
                Download

                memory/3312-25-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-16-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-11-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-12-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-17-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-18-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-19-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-20-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-23-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-21-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3312-22-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/3412-271-0x00000000111B0000-0x0000000013D8E000-memory.dmp
                Download

                memory/3412-272-0x0000000003FE0000-0x0000000003FE1000-memory.dmp
                Download

                memory/3596-266-0x000001EEB6610000-0x000001EEB6FB4000-memory.dmp
                Download

                memory/3724-66-0x000000005B7C0000-0x000000005E39E000-memory.dmp
                Download

                memory/3724-71-0x0000000001310000-0x0000000001311000-memory.dmp
                Download

                memory/3724-68-0x00000000013B0000-0x00000000013B1000-memory.dmp
                Download

                memory/3724-42-0x000000000F710000-0x0000000010294000-memory.dmp
                Download

                memory/3724-44-0x00000000114E0000-0x00000000140BE000-memory.dmp
                Download

                memory/4980-280-0x00000274801E0000-0x00000274802E0000-memory.dmp
                Download

                memory/4980-287-0x0000027483E50000-0x0000027483F50000-memory.dmp
                Download

                memory/4980-327-0x0000027494210000-0x0000027494230000-memory.dmp
                Download

                memory/4980-286-0x0000027483A30000-0x0000027483A50000-memory.dmp
                Download

                memory/4980-296-0x0000027483C90000-0x0000027483CB0000-memory.dmp
                Download

                memory/5212-41-0x0000025A1C990000-0x0000025A1C998000-memory.dmp
                Download

                memory/5572-8-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/5572-0-0x00007FF80CB6F000-0x00007FF80CB70000-memory.dmp
                Download

                memory/5572-10-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/5572-192-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/5572-7-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/5572-6-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/5572-5-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/5572-3-0x00000180987D0000-0x00000180987F2000-memory.dmp
                Download

                memory/5572-4-0x00007FF80C9E0000-0x00007FF80D384000-memory.dmp
                Download

                memory/5928-469-0x0000000010C90000-0x000000001386E000-memory.dmp
                Download

                memory/5936-463-0x00000263FCAB0000-0x00000263FD454000-memory.dmp
                Download

                memory/6032-465-0x000002A9DEDE0000-0x000002A9DEDE8000-memory.dmp
                Download