8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/10/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
limclean.bat
Size 6.1MB
Sample261005-p5btxstblc
SHA256 8ad1e81b511ad76a0dca74d39d82b8d7932d584d2047fb602b1ae4dd2eb6bada
MD5 8a9ff886cb5880ed2e2345cb3948c73f
SHA1 cf902893a232de1c4e07b3d207e2fba81bf4aedf
SHA512 538c3993a5a800cdb6ddae9c2927dd1cb53169623b2d51e9a6c78acda6b55115495be066c2bf03bf09e69204da4e45bad06ee83aad2d3ed99f28572bbc5052dc
SSDEEP 49152:VbQ8XLQygKiRO5FzresM8c/9uWBVPH1FBfB+ZevBcF7rIvBKBR3Z:P
TLSH
T19356140E7E4C1656CF2165FF702E8F09767204CB0A61AC50BD67796AADEA7C0B10C9E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\_Microsoft67"	adv4iqbsd1fsq59w.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3564	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	tmp511F.tmp.exe

Executes dropped EXE 2 IoCs

pid	Process
5084	tmp511F.tmp.exe
3040	adv4iqbsd1fsq59w.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3484	certutil.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
58	api.ipify.org
59	api.ipify.org

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\_Microsoft67	adv4iqbsd1fsq59w.exe
File opened for modification	C:\Windows\_Microsoft67	adv4iqbsd1fsq59w.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
812	cmd.exe
4808	cmd.exe
4264	cmd.exe
1388	cmd.exe
2300	cmd.exe
4012	cmd.exe
5068	cmd.exe
372	cmd.exe
4452	cmd.exe
5616	cmd.exe
5252	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	adv4iqbsd1fsq59w.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	adv4iqbsd1fsq59w.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1600	PING.EXE
4584	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1416	timeout.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1600	PING.EXE
4584	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
556	schtasks.exe
5844	schtasks.exe
4064	schtasks.exe
5256	schtasks.exe
456	schtasks.exe
2896	schtasks.exe
1216	schtasks.exe
5216	schtasks.exe
2948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
3564	powershell.exe
3564	powershell.exe
3564	powershell.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe
3040	adv4iqbsd1fsq59w.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3040	adv4iqbsd1fsq59w.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3484	4808	cmd.exe	108
PID 4808 wrote to memory of 3564	4808	cmd.exe	109
PID 4808 wrote to memory of 1416	4808	cmd.exe	110
PID 3564 wrote to memory of 5084	3564	powershell.exe	112
PID 5084 wrote to memory of 372	5084	tmp511F.tmp.exe	113
PID 5084 wrote to memory of 3040	5084	tmp511F.tmp.exe	115
PID 372 wrote to memory of 5340	372	cmd.exe	116
PID 372 wrote to memory of 1600	372	cmd.exe	117
PID 372 wrote to memory of 4584	372	cmd.exe	118
PID 3040 wrote to memory of 5076	3040	adv4iqbsd1fsq59w.exe	121
PID 3040 wrote to memory of 4264	3040	adv4iqbsd1fsq59w.exe	122
PID 4264 wrote to memory of 5216	4264	cmd.exe	125
PID 3040 wrote to memory of 1388	3040	adv4iqbsd1fsq59w.exe	126
PID 1388 wrote to memory of 456	1388	cmd.exe	128
PID 3040 wrote to memory of 4452	3040	adv4iqbsd1fsq59w.exe	129
PID 4452 wrote to memory of 2948	4452	cmd.exe	131
PID 3040 wrote to memory of 2300	3040	adv4iqbsd1fsq59w.exe	132
PID 2300 wrote to memory of 556	2300	cmd.exe	134
PID 3040 wrote to memory of 4012	3040	adv4iqbsd1fsq59w.exe	135
PID 4012 wrote to memory of 5844	4012	cmd.exe	137
PID 3040 wrote to memory of 5068	3040	adv4iqbsd1fsq59w.exe	138
PID 5068 wrote to memory of 2896	5068	cmd.exe	140
PID 3040 wrote to memory of 5616	3040	adv4iqbsd1fsq59w.exe	141
PID 5616 wrote to memory of 1216	5616	cmd.exe	143
PID 3040 wrote to memory of 5252	3040	adv4iqbsd1fsq59w.exe	144
PID 5252 wrote to memory of 4064	5252	cmd.exe	146
PID 3040 wrote to memory of 812	3040	adv4iqbsd1fsq59w.exe	147
PID 812 wrote to memory of 5256	812	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\limclean.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\xdzl.b64" "C:\Users\Admin\AppData\Local\Temp\dbvx.ps1"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:3484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoP -NonI -W Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\dbvx.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\tmp511F.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp511F.tmp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bnd_6ec476db\limfucker.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:372
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:5340
    - - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1600
    - - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\bnd_6ec476db\adv4iqbsd1fsq59w.exe
      "C:\Users\Admin\AppData\Local\Temp\bnd_6ec476db\adv4iqbsd1fsq59w.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" netsh advfirewall firewall add rule name="XuSb8Gp@8Sk>8Z" dir=in action=allow program="C:\Windows\_Microsoft67" enable=yes & exit
        5⤵
        
        PID:5076
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4264
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5216
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1388
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:456
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2948
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2300
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:556
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4012
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5844
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5068
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2896
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5616
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1216
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5252
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4064
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:812
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5256
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_zeqg2l51.zw2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zeqg2l51.zw2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

adv4iqbsd1fsq59w.exe

Path C:\Users\Admin\AppData\Local\Temp\bnd_6ec476db\adv4iqbsd1fsq59w.exe
Size 658KB
SHA256 02d9edc6990f982dd15e24e18da4d948cf4aca843fbef57a66b681d887fa9f60
MD5 315714d5b53a7f77abaceb7de879ace8
SHA1 679a5680bd09a0013d698470b6bfc4bbd2d8efd8
SHA512 289e69e3a125f54dce300c88efd2b20241f0a84659c0f0c548f86604d23b4323a0d0ac9dc23722886babfc6b2af906aa5dbcbd2e13f88d87e3992f562772517d
SSDEEP 6144:MWwPRgWXrc4JNiUl8gcFSqsFwJtZTLYtwWwA+xBr1F4PckJlZZQsEeRr5mppbWf5:URPrc4XtilNr1FERZBrUpdEeks2pI6
TLSH
T1A3E4B5253B959E11E841163EC6BE2618D73260F22712AB47370BF7614D44AFEED2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

limfucker.bat

Path C:\Users\Admin\AppData\Local\Temp\bnd_6ec476db\limfucker.bat
Size 4KB
SHA256 d65bae84f5db96692e61f0c11fa14d33a738a2eeaddf945459ea5714e2c3809d
MD5 3bfc384f368049fbeb9fa8593590ccf4
SHA1 f49749b2fd06f363eac19d0d29705876eba6c26e
SHA512 051059d02868adf5ff9b1f3074bc0a885cca92ef2c2e7724f870515120daa957946919bc3bd3998936dbc3072a1df62af04b50f6b01b6d6ff0ddc26ad4bc989e
SSDEEP 96:8xbaF8FGfdYjlOBoCM9ogq3Lsq9x2E3RdI5uFHuzp/kCEMX1WjsTe3exvR:wzltCM9m3Lsq9dXIhzdkCEMX1Wjs6OD
TLSH
T11991F2567C1DADEA6272E18288B0548AFE55C69F2F1B2EC834DF417E73423C1925C1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvx.ps1

Path C:\Users\Admin\AppData\Local\Temp\dbvx.ps1
Size 3.7MB
SHA256 fee9a8f12119cad8743552d79a48ed670a0823bdcc66970f01db5251641e225b
MD5 8c1b875dd08490ea99edc0b6f29e3321
SHA1 351423011ec3b25c1822596f75af985f9f057f9f
SHA512 180ad24c467f043b01164cb8a74038a7b957e047c04dcba27860c2cc41f31c1cad21cb6e0b79af6e07c74e89410ee0e4897878b2a0f9b1f0c125ee86fa626f3a
SSDEEP 49152:dOA7w2AxBCpk7ybRtoi/YEklJBVITQ1gC5megtNbujqRzhqdPYmaqYfx1nKXBNa/:/
TLSH
T1F106128B4B2E9F9B1820387F7D21389659DCCCCCD5A8D2D0EB835D26F158D2D22B9B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp511F.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp511F.tmp.exe
Size 2.7MB
SHA256 b6a657a8c0ecc15a4fefdcdc35ca990e90c854c7b911d7a5c5ebea311164c1f0
MD5 c0bfbaea49f9529f1f7305b2b27a1cee
SHA1 84f4bfda1a1bb59540e29b773b7a42e8f9754ecf
SHA512 0a5a91dac1e6e0fdb5adaf84533ce762cd44d81920e9d08211852f34e11fab065eb13ec70670606c710cd5c88f83cf0ec0cf693e8fc7f8e8c3267ba9cced108d
SSDEEP 49152:DbBxckwJ6LYB3lmQ6l943I/LevEh1sGM8YsY5W:4brB3G9D/LTh1sGM8AW
TLSH
T16ED5D0253B959E01E541163EC6BE2618D73260F22312AB47370BFB614D45AFEDD2C3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdzl.b64

Path C:\Users\Admin\AppData\Local\Temp\xdzl.b64
Size 4KB
SHA256 fc2bcf0c7e13a677ebcb9eaf767d310826b31cc6f4c265b12ff8b98bf5d86847
MD5 00ef9d354741676800ee3826c62748fc
SHA1 1c39c67d2fd53f1c33fa389903a28d17e5436b80
SHA512 7ce1a965ad9eac38a46af33d25ad849d14e2aa25c118ce3dc8c47a4bcabd5acb2a5f67388882ed6f0c480576a22800317180199424781d26df46003c3cf3a3a2
SSDEEP 96:nNoDGfWFtOkfkTt2S0ecNgPe8tTzwq2ZvO7NJ/WTRNXaKAcOb:niDmmfkTt2TeHm8tPwqCvWNJGRNqxF
TLSH
T17D916C8DE717EB83D2B4CD5971136257203464D03A2368AD16ADF868937BA1B0EE8C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdzl.b64

Path C:\Users\Admin\AppData\Local\Temp\xdzl.b64
Size 5.0MB
SHA256 7ac23b28bb8782091b6927c8b13d4792b8720fab3902d2fa6dbc35c19d33ecf0
MD5 6a11a403e57e49b1c9c54946e837d6f9
SHA1 5faee8238b3684d349a155e0c4b98adf6cdcde71
SHA512 a56adc8e986c2ef21bbe38b0be816388f697b3ff7bf6c4aed6b44a8fbf13194078645cfd905b17e30d424d23b21465854c91b15a9c71be3dd641f65bd782dc18
SSDEEP 49152:W3+IFzTa0i+WnMf/hZOQCyYz7qOB1jsYvv3z954RAPKPDirUfr9h:E
TLSH
T15736F11623992FDF8964663DE13421198BE0041A5DB6235DBBE3EE0FFFEAD0C0916479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3040-67555-0x0000028DBD370000-0x0000028DBD416000-memory.dmp

Download

memory/3564-67517-0x0000019026F70000-0x0000019026F80000-memory.dmp

Download

memory/3564-67528-0x0000019026F70000-0x0000019026F80000-memory.dmp

Download

memory/3564-67526-0x0000019026EB0000-0x0000019026ED2000-memory.dmp

Download

memory/3564-67518-0x0000019026F70000-0x0000019026F80000-memory.dmp

Download

memory/3564-67558-0x0000019026F70000-0x0000019026F80000-memory.dmp

Download

memory/5084-67540-0x0000000000750000-0x00000000007FE000-memory.dmp

Download