lxbaserat | 9f3a86b405215f41fbead814db46b71b70fdc6d3be85d8e0a963914642335f31

Analysis

max time kernel
299s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
__t_s_ p__sf____ a___ 57608_.js
Size 806KB
Sample260807-ld4tva1gnc
SHA256 9f3a86b405215f41fbead814db46b71b70fdc6d3be85d8e0a963914642335f31
MD5 7a3996eba75ce9f012592fccd6138c48
SHA1 274198c2e26ad353950ee7d8255170b9f435821c
SHA512 3b5b07cdb7962ba0712fac1323030a7653f279e0290f704dc25d5bba5d6523dfc23853e9bca8a16251e03a981405e6fd8c17ec1511d6646cc45f2ba37e1c0407
SSDEEP 24576:m+Cv6yC/nEgYIs4kS5NYYxAEyjMcH2uTxikx/4svsXBmNrnhAc:d+6t/nDVb5xyjMckkx/cXBUrnhX
TLSH
T123055C1341998D2C0AD9F1E11D2784C933DF65F2A0E98AC0129EC733B69A97ADDFB171
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 1a83f37a318549ff9e552cad18eceb6d collection discovery execution lxbaserat persistence rat upx

Malware Config

Extracted

Family

lxbaserat

Version

1.0.24

Botnet

Group1

Campaign

1a83f37a318549ff9e552cad18eceb6d

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
hCeWS8Uz8SJ6ASPT2fef

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3480	powershell.exe
5528	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1440	msvc_39577b6f.exe

Loads dropped DLL 1 IoCs

pid	Process
4788	chrome.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3832	wscript.exe
5072	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3480 set thread context of 4792	3480	powershell.exe	95

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0004000000008f2c-61.dat	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	MSBuild.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4792	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3480	powershell.exe
3480	powershell.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
5528	powershell.exe
5528	powershell.exe
5528	powershell.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe
4792	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4792	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	4792	MSBuild.exe
Token: SeDebugPrivilege	5528	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4792	MSBuild.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3832	916	wscript.exe	90
PID 3832 wrote to memory of 3480	3832	wscript.exe	91
PID 3480 wrote to memory of 6092	3480	powershell.exe	93
PID 6092 wrote to memory of 4452	6092	csc.exe	94
PID 3480 wrote to memory of 4792	3480	powershell.exe	95
PID 3480 wrote to memory of 4792	3480	powershell.exe	95
PID 3480 wrote to memory of 4792	3480	powershell.exe	95
PID 3480 wrote to memory of 4792	3480	powershell.exe	95
PID 4792 wrote to memory of 4788	4792	MSBuild.exe	97
PID 4792 wrote to memory of 2104	4792	MSBuild.exe	98
PID 2104 wrote to memory of 3300	2104	csc.exe	100
PID 4792 wrote to memory of 1440	4792	MSBuild.exe	101
PID 4792 wrote to memory of 4836	4792	MSBuild.exe	105
PID 4836 wrote to memory of 5072	4836	WScript.exe	107
PID 5072 wrote to memory of 5528	5072	wscript.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\__t_s_ p__sf____ a___ 57608_.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\gzzxstf7\net_106884_60bd.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\gzzxstf7\log_26807_608f.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3fcxsk3r\3fcxsk3r.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E28.tmp" "c:\Users\Admin\AppData\Local\Temp\3fcxsk3r\CSC8B05BC5560394EDB8DF4FDE55E1D7B9B.TMP"
        5⤵
        
        PID:4452
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      outlook_office_path
      PID:4792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Loads dropped DLL
        
        PID:4788
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\msvc_39577b6f.exe" "C:\Users\Admin\AppData\Local\Temp\msvc_39577b6f.cs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES420B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8D9F30F225AC47239B78874B896B257.TMP"
        6⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\msvc_39577b6f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc_39577b6f.exe" 4788 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\mojo.21135.410.B7C0.chrome"
        5⤵
        Executes dropped EXE
        
        PID:1440
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LX_Bjr5GwJlA0l--0.js"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4836
      - C:\Windows\SysWOW64\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\424cstif\net_40169_bada.vbs"
        6⤵
        Executes a VBScript file via the Windows Script Host.
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\424cstif\tmp_97129_bac0.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5528

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PhotoStudio.vbs

Path C:\Users\Admin\AppData\Local\Microsoft\PhotoEngine\PhotoStudio.vbs
Size 148B
SHA256 0c5d2af482d9eb35b077baa5407ac27776195a633ca72dafa55e81a78f7be0cf
MD5 4af25f78646b3fab604bde092251d620
SHA1 18d0225e728a58153b23bbfc880f4aa779170f19
SHA512 46aca75723ccad0dbb9c9b10c389a01d817d4862e7d702924c65bdc175923bbe6ea8b3ebc51ba8a881f8cbe50fb0780e907e08ebed1343cbf676b8445cbe4578
TLSH
T187C02B2CB4ACD93B5014C08A2B33884CFB9049DB5209F62E5310E40821817C4B94B443
MD5 SHA1 SHA512 TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 119KB
SHA256 fe8289239a81f3e1bc881e4f622e11c8e67b1d90c4a54d07a55e00a1950939d8
MD5 a6fb047749de3b890d36d2172df0ff97
SHA1 4431970ca391769bb36d72677c89e26217e006be
SHA512 3d8f6eb72f07fdf921aa4fcd000396ef5259aa7827411c691ed00742f721ff3d3334123ed178661434835b02f53d6224bd749a6e241e4d046b3e4edabf1935ed
SSDEEP 1536:nWdGfNbAkj1K3X7BQ9d0SHS7hdPFw5coos5J9PtSUDwS8U+DQAK+OAOxW4C:WdsA81ISdNQzPFzotxD789Q/+Oe
TLSH
T168C3D5D626D84E8AEA14667846DEC322773EFAF087434B03A268B0754E17FC17DC561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 2a7e3b88c72fb61394d23f05cd7271e2fd1525313474c84c34c97295cb2dfbfa
MD5 29f0df3ed512b5b3327b411eaa1acaf9
SHA1 91eaf0634b55687dd3d2d74e4cd6688edc7dbdc7
SHA512 0144298288667ce1326c28871e568eaad09250d043d47219aeb3cb3e6d83df3e13ee3e89c679044ab1a9177406567fe135e60eab6d07966155cf2e2b05f337ce
SSDEEP 384:z1XBaGX1iBuy4buz2REbkO+jk/r2PnBIAEr4yBgA6jAJD6z8Z4vlFzBzi5mX9bWR:hXnF6ur02CbX+k6ZIAErngAJJDQnLzRi
TLSH
T1B592A769513F6DC7D89222B414D602E7FFE4E048DA7551A4FF2BCE3B1C90ABB4BA0524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fcxsk3r.dll

Path C:\Users\Admin\AppData\Local\Temp\3fcxsk3r\3fcxsk3r.dll
Size 3KB
SHA256 96e5c1104d5578adf85e7b88616f8baf86c2cda5c82625d9be0f1db4c0055744
MD5 4a93b72e884276b471ad538d98eec15d
SHA1 3be7f4d63d35158abbc9c9443beb0cb6e9920fb2
SHA512 4dc6dc7a7c3f1ba9450c17c9b78b7ae1e9490f3ad63510b12ed65c8fdb74845464345b3e3ad1e7326fef53e904c29fbcb0adefc6016ccc7b7de08a161e1f3846
TLSH
T1A951A91A57E84A6BF4730B30AEF3471677B4F8609FB3571E59904218BC216549E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

cfg_53229_babc

Path C:\Users\Admin\AppData\Local\Temp\424cstif\cfg_53229_babc
Size 48KB
SHA256 3e481bd9ba6776945ad09a06f1200ad690e1fade992c7e4bbcfd4fcd04ccfa34
MD5 80e2c6d62460fba956dfe9b681d2f0f1
SHA1 30248b96e33c2df24608d97351f0c35070af0429
SHA512 cf2b90badb9e8577e9852aca8bcd53739d2abe941f0ad70cdd0d1f8f5f67fc3c1598a1ef24f2d4f760df499abcdf4b063bd8a0e98b57ae14ef63e8f9370c48de
SSDEEP 1536:rQRqsBtP7wdts8Zcsn4jB9hzsTAKo6/s8VtFd:6qMP8v3ZcsnMDhQTAGhVtf
TLSH
T1A12302BD2E02515658542E7A48A13AF362D1184CF4A7FDDE6CA87A6F031E317F14A90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_40169_bada.vbs

Path C:\Users\Admin\AppData\Local\Temp\424cstif\net_40169_bada.vbs
Size 228B
SHA256 753ef627175d036781e855fa60751f1ab2b0f57aaf5e57fdf5cf8450109495b7
MD5 2a9529726a3ef239fa960ca2a8cae0dc
SHA1 db0ff9e9a16cac6cc79acb7ebfc41b7c963b29a3
SHA512 a8e9335ce7efe595e48e9f39ab72a6d1fa48c9e6364136ed4a332af90f0fca7543f92629a0aca3c73c0e72c2066c6cdf86aba29f1e159a1e78771edd854b9618
TLSH
T107D02321A239D29CCC38C43D0073823C84D368AD318817106760D608F5861BCCE5D14C
MD5 SHA1 SHA512 TLSH

Submit Download

tmp_40296_babe

Path C:\Users\Admin\AppData\Local\Temp\424cstif\tmp_40296_babe
Size 84KB
SHA256 42b2439ba98ca9981c61175e5cfb64a5c839cffb4a4bfc6a408e750acc546292
MD5 b5b65b6942b3b42b9e44ebf8eff2b16b
SHA1 11359650d6d0c7bee73fe5fc6f604c22acf7cc1b
SHA512 9297a88c3596976cb88e09e1099f14ad44ef6ffc3f4d6260b3c951f28d6ad08abcfa804536c17dc6e2aa453f0025d7e465526db26933aa3b0bd8b5ce86b1d9c4
SSDEEP 1536:0UAIuXuIVIDZ6hZCIaooHaeMCyOBRafec1fk+h5Fos9spJjI:CPKN6hzaYrCfRM1c05W1K
TLSH
T1AA8302E529BFBF890DB481683088190AB4AD959FCE0330EA33F65CBF0667621115FD99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp_97129_bac0.ps1

Path C:\Users\Admin\AppData\Local\Temp\424cstif\tmp_97129_bac0.ps1
Size 5KB
SHA256 b8943d5278b9b2da519953f816b339939ca16b10b5bd1dac59967bad10040d68
MD5 44b14ee891148fe97652fc515424f24c
SHA1 a4a8872101380f9df5062a1f1e0124bd706c6d1e
SHA512 a1da83bf4ba81bf5b5a4c62938f89fdd93557c07656149ae7d9d778efb175a66c2ec4c5e1c32bc038eed9a7f5992eb6e264a8cad976f00fcf2fcca0b66c9dffb
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5W3j3LoGf5XZGIoBY67tKhwwDzm8CgrcXqHOpouK:gmOEG39XaygEUij/fozLoGfNEIomItKj
TLSH
T17FC185477ADA4BFA02C3647849B61512B669D02F324F1C04F6EDC2C5AF46834D3F51AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LX_Bjr5GwJlA0l--0.js

Path C:\Users\Admin\AppData\Local\Temp\LX_Bjr5GwJlA0l--0.js
Size 334KB
SHA256 cf1548f26c8ccacf83979bb26f7def35987076e2229db840a292b9dc6e3f3ea5
MD5 f42bbcd698e09cea39f5770fb75e3c88
SHA1 2bd4ffcf59b1de3a383892e1edbe92f8efaf4f26
SHA512 254fa63db478cdbb70e151c54af82c1631915124b7428d87f3ea570fb759c7694783880b83371cfc95fe442cfac549163a83c0784a50c8996ad44f6d7f2be72c
SSDEEP 6144:ngdpgOReSlXhQF1zifxFoqofnKXf4bI+IFLRlCfsEHs1EWgd6oJUzbvDWzs:nwZxQF1yyxfKXAbI+I3lqsEM1EdkoJsR
TLSH
T151749F78620CA84A40B1E4FD671D63E41FDCED3150D667266AC8DF862B5C4E7C0AA8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES1E28.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1E28.tmp
Size 1KB
SHA256 4fd1fb72b1de019611cd374866a5e7653a6bf45aebd965a19aec93a3b19fc8fa
MD5 bf2d15dd9b9f9fa2229bf3372f49d833
SHA1 501cc99c1cbdd93ca6c4ba3d1f601b9db2df6fe4
SHA512 c37cb6fe0896bcce125bfb21c864cc5f93972f5ea760a68057e55f86c06bc31d3c8b6f5aaf6f6bad984e205ac70f8093d3fd2a2151d81edb545de880fa60f585
TLSH
T13021C90593E9470FF0734B31A9FA172FA634FC65EFB2575A894042292812544EEF1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES420B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES420B.tmp
Size 1KB
SHA256 6a72bd9641c1bc0337f3b5f9c021fb557354efb7d98549cbef012c581fd3bad0
MD5 aaab8a392cb53ca82a6afcf443c33d38
SHA1 57fe79a9a488d231fe37ca75def980a91f64d006
SHA512 8ca13b055534bcd08efdf0e62b830f26ac155136b2ab95ccb6f21a07554bcd5e4aa48b89e3f5b7d5a4e979e561fca0896683e18e49a70ce4460c8b27465149e6
TLSH
T18B41224093DD4B2BF272433119F78729E778BE56AAA9875D7588122E2E02740DDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

log_26807_608f.ps1

Path C:\Users\Admin\AppData\Local\Temp\gzzxstf7\log_26807_608f.ps1
Size 5KB
SHA256 f6c7c517b44f07b69691247478254fc7686de74aa96b16143277a4841fda643f
MD5 78d50b9d96b914e9945440e2df7236ae
SHA1 80ebf761cfdd20da108b7782454494681c79cc37
SHA512 b0d3528d11a3e63aa7bbdf4c52e4743b50c6170dc9052b9da0795b8e12fcc8bac64e89720b1b347c6b629b8e76cc6e0594869b3f3ec7180a09a3317779186750
SSDEEP 96:aJcQulO9GG3z5Xayg9GUij/f5vuVuzFf55gNGIoBY67tKhwwDzm8CgrcXgHOpou2:gmOEG39XaygEUij/fBuVuzFfLg4IomIq
TLSH
T1C3C1730B7ADA47FA02C3B47449B61652B278D02B224F1D00F6EDC6C9BF06534D3E61A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_52113_608c

Path C:\Users\Admin\AppData\Local\Temp\gzzxstf7\log_52113_608c
Size 48KB
SHA256 fbbc77b7fda4f922f4e8f4fdd9e5d0c5445137d06f20e138f8cab1503a3f3183
MD5 3efa895f289969badf95c397bd357624
SHA1 e13be08b60659d58c9b244eac080fbd1d7fe2783
SHA512 c6f5442a78777e7b340c5c5dfce4668f31c0f937138dcf1fbad8272e2addc02a3135c861a9903a40fdba8fa5292f829deb9373ed19ddbb902adcf46a37d81d43
SSDEEP 768:CFHTQF3P3e10yYoX666nVrB03Sl5MByHfpA1GJxKaLXYQ7e9ZYfc6QdyCt18O/Ky:CFzQFfcVF6ZUIfpASxLXJUZYxQZtd
TLSH
T1132301E1CA629020122171B6C80FF64BFFFAE56500EA1BF9C129B565902755DF49FEB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_106884_60bd.vbs

Path C:\Users\Admin\AppData\Local\Temp\gzzxstf7\net_106884_60bd.vbs
Size 228B
SHA256 c755aa7040f676d0c99b471b3a59674813921089e6c0ea3f97a331f91b1d3d18
MD5 ce18897e85f8816c974752326cd648a5
SHA1 d2efbe98476966edb62e9ec30e70e2c6ac088264
SHA512 c89a7f1c1b1133120aa1880a5668138234780cdceb64f34fda7a905a2e850162e7c2074e301f1a09dd70741c7ef3f1e9dda98cdb0cdd937ceecaf04df28b6a3c
TLSH
T1E6D02300717DF20CED25C47606B6936C85E395DD22006B526750C508B6C1375CF5914D
MD5 SHA1 SHA512 TLSH

Submit Download

net_46925_608e

Path C:\Users\Admin\AppData\Local\Temp\gzzxstf7\net_46925_608e
Size 308KB
SHA256 0073d29742dcb0c416411300ba70774ae36b2604fabf1fe7d415b4e7137c4fa5
MD5 ef6cecc5bf34e586928a75037ba24349
SHA1 6c9b45a1455b3c4d288b9f9d26bbd9ba2804fad9
SHA512 7f104eddf87c83361b8b690db5f3ed383a0e6673f284d1531438f2a7192df15767950df4f16816c4f98c2d4deef37fdd29c8d2ce216ad75a0dc61008340e3e37
SSDEEP 6144:+hnH8+FBSLhhOqclGqNlKI9B1Tzak844kt/ZehU2Qa7SD3:+dlTSLDaAS3zajDYgK2QoSD3
TLSH
T12964226A0E3C5FFF8A5623ACE8AE460E37F184CC4738E11E55A8D847698FA56711D074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvc_39577b6f.exe

Path C:\Users\Admin\AppData\Local\Temp\msvc_39577b6f.exe
Size 6KB
SHA256 e3949c139b66c62e885948b6c789c962a59ab34462b952a9521fec82b76af9a9
MD5 73a654e7c1eaa8b414321b7005016c6b
SHA1 6672a56e46873e06ed2f7bb96624dc6cd25005e3
SHA512 0eac0e07af177acf99bd849c35dd34b2dda86edc172da2ebbfb74a93b4e322251d153149140cc74e6a3274839c414d3bc573ec950cd8de77ecb6dc33cbab407a
SSDEEP 96:XOoKU4XMuUdFis4hezvUvXfcAdOg88L38KbbkrVYL9zNt:974hN5JQG3
TLSH
T162C1099B87EC0772E8AD433C52B3471563B9E5B645238B9F68C1012BAE13BD847233B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3fcxsk3r.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3fcxsk3r\3fcxsk3r.0.cs
Size 342B
SHA256 6e7c584ab6a22978c7d48d0eb70f3e9cc9fc9d7b41314e78d6ad3e95efc376ea
MD5 1c557a6f00ffd168e4e9dae74ea45b7e
SHA1 5928a97cbf54955522ad00c87137658c9d5b927a
SHA512 4e92ae86daa651a548cf885afde0c37d0cf514f03c6c7b31fd06593f313066bbd8ed5945ff4b33eddab91c8fb239fb4af8dbdb21b80ee9183763133909673bbd
TLSH
T1A7E086147EF2FF3010534C2A9D8BE4FDB62B902727BB1A146AB85312DF4B0464239E55
MD5 SHA1 SHA512 TLSH

Submit Download

3fcxsk3r.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3fcxsk3r\3fcxsk3r.cmdline
Size 369B
SHA256 f5dffbe79a2ba45bc8fe80213927ae949d7d10f64df171bd42383e31e3c4fe6f
MD5 a90aa0248a425750ca542e9f56c8050c
SHA1 1e3926dd92045fc52a5c377f13daddf6a12a3c59
SHA512 2ada3e7a53c1dc2b0eb61cc284153540d02639eccfaae659f445c620726351bdb16749f81f5cfe260393b817fb5b36617ac5b971a5dc0da52e9e363ed8ba32b4
TLSH
T1D8E0682A9246C6FD01DB20272169CCBCA2B60AC729607F94A290440FE017044ABE27D5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8B05BC5560394EDB8DF4FDE55E1D7B9B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3fcxsk3r\CSC8B05BC5560394EDB8DF4FDE55E1D7B9B.TMP
Size 652B
SHA256 2102543af48c1a8000e535790972edfcf435513ea4e90f7613c5fd28c480b0cf
MD5 5936a81388493d00e4f751dab8c1111d
SHA1 99ec61e52cedb8cb16c168adce70cbcd324956f4
SHA512 0a308719cb53847829ef8ce33ebbff9e58a972e32be87ba33245ea9e186ee6cdafc8d2e73e990d51e9976e1520caaa4743a880463246631fe7f6b4603282061b
TLSH
T1F7F03A0963F8120AF4F34B30B9F643A395A8BC76DE3297ED554043192864910C9A2FB6
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8D9F30F225AC47239B78874B896B257.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC8D9F30F225AC47239B78874B896B257.TMP
Size 1KB
SHA256 885f27e625856b5a8a457707ad2421c03bf6eb513ffdf0977b9690577a725883
MD5 ad683a2e61c35ccdffde30c0ad057710
SHA1 b7b0db2ef80169c133a58f417b3eaa3f0d19a1f7
SHA512 e3216202219f100cb19ff9af5db097cd939a11cd2091b0e45768df458e87dad1ed3d0ab905cc7dee2949b4403648a9ccd0f9be58e0f11d9c29157db6a26bbbc5
TLSH
T16521CC85A3EC421EF2B387302AF2C363926C7E569C7A47EC3488171B2F15900C4836B1
MD5 SHA1 SHA512 TLSH

Submit Download

msvc_39577b6f.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\msvc_39577b6f.cs
Size 3KB
SHA256 1243a2c30132533e8a2baba7fbb9dc628778e4c2c101c6c39255dd5bc2ab2074
MD5 956d29c7c2582edb156faa745998d459
SHA1 dfbaae25a60f503aab33196716b3e10e51b4791c
SHA512 8bb8495ca4f56c514f12288979cb6ceb3d29b438d19bd796e0024fb2a9a9bcd2cf5d352e5101cea17b00d07cc0af2e78a923a3218d31116d188c9e4b5851986b
TLSH
T13D61EE556349E7A416B1040F4AD8C059F3678033473A6E04BE9E8512AFF812BA37AFA1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1440-60-0x00000000006D0000-0x00000000006D6000-memory.dmp

Download

memory/3480-9-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/3480-10-0x0000000005800000-0x0000000005866000-memory.dmp

Download

memory/3480-40-0x00000000078B0000-0x0000000007946000-memory.dmp

Download

memory/3480-41-0x00000000077B0000-0x00000000077D2000-memory.dmp

Download

memory/3480-6-0x0000000002C70000-0x0000000002CA6000-memory.dmp

Download

memory/3480-7-0x0000000005970000-0x0000000005FBA000-memory.dmp

Download

memory/3480-8-0x00000000056F0000-0x0000000005712000-memory.dmp

Download

memory/3480-21-0x00000000076F0000-0x000000000770A000-memory.dmp

Download

memory/3480-13-0x0000000005FC0000-0x000000000631B000-memory.dmp

Download

memory/3480-14-0x00000000064D0000-0x00000000064EE000-memory.dmp

Download

memory/3480-35-0x0000000007740000-0x0000000007748000-memory.dmp

Download

memory/3480-19-0x0000000007D00000-0x000000000837C000-memory.dmp

Download

memory/3480-34-0x0000000007720000-0x0000000007728000-memory.dmp

Download

memory/3480-20-0x0000000007680000-0x000000000769A000-memory.dmp

Download

memory/3480-15-0x0000000006520000-0x000000000656C000-memory.dmp

Download

memory/4792-36-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4792-49-0x00000000091A0000-0x00000000096CC000-memory.dmp

Download

memory/4792-48-0x0000000008AA0000-0x0000000008C62000-memory.dmp

Download

memory/4792-37-0x00000000058A0000-0x0000000005E5A000-memory.dmp

Download

memory/4792-47-0x0000000008880000-0x00000000088D0000-memory.dmp

Download

memory/4792-44-0x0000000007170000-0x000000000717A000-memory.dmp

Download

memory/4792-43-0x0000000006FC0000-0x0000000007052000-memory.dmp

Download

memory/5528-92-0x00000000063E0000-0x000000000673B000-memory.dmp

Download

memory/5528-96-0x0000000006A20000-0x0000000006A6C000-memory.dmp

Download

memory/5528-100-0x00000000079A0000-0x00000000079BA000-memory.dmp

Download