lxbaserat | 206cfbabb6175852a80ccfff9884e6019a39d712de6c198a3ac43e4e4e9f9c45

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Declaration Aproval Details.pdf.vbe
Size 3KB
Sample261104-tek25asycs
SHA256 206cfbabb6175852a80ccfff9884e6019a39d712de6c198a3ac43e4e4e9f9c45
MD5 69431a22b7b7f5c003ca2bcc0deb88c5
SHA1 51855591aad87ba6d66b9535fd1efa4f4c503254
SHA512 db4360f52f6515027f9dff0623679ce87b68efa40977136d1e3704eba9ffa185bec6441e425b382140e796bf0352cdc04b06b4fe1e6a6814c0433c36ba8bb86d
TLSH
T1ED51424B3E02C53959B2CDA4CEBEF829E9D0346B65455C04F65CCD43DF3226AB1301E9
MD5 SHA1 SHA512 TLSH

Score

10^/10

group1 26e0c7f5f459424a99c5778f99297a1d collection discovery execution lxbaserat rat spyware stealer

Malware Config

Extracted

Family

lxbaserat

Version

1.0.51

Botnet

Group1

Campaign

26e0c7f5f459424a99c5778f99297a1d

Gaza.gleeze.com:2712

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
OPYC89fCsflfswL10NaU

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5236	WScript.exe
6	5236	WScript.exe
10	5236	WScript.exe
12	5236	WScript.exe
15	5236	WScript.exe
19	5236	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
952	.dfc_97d64f39.dat
5552	.dfc_816921f9.dat
5652	.dfc_f942630a.dat

Loads dropped DLL 2 IoCs

pid	Process
2624	chrome.exe
5428	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	aspnet_compiler.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
24	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5236	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5080 set thread context of 5404	5080	powershell.exe	95

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5080	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5080	powershell.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5080	powershell.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5080	powershell.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5080	powershell.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5080	powershell.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe
5404	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	5404	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5404	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 5080	5236	WScript.exe	89
PID 5080 wrote to memory of 5524	5080	powershell.exe	94
PID 5080 wrote to memory of 5404	5080	powershell.exe	95
PID 5080 wrote to memory of 5404	5080	powershell.exe	95
PID 5080 wrote to memory of 5404	5080	powershell.exe	95
PID 5080 wrote to memory of 5404	5080	powershell.exe	95
PID 5080 wrote to memory of 5404	5080	powershell.exe	95
PID 5404 wrote to memory of 2624	5404	aspnet_compiler.exe	104
PID 5404 wrote to memory of 1520	5404	aspnet_compiler.exe	105
PID 1520 wrote to memory of 3928	1520	csc.exe	107
PID 5404 wrote to memory of 952	5404	aspnet_compiler.exe	108
PID 5404 wrote to memory of 5428	5404	aspnet_compiler.exe	112
PID 5404 wrote to memory of 5576	5404	aspnet_compiler.exe	113
PID 5576 wrote to memory of 412	5576	csc.exe	115
PID 5404 wrote to memory of 5552	5404	aspnet_compiler.exe	116
PID 5404 wrote to memory of 1828	5404	aspnet_compiler.exe	120
PID 1828 wrote to memory of 3100	1828	csc.exe	122
PID 5404 wrote to memory of 5652	5404	aspnet_compiler.exe	123
PID 5080 wrote to memory of 3912	5080	powershell.exe	128

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Declaration Aproval Details.pdf.vbe"
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\DGGRYRYC.ps1"
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Loads dropped DLL
      PID:2624
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_97d64f39.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_97d64f39.tmp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES142A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC148B273950244F13B846186B10387568.TMP"
        5⤵
        
        PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\.dfc_97d64f39.dat
      "C:\Users\Admin\AppData\Local\Temp\.dfc_97d64f39.dat" 2624 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\mojo.1095.2873.1960.chrome"
      4⤵
      Executes dropped EXE
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      Loads dropped DLL
      PID:5428
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_816921f9.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_816921f9.tmp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5576
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES164D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9A07056C93FF4BEC85BA7CDE75E41C.TMP"
        5⤵
        
        PID:412
  - - C:\Users\Admin\AppData\Local\Temp\.dfc_816921f9.dat
      "C:\Users\Admin\AppData\Local\Temp\.dfc_816921f9.dat" 5428 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\msedge.sync.158.2873"
      4⤵
      Executes dropped EXE
      PID:5552
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_f942630a.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_f942630a.tmp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES189F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA9D8AB2105A4FE09A1E2064828A661A.TMP"
        5⤵
        
        PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\.dfc_f942630a.dat
      "C:\Users\Admin\AppData\Local\Temp\.dfc_f942630a.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xynr4oz2.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"
      4⤵
      Executes dropped EXE
      PID:5652
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5080" "852" "2300" "868" "0" "0" "1060" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:3912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2340

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DGGRYRYC.ps1

Path C:\Temp\DGGRYRYC.ps1
Size 2.5MB
SHA256 3eba1e42c88f035ace13f7539bb43983bcd420a9b80522780b2897b8a8e25597
MD5 52f626a2ca1a4594cbfa7b8b70e738ac
SHA1 183199b0fababd5864fb1fd923fe456f2084f5a9
SHA512 17fcfe4da0c13f2e4d0a9fce23873054e2e5db5e71e728b431c92497eb11bfed97408d142d3a87926c0b887a67353a37e9531c3dc00c02342ade0eb72db817e1
SSDEEP 24576:Twf53fzp+v3VbkgDk9QgAg7iunFzzRudkkG3RR0UZTaoky/ESVdFXxu2aAsFXFG3:Tw9VAa7VzsIRNHaAsbxdG
TLSH
T1EAC5232CAE9826CF4D11E2F5620AF880B1E953C7594A03A703ADC5B435FC6F48E77967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 63KB
SHA256 0232e3d13e53fc069b113190903be389ec59f5991acd99aecc8011d19c2d9282
MD5 96a644ea4c30cd71c965810ad0bdad55
SHA1 e748e8bc6cee870b0fb5ea798faa29f0832170f3
SHA512 7b22ea69c18b7e1f4114fe2368688ebfc9a64803dfe23a2b0d460caf62c27e6f5b00b10752ebf69172eba040b7bcd5580a9fb9bf72025297dc6d47438fd13de0
SSDEEP 1536:MGLiTh9ZTWZg8FjwYDbCgs7ZodphAQ/m5:MGLiTh9uMYqgsiph9
TLSH
T1FF53C53871C981B7C297CD30586DBF12527330A38FE1669F33ACF61D1E7979A2A1650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_816921f9.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_816921f9.dat
Size 6KB
SHA256 78ef674bcbbcee2cc7d3901f8c285003464fa46b4a78f26e9e93caf18d71ab45
MD5 082a1892529ba10ee091a8e7926a9954
SHA1 6dc577fd6a7284cf14713fdb8d711a4c3e206d48
SHA512 2a9dfc547659402bf15876a6768067574c903689a3c24343e378ee9a3b88372b5b5ecf9bc3652b7ad92732f4ec08ed3374b0199c8a15a8bf56d591897b6cff8d
SSDEEP 96:FOoKU4XMuUdFis4hezvUvXfBdOb88plr38FA/bbkrV1wLBhzNt:z74hNx0jQ7sBj
TLSH
T1E5C10A9B87DC0372E8AD433C51B347116378E5B656538B9F68C5106BAE23BE547233B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_97d64f39.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_97d64f39.dat
Size 6KB
SHA256 55eb3e77f1597b5790dd63bfd8c305c4b2e5c2be4aca25ba72c862a8f23bdb24
MD5 01b19d983f4d0f3ab13effd3bd714087
SHA1 f3f01b8ffedc5b2b8de3ddfd49093e4b12b833b8
SHA512 c4895b100fafff59f230715c05f966ebcde9d8c7c666e9ce1bb2f6600f851966fec9a790c03ec5770a40c8b74d00277d9e5fd46be780544709f96d35bfa12e04
SSDEEP 96:QOoKU4XMuUdFis4hezvUvXfPdOh886p38zbbkrV1dkLBdFzNt:A74hNfGQ7eBl
TLSH
T18FC10A5B87DC0772E8AE433C51B387252378E6A645538B9F28C1416BAE23BD547233B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_f942630a.dat

Path C:\Users\Admin\AppData\Local\Temp\.dfc_f942630a.dat
Size 9KB
SHA256 af9bf342c226ab06fcd60a8533e8c9f7f3c60899066653cea84414809070074f
MD5 5d40465825476c57fae8db28fe0b08e7
SHA1 ca33cf73758f12ded1711e1b5312fe4908feccb4
SHA512 368a4217d5d5c69004b694d07c50aa3423988670e799f1e9d8a5aa6ef8f3d2a1d0f5f48802e29d071a120b22fbfb419d92be99f23334f1a81593662f29c7ea2e
SSDEEP 192:j3GnXD2f3iMG1ImkWWZAtagLlgEAcrRBI:bm43ibpWMJnAct
TLSH
T12912A426B7F40A66C9BE877D387203604270F5424977C74F2CDE396E9E723D594927A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES142A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES142A.tmp
Size 1KB
SHA256 37df48fa0a8f830b5f68cec5841cc4997f1013a353a3214a589fe37b7f49ce6a
MD5 be344f9f1c46f12f8fbe5523ad745920
SHA1 fbb263bc34fab7ae5d3e13b6c0de2882ac35a56c
SHA512 aded8a39b062474d841c47dbf22ce2e4708f475820d6567af0d50bf62d118745119eaf5a852d005030a83a6678944f0dc93c020080747d822485137a030717af
TLSH
T11841334083DC472FF172433229F7972AB374BF92AA9A475DB188162E1E52744DDC32B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES164D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES164D.tmp
Size 1KB
SHA256 c974af245e8cb5c408a3b06b2a17032cc6b5d763a1fce4adbe4895a95be21e37
MD5 03bf218d8a26588cab943bf1661b56f4
SHA1 80b58622ef4464bc9e7f2a66760993bccce72dee
SHA512 af82ca19af8d9ea62b4946862c4d39ab333136b90733e56b1890ffba6a2819a620dd9405de86df9004350a09d6c7dd118afa461911ff0e61067202feea437987
TLSH
T14041114083D8472FF172573129F7872AA778BF56AAA9435E7484122E1F02740DD832B2
MD5 SHA1 SHA512 TLSH

Submit Download

RES189F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES189F.tmp
Size 1KB
SHA256 0594826e0e2fb7a10d81c599471dd96ee39ca7e17e3001fd670eceea9b2457e8
MD5 90c07bdc4d0d0c7db29577844e17b886
SHA1 c0e8b1907f7d8ffc2414d5e8d0d6810803d11dad
SHA512 92ccb9f70b80e9ccddd25a7472140290a0112afebfff41ed136885d30031f1e812ae503292de914eab805737a6b20f7316a035cd3d6f364388a76fd9651c65b7
TLSH
T1B241334183E85B1FE1B2473129F78736A778BF56AAA9875E7084122E1E06744DDC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d1g0fz5e.5la.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1g0fz5e.5la.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b859b97b050f425d8544e22a7682e8c7.db

Path C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\.temp\b859b97b050f425d8544e22a7682e8c7.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.dfc_97d64f39.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_97d64f39.tmp
Size 3KB
SHA256 b2039360f11e07eea9c58b242176fb079d2d8612c468ff8c5e126312cd64965a
MD5 d61abc178862a54927023622c2eba9fc
SHA1 6d0fc4892b1c793dbd98ef7e4eb65831c191eb54
SHA512 dc36c30a6cd42123ef69cb93aeae789d56642d514b78cda71547f1bb53a444ce290b6ac42c488452a8ec94639edc3682597d52b3ef029c9d030fbe8c91c74a2f
TLSH
T19161EE94235BA76026A3041F4ADBC059F3679133473EEC14BEAD8512AF8911FB379BA1
MD5 SHA1 SHA512 TLSH

Submit Download

.dfc_f942630a.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\.dfc_f942630a.tmp
Size 5KB
SHA256 ee9b5b8c049eeaca0772d78791e4cbff4049d0390caf07a77ee27070df096f3a
MD5 d7433bc585ec75f7b7bd952a4cb6ebef
SHA1 7aafd22384aeaf19431c19c684e41d2d580ebb62
SHA512 2a5e5951acf357da7240b61db3716b5ca55e8f706d75b4757240fdca9d91acdd8510823c7983659658836aa557f8a19a247d21824f2fb6cadbadb4913debaac4
SSDEEP 96:6jPKov0Eqt0lGfVwarkv8ZE498dmzUYK+8hwbaTy8bLvbq7VOgQTy/x:GNc7yKE49JzUh+8WeyMhTwx
TLSH
T1E5B1954435A0E92BCEF4184A04DB067DEA42567347744CB3C7E64E094EB7912E179F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC148B273950244F13B846186B10387568.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC148B273950244F13B846186B10387568.TMP
Size 1KB
SHA256 6fad513b85ea2cd56d2a0dc14d02d4a07346f6ee8cd9ed5e83580bd805c76948
MD5 3730b799eb5691ef0f7a80ff3110b00d
SHA1 43238efcdda81be4f13c10c1c87764f3699339d2
SHA512 c2ed6470fe12658d539069225267dbf59a62d9ac8bf46cbfee5c74de61a84bb96faff0e0fbd9b15483b869749e2a95309e7a96ce424e8375c97759355762e704
TLSH
T19B21EF45A3E8432EF1B3473069F2C3739268BF569CB947EC3488171F2F15A0184836B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9A07056C93FF4BEC85BA7CDE75E41C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9A07056C93FF4BEC85BA7CDE75E41C.TMP
Size 1KB
SHA256 3f7eb8568fdf2b8a5bbaf41ba766cc4ab776c13b9d24d0bfe8c2241c47f23086
MD5 01a495bdf05879b77d9091fcb0dcff19
SHA1 31d51cbc226374d2e0df05ec8b4287bc2a835b0b
SHA512 2b5f27fc2a8dc461e45d13a495f739983e1772debd040ea20cfe0752371069a2ad23b9ffd69a979f7d485afa6d8b5f48e466cdb3aa3a159da3c451f39b376e7c
TLSH
T1EC21CC45A3E8532EF1B3873069F2C36391687F569CB943DC34C8171F2F15A0084836B2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA9D8AB2105A4FE09A1E2064828A661A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA9D8AB2105A4FE09A1E2064828A661A.TMP
Size 1KB
SHA256 56eb440ebede551b6b2c36e87a2a256463b1175c9ed9af6679bb5cfe8bbeff09
MD5 009b98c6aaca12f533c8fd42fa5f40ce
SHA1 2dfa06dfd3095c3faec8970c9668344f92f18fc3
SHA512 86f061e9943ee05c5628b0f4384a989c437b3ec702828c650536fd3cb192671715021bd4242c503f129672dd906d02cc42dad0473ce856b1529f0ac4a629cf74
TLSH
T18721AA45A2E8531EF1F3873029F6C26391687E569CA987DC3488175B2F15A0084836B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-67-0x00000000007E0000-0x00000000007E6000-memory.dmp

Download

memory/5080-17-0x0000017CE86C0000-0x0000017CE86D0000-memory.dmp

Download

memory/5080-18-0x0000017CE91C0000-0x0000017CE91E2000-memory.dmp

Download

memory/5080-34-0x0000017CE86C0000-0x0000017CE86D0000-memory.dmp

Download

memory/5080-54-0x0000017CE86C0000-0x0000017CE86D0000-memory.dmp

Download

memory/5080-28-0x0000017CE86B0000-0x0000017CE86BE000-memory.dmp

Download

memory/5080-39-0x0000017CE86C0000-0x0000017CE86D0000-memory.dmp

Download

memory/5080-27-0x0000017CE86C0000-0x0000017CE86D0000-memory.dmp

Download

memory/5080-16-0x0000017CE86C0000-0x0000017CE86D0000-memory.dmp

Download

memory/5404-30-0x0000000005F50000-0x00000000064F4000-memory.dmp

Download

memory/5404-29-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/5404-31-0x0000000006E70000-0x0000000006ED6000-memory.dmp

Download

memory/5404-55-0x0000000007E80000-0x00000000083AC000-memory.dmp

Download

memory/5404-53-0x0000000007780000-0x0000000007942000-memory.dmp

Download

memory/5404-52-0x0000000007540000-0x0000000007590000-memory.dmp

Download

memory/5552-91-0x00000000000C0000-0x00000000000C6000-memory.dmp

Download

memory/5652-112-0x0000000000200000-0x0000000000206000-memory.dmp

Download