Analysis Overview
SHA256
8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561
Threat Level: Known bad
The file 8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561 was found to be: Known bad.
Malicious Activity Summary
Quasar payload
Quasar RAT
AsyncRat
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Sets file to hidden
Drops startup file
Loads dropped DLL
Executes dropped EXE
Adds Run key to start application
Unsigned PE
Detects Pyinstaller
Embeds OpenSSL
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Scheduled Task/Job: Scheduled Task
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Uses Task Scheduler COM API
Views/modifies file attributes
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-28 15:58
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-28 15:58
Reported
2024-07-28 16:01
Platform
win10v2004-20240709-en
Max time kernel
146s
Max time network
158s
Command Line
Signatures
AsyncRat
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Sets file to hidden
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ldEXan5S.exe | C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ldEXan5S.exe | C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\ldEXan5S.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\browser\edge.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\mUhDH55s.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyProgram = "C:\\Users\\Admin\\AppData\\Roaming\\ldEXan5S.exe" | C:\Windows\system32\reg.exe | N/A |
Embeds OpenSSL
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\reg.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\browser\edge.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\mUhDH55s.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe
"C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe"
C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe
"C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableIOAVProtection $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisablePrivacyMode $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableArchiveScanning $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -MAPSReporting Disabled"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -SubmitSamplesConsent 2"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -LowThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -SevereThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' -Name 'SmartScreenEnabled' -Value 'Off' -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Edge\SmartScreenEnabled' -Name 'SmartScreenEnabled' -Value 0 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Edge\SmartScreenPuaEnabled' -Name 'SmartScreenPuaEnabled' -Value 0 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost' -Name 'EnableWebContentEvaluation' -Value 0 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost' -Name 'PreventOverride' -Value 0 -Force"
C:\Users\Admin\AppData\Roaming\ldEXan5S.exe
C:\Users\Admin\AppData\Roaming\ldEXan5S.exe
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\browser\edge.exe" /rl HIGHEST /f
C:\Users\Admin\AppData\Roaming\browser\edge.exe
"C:\Users\Admin\AppData\Roaming\browser\edge.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyProgram /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ldEXan5S.exe" /f"
C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyProgram /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ldEXan5S.exe" /f
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +s +h "C:\Users\Admin\AppData\Roaming\ldEXan5S.exe"
C:\Windows\system32\attrib.exe
attrib +s +h "C:\Users\Admin\AppData\Roaming\ldEXan5S.exe"
C:\Users\Admin\AppData\Roaming\mUhDH55s.exe
C:\Users\Admin\AppData\Roaming\mUhDH55s.exe
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\browser\edge.exe" /rl HIGHEST /f
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| US | 8.8.8.8:53 | 9.11.42.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.142.211.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 70.252.19.2.in-addr.arpa | udp |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| DE | 193.42.11.9:4329 | tcp | |
| US | 8.8.8.8:53 | ipwho.is | udp |
| DE | 195.201.57.90:443 | ipwho.is | tcp |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.57.201.195.in-addr.arpa | udp |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| US | 8.8.8.8:53 | 25.140.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| US | 8.8.8.8:53 | 17.173.189.20.in-addr.arpa | udp |
| TR | 45.141.151.163:80 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI50922\python312.dll
| MD5 | d521654d889666a0bc753320f071ef60 |
| SHA1 | 5fd9b90c5d0527e53c199f94bad540c1e0985db6 |
| SHA256 | 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2 |
| SHA512 | 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\base_library.zip
| MD5 | 43935f81d0c08e8ab1dfe88d65af86d8 |
| SHA1 | abb6eae98264ee4209b81996c956a010ecf9159b |
| SHA256 | c611943f0aeb3292d049437cb03500cc2f8d12f23faf55e644bca82f43679bc0 |
| SHA512 | 06a9dcd310aa538664b08f817ec1c6cfa3f748810d76559c46878ea90796804904d41ac79535c7f63114df34c0e5de6d0452bb30df54b77118d925f21cfa1955 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ctypes.pyd
| MD5 | fb454c5e74582a805bc5e9f3da8edc7b |
| SHA1 | 782c3fa39393112275120eaf62fc6579c36b5cf8 |
| SHA256 | 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1 |
| SHA512 | 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\python3.DLL
| MD5 | a07661c5fad97379cf6d00332999d22c |
| SHA1 | dca65816a049b3cce5c4354c3819fef54c6299b0 |
| SHA256 | 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b |
| SHA512 | 6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_ssl.pyd
| MD5 | c87c5890039c3bdb55a8bc189256315f |
| SHA1 | 84ef3c2678314b7f31246471b3300da65cb7e9de |
| SHA256 | a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2 |
| SHA512 | e750dc36ae00249ed6da1c9d816f1bd7f8bc84ddea326c0cd0410dbcfb1a945aac8c130665bfacdccd1ee2b7ac097c6ff241bfc6cc39017c9d1cde205f460c44 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_socket.pyd
| MD5 | dd8ff2a3946b8e77264e3f0011d27704 |
| SHA1 | a2d84cfc4d6410b80eea4b25e8efc08498f78990 |
| SHA256 | b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085 |
| SHA512 | 958224a974a3449bcfb97faab70c0a5b594fa130adc0c83b4e15bdd7aab366b58d94a4a9016cb662329ea47558645acd0e0cc6df54f12a81ac13a6ec0c895cd8 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libssl-3.dll
| MD5 | 19a2aba25456181d5fb572d88ac0e73e |
| SHA1 | 656ca8cdfc9c3a6379536e2027e93408851483db |
| SHA256 | 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006 |
| SHA512 | df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\select.pyd
| MD5 | d0cc9fc9a0650ba00bd206720223493b |
| SHA1 | 295bc204e489572b74cc11801ed8590f808e1618 |
| SHA256 | 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019 |
| SHA512 | d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_hashlib.pyd
| MD5 | da02cefd8151ecb83f697e3bd5280775 |
| SHA1 | 1c5d0437eb7e87842fde55241a5f0ca7f0fc25e7 |
| SHA256 | fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354 |
| SHA512 | a13bc5c481730f48808905f872d92cb8729cc52cfb4d5345153ce361e7d6586603a58b964a1ebfd77dd6222b074e5dcca176eaaefecc39f75496b1f8387a2283 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_queue.pyd
| MD5 | b7e5fbd7ef3eefff8f502290c0e2b259 |
| SHA1 | 9decba47b1cdb0d511b58c3146d81644e56e3611 |
| SHA256 | dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173 |
| SHA512 | b7568b9df191347d1a8d305bd8ddd27cbfa064121c785fa2e6afef89ec330b60cafc366be2b22409d15c9434f5e46e36c5cbfb10783523fdcac82c30360d36f7 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\libcrypto-3.dll
| MD5 | e547cf6d296a88f5b1c352c116df7c0c |
| SHA1 | cafa14e0367f7c13ad140fd556f10f320a039783 |
| SHA256 | 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de |
| SHA512 | 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_lzma.pyd
| MD5 | 195defe58a7549117e06a57029079702 |
| SHA1 | 3795b02803ca37f399d8883d30c0aa38ad77b5f2 |
| SHA256 | 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a |
| SHA512 | c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
| MD5 | bf9a9da1cf3c98346002648c3eae6dcf |
| SHA1 | db16c09fdc1722631a7a9c465bfe173d94eb5d8b |
| SHA256 | 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637 |
| SHA512 | 7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\charset_normalizer\md.cp312-win_amd64.pyd
| MD5 | d9e0217a89d9b9d1d778f7e197e0c191 |
| SHA1 | ec692661fcc0b89e0c3bde1773a6168d285b4f0d |
| SHA256 | ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0 |
| SHA512 | 3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_decimal.pyd
| MD5 | 492c0c36d8ed1b6ca2117869a09214da |
| SHA1 | b741cae3e2c9954e726890292fa35034509ef0f6 |
| SHA256 | b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1 |
| SHA512 | b8f1c64ad94db0252d96082e73a8632412d1d73fb8095541ee423df6f00bc417a2b42c76f15d7e014e27baae0ef50311c3f768b1560db005a522373f442e4be0 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\unicodedata.pyd
| MD5 | cc8142bedafdfaa50b26c6d07755c7a6 |
| SHA1 | 0fcab5816eaf7b138f22c29c6d5b5f59551b39fe |
| SHA256 | bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268 |
| SHA512 | c3b0c1dbe5bf159ab7706f314a75a856a08ebb889f53fe22ab3ec92b35b5e211edab3934df3da64ebea76f38eb9bfc9504db8d7546a36bc3cabe40c5599a9cbd |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_cffi_backend.cp312-win_amd64.pyd
| MD5 | 0572b13646141d0b1a5718e35549577c |
| SHA1 | eeb40363c1f456c1c612d3c7e4923210eae4cdf7 |
| SHA256 | d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7 |
| SHA512 | 67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\_bz2.pyd
| MD5 | 5bebc32957922fe20e927d5c4637f100 |
| SHA1 | a94ea93ee3c3d154f4f90b5c2fe072cc273376b3 |
| SHA256 | 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62 |
| SHA512 | afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\certifi\cacert.pem
| MD5 | 181ac9a809b1a8f1bc39c1c5c777cf2a |
| SHA1 | 9341e715cea2e6207329e7034365749fca1f37dc |
| SHA256 | 488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee |
| SHA512 | e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85 |
C:\Users\Admin\AppData\Local\Temp\_MEI50922\cryptography\hazmat\bindings\_rust.pyd
| MD5 | b98d491ead30f30e61bc3e865ab72f18 |
| SHA1 | db165369b7f2ae513b51c4f3def9ea2668268221 |
| SHA256 | 35d5aeb890b99e6bae3e6b863313fbc8a1a554acbcd416fe901b1e1ae2993c98 |
| SHA512 | 044c9c39bddb13020ed865d3aa30926460ae6ded5fdea59eca2b1cf6a4ded55728d883f19ee0749f95a4d93f66e04fcc62bc3be67119c4ccabd17b003cf5f3c4 |
memory/4888-72-0x00007FFA2CFE3000-0x00007FFA2CFE5000-memory.dmp
memory/4888-73-0x000002A92B010000-0x000002A92B032000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_foix0lfb.lhc.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4888-83-0x00007FFA2CFE0000-0x00007FFA2DAA1000-memory.dmp
memory/4888-84-0x00007FFA2CFE0000-0x00007FFA2DAA1000-memory.dmp
memory/4888-87-0x00007FFA2CFE0000-0x00007FFA2DAA1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 588e5b3406537204588ef39f4c84259f |
| SHA1 | c6056b8139c0796cc6272b7b71fca2085f62b785 |
| SHA256 | 3b7e7c56deb0f16483d67e60a42a5f0a58ee557790fe0f312d036e4ecc31f7f0 |
| SHA512 | f85ea8f8f0c3ea56840a84f42a188f125c13cea8b23f86ddcce8eb28758e816dd6d871154dfe63d250ef369b153f72c587a7a8bccd0a2728b7bc922dd7436e96 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 4c60463b0551abf52d31bc311e50c789 |
| SHA1 | 59c839439e2b520bf1dc6c9872c03fef8eb85aa0 |
| SHA256 | 31a2eaf3b166c43b57b902ed91ef7ac522724a679b82a31f8bdb5a6a35f76a4f |
| SHA512 | b6b7b22f70f930f8ccf619b06f2e31903034774beee22fac8fb507e44352f74fba7ee03380a94ff988d7697ce467216e5ab7f9791c85628fe4afaa4871770676 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | f0a41fc9c1123bb127e55ecc66c8f052 |
| SHA1 | 57152411758fa3df2623cc8a4df6d9fea73652f8 |
| SHA256 | a4fe2be2c449e841f6a12d32114672b097fc1058b6f2971a03521220a0228745 |
| SHA512 | e3e967adac361ddcf8240cf641f3e77eacfefc61dec725b8ae12e6a94f7d2ebd937fb9eb3cd068a0b3d4306e163dc87773b322bc2dd8b7df93b8103d0e99a900 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 110b59ca4d00786d0bde151d21865049 |
| SHA1 | 557e730d93fdf944a0cad874022df1895fb5b2e2 |
| SHA256 | 77f69011c214ea5a01fd2035d781914c4893aee66d784deadc22179eadfdf77f |
| SHA512 | cb55ac6eca50f4427718bace861679c88b2fdfea94d30209e8d61ca73a6ce9f8c4b5334922d2660a829b0636d20cbdf3bae1497c920e604efe6c636019feb10e |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | eb033be02578f9635ec47bdc1de5c3fb |
| SHA1 | ec356bc87381354a06baa9c30e8c3ac3d30e0f6f |
| SHA256 | bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063 |
| SHA512 | 4d8778503646f7016df73ff9d204760f4fe4d2b24157920ac3e5651653373975b2f2d229530143059f11b16c42822ad7963e628ad6066022ee712c17d90595ed |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 735388b98281cec7d063b1b470c13632 |
| SHA1 | 7536ce1c5f3732fac491d7038e24124551c4290a |
| SHA256 | 843fced254477f5ad803cc98e853d7ab674852d5e94bc174497691b736d49e69 |
| SHA512 | 30244c596f4c3cc0194186a210170f04985b77fc90f10cff0a2fbd07e079944e5f8c9998759219363033c450b6a4093ad1b3d75e0a0fae1aa6208a61a88a9717 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | ab24765a7393bd3cef8acbf0a617fba2 |
| SHA1 | ef2c12a457a11f6204344afed09a39f4d3e803cb |
| SHA256 | 3a03c7efabe880ae9f283b1cf373d3f09d07ab619028319b3599b643ae140d47 |
| SHA512 | e16306674a8c89f54467d7fba3857e1e0bdf3729f5de9f4451520cfbddfa535c4d653dde6efcac38efd693e9b3e4965fcd08c559e720c372feca65050b46e355 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 929c856a9f5f4fd187b9b324e39be583 |
| SHA1 | b5d74d5b632f2b0d892c0b763f7f9c36f8677fec |
| SHA256 | 67fc49d5d72ee25add82821193e326f1109d7b88189560492686a8f9d8b6c97e |
| SHA512 | 5746885b047af646bee26dc965c2fea100c395b2cc89a868af5d5858dd273497c3ea2f567c11439a84502cceea001a661352b8d0873c2cf09b1697c583fc61dd |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 01d89dd05c27325bbfe34d7a2bc716ad |
| SHA1 | fa0a5ce95e7e989da44face5a736172aba834ddc |
| SHA256 | 52bf1aacc2b2f03b2bbdca40b7eff5e041c8f2892575b3bf5cbaa000a02f71e9 |
| SHA512 | d7500eae5877d297fec543b607a1e6764ac07002178e92306de9b5a9cc76d9f42cdaa9a2b086ed1d3174c660afa120228affa80a4fb1ac4a430f7028449e0adb |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 43eccffee873a732abf21708ce046a1c |
| SHA1 | 98c47cfb1b46ee152418da77f89dd1086516ab98 |
| SHA256 | b153b1ad2eca3f1c50db0a0ce04a2553d595408f6c1e1c464318024c1dcc857d |
| SHA512 | c8e6fca7372f9abdf46288d91302a95e05daf146fbce449fa66d82e7b59a01e2a8b3be7e1a8da189aa25462e73760ebe863086b6c86ab1e29eb935f71843ba80 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 217d9191dfd67252cef23229676c9eda |
| SHA1 | 80d940b01c28e3933b9d68b3e567adc2bac1289f |
| SHA256 | e64811c3e57476bb644539824034cabe2cabcb88941122193e2af328f5eb2133 |
| SHA512 | 86767aa3c0eec425b7c6dbfd70a4a334fb5b1227c05fb06fbb3845e7b6974008386276f441c8e66e2bf9b0ae0a76133c4e5602211788cd702eaeadd12c5ff757 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 5caad758326454b5788ec35315c4c304 |
| SHA1 | 3aef8dba8042662a7fcf97e51047dc636b4d4724 |
| SHA256 | 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391 |
| SHA512 | 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 38f0f14cc7ca72ad51216866e66efb4e |
| SHA1 | 34ed0f47a4aaa95e786ca9f125b0341b38bfb9be |
| SHA256 | 668820fc659c9d229d32731ead41381eca0e5fb57232bbd3ef0118f5a21fc501 |
| SHA512 | 4a7d00c585784cf1aec6ed82d8c78542d2db3b9da30d8db20680a1ee9fd45b697207fbd459557336f2166d8b6ac17016f9e71c61ad351f2915bb163c8ed2b73a |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | c6c412f442d92c3ac4051ccbb17eb3ad |
| SHA1 | 084c76b49ac1f1a9af98a6527364c079af686581 |
| SHA256 | ad5d4e1c11498acb3898bf24abcdecd71c8114f045831449904fe092c692df4b |
| SHA512 | a01c42b0e43acc031b3d7183350ba03b21509bd3d4e23dda053c2e499121d9d53e96432eaaace2811c73067fb1281811ac60fd96cf8f0129cc4808d71d9089c0 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | a2568184602a24d6d7e5635d5fb43c1a |
| SHA1 | 8e8d6e16fdffe8bfb08cd4719c8f580b5726fa88 |
| SHA256 | ebc0321a4380b744905115a7a094124ad878173f5942d01ece951142c91efbd6 |
| SHA512 | af47d87f6ffb1b14b6493d26cec46fe085306b40ad2b4506168a84267998ce052897c68fa90c9c422842c1aaa27a0ee31859a5df7ef5c8cd695a2101e6805d95 |
C:\Users\Admin\AppData\Roaming\ldEXan5S.exe
| MD5 | e3e1f7fa42dd68f410bb885f0aefe5e3 |
| SHA1 | d51edc519d86a11e6533cd4cac8f190dd3f7d4bb |
| SHA256 | 1d686b05f745875e28939abe357baedd169b59f5a0d8825b602fd803a6303ba3 |
| SHA512 | 92ac0379074366a4dbb9235d8c61935be6d8086629611dbcdecdaf680a0a8636f7810d4f6394dbdee5b1e463842284ab9855534da4627677965557e8eb609aa3 |
memory/2124-280-0x0000000000630000-0x0000000000954000-memory.dmp
memory/4360-295-0x0000024565C80000-0x0000024565E9C000-memory.dmp
memory/5004-299-0x00000000003A0000-0x00000000003B8000-memory.dmp
memory/3360-301-0x000000001B260000-0x000000001B2B0000-memory.dmp
memory/3360-302-0x000000001BCE0000-0x000000001BD92000-memory.dmp
memory/3360-305-0x000000001B3F0000-0x000000001B402000-memory.dmp
memory/3360-306-0x000000001B450000-0x000000001B48C000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-28 15:58
Reported
2024-07-28 16:01
Platform
win11-20240709-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
AsyncRat
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Sets file to hidden
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uh9VlmUi.exe | C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uh9VlmUi.exe | C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\browser\edge.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\EzVFgpbO.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyProgram = "C:\\Users\\Admin\\AppData\\Roaming\\uh9VlmUi.exe" | C:\Windows\system32\reg.exe | N/A |
Embeds OpenSSL
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Modifies registry key
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\reg.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\browser\edge.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\EzVFgpbO.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe
"C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe"
C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe
"C:\Users\Admin\AppData\Local\Temp\8cf0382f7f56bc86f6d5cf41a76b23d0cbc64dacf467b84f3c94866951eb9561.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableIOAVProtection $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisablePrivacyMode $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -DisableArchiveScanning $true"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -MAPSReporting Disabled"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -SubmitSamplesConsent 2"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -HighThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -ModerateThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -LowThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-MpPreference -SevereThreatDefaultAction 6 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' -Name 'SmartScreenEnabled' -Value 'Off' -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Edge\SmartScreenEnabled' -Name 'SmartScreenEnabled' -Value 0 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Edge\SmartScreenPuaEnabled' -Name 'SmartScreenPuaEnabled' -Value 0 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost' -Name 'EnableWebContentEvaluation' -Value 0 -Force"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\AppHost' -Name 'PreventOverride' -Value 0 -Force"
C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe
C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\browser\edge.exe" /rl HIGHEST /f
C:\Users\Admin\AppData\Roaming\browser\edge.exe
"C:\Users\Admin\AppData\Roaming\browser\edge.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyProgram /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe" /f"
C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v MyProgram /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe" /f
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c attrib +s +h "C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe"
C:\Windows\system32\attrib.exe
attrib +s +h "C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe"
C:\Users\Admin\AppData\Roaming\EzVFgpbO.exe
C:\Users\Admin\AppData\Roaming\EzVFgpbO.exe
C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Chrome" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\browser\edge.exe" /rl HIGHEST /f
Network
| Country | Destination | Domain | Proto |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| US | 8.8.8.8:53 | 9.11.42.193.in-addr.arpa | udp |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| DE | 193.42.11.9:80 | 193.42.11.9 | tcp |
| DE | 193.42.11.9:4329 | tcp | |
| DE | 195.201.57.90:443 | ipwho.is | tcp |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| N/A | 127.0.0.1:4449 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| TR | 45.141.151.163:80 | tcp | |
| N/A | 127.0.0.1:4449 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI16162\python312.dll
| MD5 | d521654d889666a0bc753320f071ef60 |
| SHA1 | 5fd9b90c5d0527e53c199f94bad540c1e0985db6 |
| SHA256 | 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2 |
| SHA512 | 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\base_library.zip
| MD5 | 43935f81d0c08e8ab1dfe88d65af86d8 |
| SHA1 | abb6eae98264ee4209b81996c956a010ecf9159b |
| SHA256 | c611943f0aeb3292d049437cb03500cc2f8d12f23faf55e644bca82f43679bc0 |
| SHA512 | 06a9dcd310aa538664b08f817ec1c6cfa3f748810d76559c46878ea90796804904d41ac79535c7f63114df34c0e5de6d0452bb30df54b77118d925f21cfa1955 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_ctypes.pyd
| MD5 | fb454c5e74582a805bc5e9f3da8edc7b |
| SHA1 | 782c3fa39393112275120eaf62fc6579c36b5cf8 |
| SHA256 | 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1 |
| SHA512 | 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\python3.DLL
| MD5 | a07661c5fad97379cf6d00332999d22c |
| SHA1 | dca65816a049b3cce5c4354c3819fef54c6299b0 |
| SHA256 | 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b |
| SHA512 | 6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_cffi_backend.cp312-win_amd64.pyd
| MD5 | 0572b13646141d0b1a5718e35549577c |
| SHA1 | eeb40363c1f456c1c612d3c7e4923210eae4cdf7 |
| SHA256 | d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7 |
| SHA512 | 67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\libssl-3.dll
| MD5 | 19a2aba25456181d5fb572d88ac0e73e |
| SHA1 | 656ca8cdfc9c3a6379536e2027e93408851483db |
| SHA256 | 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006 |
| SHA512 | df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_ssl.pyd
| MD5 | c87c5890039c3bdb55a8bc189256315f |
| SHA1 | 84ef3c2678314b7f31246471b3300da65cb7e9de |
| SHA256 | a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2 |
| SHA512 | e750dc36ae00249ed6da1c9d816f1bd7f8bc84ddea326c0cd0410dbcfb1a945aac8c130665bfacdccd1ee2b7ac097c6ff241bfc6cc39017c9d1cde205f460c44 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_decimal.pyd
| MD5 | 492c0c36d8ed1b6ca2117869a09214da |
| SHA1 | b741cae3e2c9954e726890292fa35034509ef0f6 |
| SHA256 | b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1 |
| SHA512 | b8f1c64ad94db0252d96082e73a8632412d1d73fb8095541ee423df6f00bc417a2b42c76f15d7e014e27baae0ef50311c3f768b1560db005a522373f442e4be0 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_socket.pyd
| MD5 | dd8ff2a3946b8e77264e3f0011d27704 |
| SHA1 | a2d84cfc4d6410b80eea4b25e8efc08498f78990 |
| SHA256 | b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085 |
| SHA512 | 958224a974a3449bcfb97faab70c0a5b594fa130adc0c83b4e15bdd7aab366b58d94a4a9016cb662329ea47558645acd0e0cc6df54f12a81ac13a6ec0c895cd8 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_queue.pyd
| MD5 | b7e5fbd7ef3eefff8f502290c0e2b259 |
| SHA1 | 9decba47b1cdb0d511b58c3146d81644e56e3611 |
| SHA256 | dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173 |
| SHA512 | b7568b9df191347d1a8d305bd8ddd27cbfa064121c785fa2e6afef89ec330b60cafc366be2b22409d15c9434f5e46e36c5cbfb10783523fdcac82c30360d36f7 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_lzma.pyd
| MD5 | 195defe58a7549117e06a57029079702 |
| SHA1 | 3795b02803ca37f399d8883d30c0aa38ad77b5f2 |
| SHA256 | 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a |
| SHA512 | c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_hashlib.pyd
| MD5 | da02cefd8151ecb83f697e3bd5280775 |
| SHA1 | 1c5d0437eb7e87842fde55241a5f0ca7f0fc25e7 |
| SHA256 | fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354 |
| SHA512 | a13bc5c481730f48808905f872d92cb8729cc52cfb4d5345153ce361e7d6586603a58b964a1ebfd77dd6222b074e5dcca176eaaefecc39f75496b1f8387a2283 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\_bz2.pyd
| MD5 | 5bebc32957922fe20e927d5c4637f100 |
| SHA1 | a94ea93ee3c3d154f4f90b5c2fe072cc273376b3 |
| SHA256 | 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62 |
| SHA512 | afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\unicodedata.pyd
| MD5 | cc8142bedafdfaa50b26c6d07755c7a6 |
| SHA1 | 0fcab5816eaf7b138f22c29c6d5b5f59551b39fe |
| SHA256 | bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268 |
| SHA512 | c3b0c1dbe5bf159ab7706f314a75a856a08ebb889f53fe22ab3ec92b35b5e211edab3934df3da64ebea76f38eb9bfc9504db8d7546a36bc3cabe40c5599a9cbd |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\select.pyd
| MD5 | d0cc9fc9a0650ba00bd206720223493b |
| SHA1 | 295bc204e489572b74cc11801ed8590f808e1618 |
| SHA256 | 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019 |
| SHA512 | d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\libcrypto-3.dll
| MD5 | e547cf6d296a88f5b1c352c116df7c0c |
| SHA1 | cafa14e0367f7c13ad140fd556f10f320a039783 |
| SHA256 | 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de |
| SHA512 | 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\charset_normalizer\md.cp312-win_amd64.pyd
| MD5 | d9e0217a89d9b9d1d778f7e197e0c191 |
| SHA1 | ec692661fcc0b89e0c3bde1773a6168d285b4f0d |
| SHA256 | ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0 |
| SHA512 | 3b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
| MD5 | bf9a9da1cf3c98346002648c3eae6dcf |
| SHA1 | db16c09fdc1722631a7a9c465bfe173d94eb5d8b |
| SHA256 | 4107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637 |
| SHA512 | 7371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\certifi\cacert.pem
| MD5 | 181ac9a809b1a8f1bc39c1c5c777cf2a |
| SHA1 | 9341e715cea2e6207329e7034365749fca1f37dc |
| SHA256 | 488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee |
| SHA512 | e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85 |
C:\Users\Admin\AppData\Local\Temp\_MEI16162\cryptography\hazmat\bindings\_rust.pyd
| MD5 | b98d491ead30f30e61bc3e865ab72f18 |
| SHA1 | db165369b7f2ae513b51c4f3def9ea2668268221 |
| SHA256 | 35d5aeb890b99e6bae3e6b863313fbc8a1a554acbcd416fe901b1e1ae2993c98 |
| SHA512 | 044c9c39bddb13020ed865d3aa30926460ae6ded5fdea59eca2b1cf6a4ded55728d883f19ee0749f95a4d93f66e04fcc62bc3be67119c4ccabd17b003cf5f3c4 |
memory/4172-72-0x00007FFB62FE3000-0x00007FFB62FE5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2tqggylt.hhg.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4172-81-0x000001EDB1570000-0x000001EDB1592000-memory.dmp
memory/4172-82-0x00007FFB62FE0000-0x00007FFB63AA2000-memory.dmp
memory/4172-83-0x00007FFB62FE0000-0x00007FFB63AA2000-memory.dmp
memory/4172-84-0x00007FFB62FE0000-0x00007FFB63AA2000-memory.dmp
memory/4172-87-0x00007FFB62FE0000-0x00007FFB63AA2000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 627073ee3ca9676911bee35548eff2b8 |
| SHA1 | 4c4b68c65e2cab9864b51167d710aa29ebdcff2e |
| SHA256 | 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c |
| SHA512 | 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 408641808e457ab6e23d62e59b767753 |
| SHA1 | 4205cfa0dfdfee6be08e8c0041d951dcec1d3946 |
| SHA256 | 3921178878eb416764a6993c4ed81a1f371040dda95c295af535563f168b4258 |
| SHA512 | e7f3ffc96c7caad3d73c5cec1e60dc6c7d5ed2ced7d265fbd3a402b6f76fed310a087d2d5f0929ab90413615dad1d54fce52875750057cffe36ff010fc6323fb |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 8cb7f4b4ab204cacd1af6b29c2a2042c |
| SHA1 | 244540c38e33eac05826d54282a0bfa60340d6a1 |
| SHA256 | 4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6 |
| SHA512 | 7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 165bc3a69d848785a8d3c6764ff7407a |
| SHA1 | ff2b5ee2bcff6b42d3da03da97b3c89f3aa9c75b |
| SHA256 | 740f680a942279b7f103ecacd5f35906ba3d6c028c2908a37c35c9b435869587 |
| SHA512 | 3c4c5a29b3ba1f5baa68a6070ee61663e598bda622b7df3d37f4ca42c6f4cbbe6ae56c41a5bffa0682a0304552a83a05a856ccda83878bc1678336e5f5897daa |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 3ac102a242951c2d9c84955d39a30a76 |
| SHA1 | d85b46ddcb8a895a384c5399d7de95bb9eba8446 |
| SHA256 | c8909b2b4a5366f114b25f4c514ab5faea6d1f61b3cbdcf3f1f2336d7b76a54c |
| SHA512 | 8d798c9751c7337907352795b4c831f05da1f3fd966eec5b771f661ec3b59c3f706f90a7d1484763a9b2ba363672927847ebf5cb85f4785683d7abefbea50111 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 3c0fe86517be16d2b0a671148c0274d2 |
| SHA1 | bd7a487a037395e9ede9e76b4a455fdf386ba8db |
| SHA256 | 5f85aaa0472b8ae98352b7295cd59357e3e585b2299c540e9a8b5848a8d6b302 |
| SHA512 | 642bc58c0a5682b45056e837be0dc5d1cd8c400f0e73f20d17c19720fb1fdae132b86873100955e9d65f72f1d481704b84c30d440ca53898c6d6d6f106b74f0a |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 052b734e3d0b49bccde40def527c10df |
| SHA1 | 2ac7c9bd7dc7bd54699fd06252a89a963e1c1ec0 |
| SHA256 | d51b94b595a5bee567d89011dc8d97f6210a7911828e5a24172708d5a177f65f |
| SHA512 | bbe94350f51a4029f44631e5bb6658d9583d46011db3ca3159a21b179ab7dc7b200a27ccdf34897fdcba890acec2cdb84a2c1ba0cd95360478e38e911f56f4ba |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 9f7c179fc32b42fa4b7b4d0ef32fc33e |
| SHA1 | a4c680964fe488f273fbf60c3bd62b8c4311f677 |
| SHA256 | 750e576dd2c7cbca19c71c92367808954462403a4d5e38446ddfbaa9f98ad9fd |
| SHA512 | 573e0bf91581565e26163a6930504732a0f1f6f6c6ae90c1f5fbfe8d9944375969916053bd642f625b6d202605aeadbafb193e5b7e6d5b8dfef7a45eaa868728 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | a333e0102d6e6eebdcc3b85ef51a543b |
| SHA1 | 7f6d4b3dbc82495c6093e3057f6f8920cc2b4c62 |
| SHA256 | 25db3b4efc8bcf6c6e44d5e19eb0bee3b52bc6dc1f270429cc2f930bc892e8d3 |
| SHA512 | a76e62f6eb99ec0c5588fc89d12a146d7e8f56f300f28972741fe32944513c9347f05ac6082b0e09c3d1bb7f59bb1c56521aed234bfef519b5cfcc958be2cd48 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d70b0a49b2727a97cc322ea54d2a66c7 |
| SHA1 | 57d984bd970307ad80665d97f5369ad644de8776 |
| SHA256 | bc38ea6605142cb9ec440231b665a5c5a53c499c7e25a77a94eb6491efdd2a65 |
| SHA512 | 90790e506f7453a63d4915fb50c7694184c3bc5b836979d19c15a240c6145d9bbc33d393007f4b39a782e789f6259974a1824e79e960a64c5f8703e4797fdd0d |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b6c336e3b3cb2cd04d42baac1aa4aa0d |
| SHA1 | 35a943816f3e9cd596e91be92c4bdb1b05a42d88 |
| SHA256 | 4518fb6ffb3f70be78cb243cac94fcf74d9c58d2e7bd8c510ebe696d3f81cb60 |
| SHA512 | 42c4a8f07051ac7c00014ddaa0b0db50bdbcb49a30ae96803e37f3a566c100932367e0a50baead881509ae4a4d49c769513626c5015fe0a02d1d3ae22ca759f4 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | c6121e0c42fbe0338296040197abfe3f |
| SHA1 | ba2d9897aa20d62e2c63fdfe041d4996cdd9a03d |
| SHA256 | 4d19541e2be70f2aad98180ad59670e499b790a0c47915d1e0a47fa0389b420c |
| SHA512 | de07b297e99e79cf997f08cff4c209353282e66b531d8a7473075a8fa385c3b22a2f423a86e7c1204feaf998667636029cf42243660bbb5d9e5039c968b5d3ce |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | a6c9d692ed2826ecb12c09356e69cc09 |
| SHA1 | def728a6138cf083d8a7c61337f3c9dade41a37f |
| SHA256 | a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b |
| SHA512 | 2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | ea292e0d870c21833e86a33dbdbeb4b5 |
| SHA1 | 1d4ea5bf2aa655df1a7dfe1542e8a0c11b10410b |
| SHA256 | b06ce1c537b90fb95d640ec13aee0cccd4fcf225e2dde619cb3ac3def3ea8e78 |
| SHA512 | d6a7eb9de74196491f1f81cef9273b3259ffd2be51b68e17dd2fb336a7543b385ebe6d95cd57aeae9296395a51a8e3446ba14a2b8b938ab745d7df5c8e1deae2 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d88bc90e3979274e537215a08696f953 |
| SHA1 | ad3034e5c0219989aa3b120838e627734f220e1b |
| SHA256 | 133b387a643bef958be69e01cf5c6bbb15a76bcca2655e5d8bab438e71f4c9ff |
| SHA512 | b0028a796970c3d9f5b45d456e05e08cbeb7964edaf06c9ae6227464b659eac979ae847ddf23d6cde33c4fbca73f009f75d2eac3a26a42c1f8fa090c889aa6b3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | c2d8a34deffd0c25df3bbe0e5cdc27d0 |
| SHA1 | 48efe8599da1e68014686b024301b6aeb1cfa672 |
| SHA256 | e31b8f6293f73dd2ccf81b397f2f81e74f2d7c0a4ec9bc67a8d999114519b265 |
| SHA512 | 507ea6b94c61f058ae2931e57f81dd293b280ed95979848020af8fbcf5fc7498759bb994cd7858f1f31601111dd6d7325d13041dff47137089e54d73829650a0 |
C:\Users\Admin\AppData\Roaming\uh9VlmUi.exe
| MD5 | e3e1f7fa42dd68f410bb885f0aefe5e3 |
| SHA1 | d51edc519d86a11e6533cd4cac8f190dd3f7d4bb |
| SHA256 | 1d686b05f745875e28939abe357baedd169b59f5a0d8825b602fd803a6303ba3 |
| SHA512 | 92ac0379074366a4dbb9235d8c61935be6d8086629611dbcdecdaf680a0a8636f7810d4f6394dbdee5b1e463842284ab9855534da4627677965557e8eb609aa3 |
memory/1416-263-0x0000000000440000-0x0000000000764000-memory.dmp
memory/4700-280-0x0000000000B00000-0x0000000000B18000-memory.dmp
memory/4364-283-0x000000001CAA0000-0x000000001CB52000-memory.dmp
memory/4364-282-0x000000001BF70000-0x000000001BFC0000-memory.dmp
memory/4364-286-0x000000001CA20000-0x000000001CA32000-memory.dmp
memory/4364-287-0x000000001D1B0000-0x000000001D1EC000-memory.dmp