quasar | 1cdd2cd88644b2d634ac27b95031bddcbb69479bf6bdd090a2257e40132a69c2

Resubmissions

04-07-2024 22:35

240704-2hv1havgnh 10

04-07-2024 22:32

240704-2gcgrsshnp 10

Analysis

max time kernel
133s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04-07-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SlottedAimV2.exe
Size

7.0MB
MD5

decace854bd66eba96581505cbb1f785
SHA1

dfd6824e2db3a2ebb89208f0e5f69e6cc1661da6
SHA256

ebbdf48aafe6c046eca7512a4e764629559392147518fdf2917751a891bfcd5d
SHA512

e55f8afc9a36913aaa24932a94b82100a53accd4f5d8865fc207c9b50c607efa259115d53d5926e0b45c99c0b9dece02996a6b8db5d365af122ccbcdd69823c8
SSDEEP

196608:WrSUf0qyleOjmFQR4MVGFtwLPCnL2hVcL:PVXKtM5LPCGcL

Score

10^/10

quasar fortnite evasion execution spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

FORTNITE

hanekese.ddns.net:1005

Mutex

QSR_MUTEX_uKpgto5HxTzlVefHo9

Attributes

encryption_key
RayN5IunUgPITKqRBUZA
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
mac updater
subdirectory
SubDir

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Processes:

MpCmdRun.exe

pid process

2444 MpCmdRun.exe
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\bound.exe family_quasar
behavioral2/memory/2944-108-0x0000000000DB0000-0x0000000000E0E000-memory.dmp family_quasar
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1824 powershell.exe
4788 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

bound.exebound.exe

pid process

2944 bound.exe
5100 bound.exe

pid	process
2444	MpCmdRun.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\bound.exe	family_quasar
behavioral2/memory/2944-108-0x0000000000DB0000-0x0000000000E0E000-memory.dmp	family_quasar

pid	process
2944	bound.exe
5100	bound.exe

Loads dropped DLL 17 IoCs

Processes:

SlottedAimV2.exe

pid	process
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe
704	SlottedAimV2.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI39842\python311.dll	upx
behavioral2/memory/704-30-0x00007FFEB9310000-0x00007FFEB98F9000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_ctypes.pyd	upx
\Users\Admin\AppData\Local\Temp\_MEI39842\libffi-8.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_ssl.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_sqlite3.pyd	upx
behavioral2/memory/704-54-0x00007FFECFFB0000-0x00007FFECFFBF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\libssl-1_1.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI39842\libcrypto-1_1.dll	upx
behavioral2/memory/704-53-0x00007FFECC720000-0x00007FFECC743000-memory.dmp	upx
behavioral2/memory/704-60-0x00007FFECC6F0000-0x00007FFECC71D000-memory.dmp	upx
behavioral2/memory/704-62-0x00007FFECC6B0000-0x00007FFECC6C9000-memory.dmp	upx
behavioral2/memory/704-64-0x00007FFECC680000-0x00007FFECC6A3000-memory.dmp	upx
behavioral2/memory/704-66-0x00007FFEC8A60000-0x00007FFEC8BD0000-memory.dmp	upx
behavioral2/memory/704-68-0x00007FFECC660000-0x00007FFECC679000-memory.dmp	upx
behavioral2/memory/704-70-0x00007FFECC440000-0x00007FFECC44D000-memory.dmp	upx
behavioral2/memory/704-72-0x00007FFEC97E0000-0x00007FFEC980E000-memory.dmp	upx
behavioral2/memory/704-74-0x00007FFEC9360000-0x00007FFEC9418000-memory.dmp	upx
behavioral2/memory/704-78-0x00007FFEB8F90000-0x00007FFEB9309000-memory.dmp	upx
behavioral2/memory/704-80-0x00007FFECC720000-0x00007FFECC743000-memory.dmp	upx
behavioral2/memory/704-77-0x00007FFEB9310000-0x00007FFEB98F9000-memory.dmp	upx
behavioral2/memory/704-85-0x00007FFECC430000-0x00007FFECC43D000-memory.dmp	upx
behavioral2/memory/704-84-0x00007FFECC6B0000-0x00007FFECC6C9000-memory.dmp	upx
behavioral2/memory/704-83-0x00007FFEC9720000-0x00007FFEC9734000-memory.dmp	upx
behavioral2/memory/704-89-0x00007FFEC8940000-0x00007FFEC8A5C000-memory.dmp	upx
behavioral2/memory/704-88-0x00007FFECC680000-0x00007FFECC6A3000-memory.dmp	upx
behavioral2/memory/704-233-0x00007FFEB9310000-0x00007FFEB98F9000-memory.dmp	upx
behavioral2/memory/704-240-0x00007FFECC660000-0x00007FFECC679000-memory.dmp	upx
behavioral2/memory/704-257-0x00007FFEC9360000-0x00007FFEC9418000-memory.dmp	upx
behavioral2/memory/704-256-0x00007FFEC97E0000-0x00007FFEC980E000-memory.dmp	upx
behavioral2/memory/704-255-0x00007FFECC440000-0x00007FFECC44D000-memory.dmp	upx
behavioral2/memory/704-254-0x00007FFECC430000-0x00007FFECC43D000-memory.dmp	upx
behavioral2/memory/704-253-0x00007FFEC8A60000-0x00007FFEC8BD0000-memory.dmp	upx
behavioral2/memory/704-252-0x00007FFECC680000-0x00007FFECC6A3000-memory.dmp	upx
behavioral2/memory/704-251-0x00007FFECC6B0000-0x00007FFECC6C9000-memory.dmp	upx
behavioral2/memory/704-250-0x00007FFECC6F0000-0x00007FFECC71D000-memory.dmp	upx
behavioral2/memory/704-249-0x00007FFECFFB0000-0x00007FFECFFBF000-memory.dmp	upx
behavioral2/memory/704-248-0x00007FFECC720000-0x00007FFECC743000-memory.dmp	upx
behavioral2/memory/704-247-0x00007FFEC8940000-0x00007FFEC8A5C000-memory.dmp	upx
behavioral2/memory/704-245-0x00007FFEC9720000-0x00007FFEC9734000-memory.dmp	upx
behavioral2/memory/704-244-0x00007FFEB8F90000-0x00007FFEB9309000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3432 2944 WerFault.exe bound.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

3604 tasklist.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4388 PING.EXE

flow	ioc
2	ip-api.com

pid	pid_target	process	target process
3432	2944	WerFault.exe	bound.exe

pid	process
3604	tasklist.exe

pid	process
4388	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
1824	powershell.exe
1316	powershell.exe
4788	powershell.exe
1316	powershell.exe
4788	powershell.exe
1824	powershell.exe
1316	powershell.exe
4788	powershell.exe
4788	powershell.exe
1824	powershell.exe
1824	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tasklist.exepowershell.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3604	tasklist.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeIncreaseQuotaPrivilege	5012	WMIC.exe
Token: SeSecurityPrivilege	5012	WMIC.exe
Token: SeTakeOwnershipPrivilege	5012	WMIC.exe
Token: SeLoadDriverPrivilege	5012	WMIC.exe
Token: SeSystemProfilePrivilege	5012	WMIC.exe
Token: SeSystemtimePrivilege	5012	WMIC.exe
Token: SeProfSingleProcessPrivilege	5012	WMIC.exe
Token: SeIncBasePriorityPrivilege	5012	WMIC.exe
Token: SeCreatePagefilePrivilege	5012	WMIC.exe
Token: SeBackupPrivilege	5012	WMIC.exe
Token: SeRestorePrivilege	5012	WMIC.exe
Token: SeShutdownPrivilege	5012	WMIC.exe
Token: SeDebugPrivilege	5012	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5012	WMIC.exe
Token: SeRemoteShutdownPrivilege	5012	WMIC.exe
Token: SeUndockPrivilege	5012	WMIC.exe
Token: SeManageVolumePrivilege	5012	WMIC.exe
Token: 33	5012	WMIC.exe
Token: 34	5012	WMIC.exe
Token: 35	5012	WMIC.exe
Token: 36	5012	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4788	powershell.exe
Token: SeSecurityPrivilege	4788	powershell.exe
Token: SeTakeOwnershipPrivilege	4788	powershell.exe
Token: SeLoadDriverPrivilege	4788	powershell.exe
Token: SeSystemProfilePrivilege	4788	powershell.exe
Token: SeSystemtimePrivilege	4788	powershell.exe
Token: SeProfSingleProcessPrivilege	4788	powershell.exe
Token: SeIncBasePriorityPrivilege	4788	powershell.exe
Token: SeCreatePagefilePrivilege	4788	powershell.exe
Token: SeBackupPrivilege	4788	powershell.exe
Token: SeRestorePrivilege	4788	powershell.exe
Token: SeShutdownPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeSystemEnvironmentPrivilege	4788	powershell.exe
Token: SeRemoteShutdownPrivilege	4788	powershell.exe
Token: SeUndockPrivilege	4788	powershell.exe
Token: SeManageVolumePrivilege	4788	powershell.exe
Token: 33	4788	powershell.exe
Token: 34	4788	powershell.exe
Token: 35	4788	powershell.exe
Token: 36	4788	powershell.exe
Token: SeIncreaseQuotaPrivilege	1824	powershell.exe
Token: SeSecurityPrivilege	1824	powershell.exe
Token: SeTakeOwnershipPrivilege	1824	powershell.exe
Token: SeLoadDriverPrivilege	1824	powershell.exe
Token: SeSystemProfilePrivilege	1824	powershell.exe
Token: SeSystemtimePrivilege	1824	powershell.exe
Token: SeProfSingleProcessPrivilege	1824	powershell.exe
Token: SeIncBasePriorityPrivilege	1824	powershell.exe
Token: SeCreatePagefilePrivilege	1824	powershell.exe
Token: SeBackupPrivilege	1824	powershell.exe
Token: SeRestorePrivilege	1824	powershell.exe
Token: SeShutdownPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeSystemEnvironmentPrivilege	1824	powershell.exe
Token: SeRemoteShutdownPrivilege	1824	powershell.exe
Token: SeUndockPrivilege	1824	powershell.exe
Token: SeManageVolumePrivilege	1824	powershell.exe
Token: 33	1824	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bound.exe

pid process

2944 bound.exe

pid	process
2944	bound.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

SlottedAimV2.exeSlottedAimV2.execmd.execmd.execmd.execmd.execmd.execmd.exebound.execmd.exe

description	pid	process	target process
PID 3984 wrote to memory of 704	3984	SlottedAimV2.exe	SlottedAimV2.exe
PID 3984 wrote to memory of 704	3984	SlottedAimV2.exe	SlottedAimV2.exe
PID 704 wrote to memory of 4236	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 4236	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 1364	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 1364	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 3228	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 3228	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 1944	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 1944	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 428	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 428	704	SlottedAimV2.exe	cmd.exe
PID 428 wrote to memory of 3604	428	cmd.exe	tasklist.exe
PID 428 wrote to memory of 3604	428	cmd.exe	tasklist.exe
PID 4236 wrote to memory of 1824	4236	cmd.exe	powershell.exe
PID 4236 wrote to memory of 1824	4236	cmd.exe	powershell.exe
PID 1364 wrote to memory of 1316	1364	cmd.exe	powershell.exe
PID 1364 wrote to memory of 1316	1364	cmd.exe	powershell.exe
PID 3228 wrote to memory of 4788	3228	cmd.exe	powershell.exe
PID 3228 wrote to memory of 4788	3228	cmd.exe	powershell.exe
PID 1944 wrote to memory of 2944	1944	cmd.exe	bound.exe
PID 1944 wrote to memory of 2944	1944	cmd.exe	bound.exe
PID 1944 wrote to memory of 2944	1944	cmd.exe	bound.exe
PID 704 wrote to memory of 3816	704	SlottedAimV2.exe	cmd.exe
PID 704 wrote to memory of 3816	704	SlottedAimV2.exe	cmd.exe
PID 3816 wrote to memory of 5012	3816	cmd.exe	WMIC.exe
PID 3816 wrote to memory of 5012	3816	cmd.exe	WMIC.exe
PID 1364 wrote to memory of 2444	1364	cmd.exe	MpCmdRun.exe
PID 1364 wrote to memory of 2444	1364	cmd.exe	MpCmdRun.exe
PID 2944 wrote to memory of 4944	2944	bound.exe	cmd.exe
PID 2944 wrote to memory of 4944	2944	bound.exe	cmd.exe
PID 2944 wrote to memory of 4944	2944	bound.exe	cmd.exe
PID 4944 wrote to memory of 4440	4944	cmd.exe	chcp.com
PID 4944 wrote to memory of 4440	4944	cmd.exe	chcp.com
PID 4944 wrote to memory of 4440	4944	cmd.exe	chcp.com
PID 4944 wrote to memory of 4388	4944	cmd.exe	PING.EXE
PID 4944 wrote to memory of 4388	4944	cmd.exe	PING.EXE
PID 4944 wrote to memory of 4388	4944	cmd.exe	PING.EXE
PID 4944 wrote to memory of 5100	4944	cmd.exe	bound.exe
PID 4944 wrote to memory of 5100	4944	cmd.exe	bound.exe
PID 4944 wrote to memory of 5100	4944	cmd.exe	bound.exe

C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
"C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe
"C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SlottedAimV2.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
3⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
4⤵
- Deletes Windows Defender Definitions
PID:2444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:3228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "start bound.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Local\Temp\bound.exe
bound.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\36FW0OTBAKHV.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:4440

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:4388

C:\Users\Admin\AppData\Local\Temp\bound.exe
"C:\Users\Admin\AppData\Local\Temp\bound.exe"
6⤵
- Executes dropped EXE
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 2108
5⤵
- Program crash
PID:3432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5012

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
582ade9f5ffdee7dccb2814175095366

SHA1
816d713a7a7a017b2691d3240fcd8762daceab28

SHA256
497aaf8a1314a11d82b0a19b78be005afb71d679c4dca237bfea615ba5d41c53

SHA512
482303ac202a325ba7a10db7022ec60a6bf92bf672aeec49ca267e7f6fb8eddf8b2742b682a7592ef7a5941f23a51fd8087024a6e6b02a6332d689e159f22256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
3fe20f5f8dcd6e42a7d1116d8b283364

SHA1
28c0d5beb83f9b168fb3ea54e5b7c2c2e9f2197f

SHA256
653457bfd3826191c6ffc6ad2bb413ac265effec16b33b7d07d381880da1b497

SHA512
de33af9e4166ac2cb9674eba4e2a182375d17717114a7fc44828ddf920b26036a77f710f2785a7496e75532d54b5ec221b5822eafda4a80ec2d9e10360938968

Download Submit
C:\Users\Admin\AppData\Local\Temp\36FW0OTBAKHV.bat
Filesize
202B

MD5
e6ee7ad8c85dab4a8054f67dfbd4c340

SHA1
f3320a8506a39c790c683382de0534ff97405750

SHA256
35f49e7df57594cc220ace87ccf097f1dd063a1164a7198b6319d23a205a0b55

SHA512
6e3f9e56b31c8a23ae5c71e1ad933e708ba7713d2c0e28be9fd6d09ebb8e7183a1568b897b47a3829fc1738508ebfeb7dfbb9376246faa4cc38279b97daf4dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\VCRUNTIME140.dll
Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_bz2.pyd
Filesize
48KB

MD5
554b7b0d0daca993e22b7d31ed498bc2

SHA1
ea7f1823e782d08a99b437c665d86fa734fe3fe4

SHA256
1db14a217c5279c106b9d55f440ccf19f35ef3a580188353b734e3e39099b13f

SHA512
4b36097eddd2c1d69ac98c7e98eebe7bb11a5117249ad36a99883732f643e21ecf58e6bea33b70974d600563dc0b0a30bead98bafb72537f8374b3d67979e60a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_ctypes.pyd
Filesize
58KB

MD5
d603c8bfe4cfc71fe5134d64be2e929b

SHA1
ff27ea58f4f5b11b7eaa1c8884eac658e2e9248b

SHA256
5ee40bcaab13fa9cf064ecae6fc0da6d236120c06fa41602893f1010efaa52fe

SHA512
fcc0dbfbe402300ae47e1cb2469d1f733a910d573328fe7990d69625e933988ecc21ab22f432945a78995129885f4a9392e1cee224d14e940338046f61abe361

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_decimal.pyd
Filesize
106KB

MD5
9cef71be6a40bc2387c383c217d158c7

SHA1
dd6bc79d69fc26e003d23b4e683e3fac21bc29cb

SHA256
677d9993bb887fef60f6657de6c239086ace7725c68853e7636e2ff4a8f0d009

SHA512
90e02054163d44d12c603debdc4213c5a862f609617d78dd29f7fd21a0bae82add4ceaf30024da681c2a65d08a8142c83eb81d8294f1284edfbeeb7d66c371c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_hashlib.pyd
Filesize
35KB

MD5
32df18692606ce984614c7efda2eec27

SHA1
86084e39ab0aadf0ecfb82ce066b7bf14152961e

SHA256
b7c9c540d54ab59c16936e1639c6565cd35a8ca625f31753e57db9cbd0ee0065

SHA512
679f8956370edc4dee32475d8440a2d2f9b6dd0edd0e033e49fed7834a35c7ed51ccde0995d19ed0a559a4383b99ae8c11e4e686902db12a2a5e0a3f2c0f4a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_lzma.pyd
Filesize
85KB

MD5
01629284f906c40f480e80104158f31a

SHA1
6ab85c66956856710f32aed6cdae64a60aea5f0f

SHA256
a201ec286b0233644ae62c6e418588243a3f2a0c5a6f556e0d68b3c747020812

SHA512
107a4e857dd78dd92be32911e3a574f861f3425e01ab4b1a7580ac799dc76122ce3165465d24c34ac7fc8f2810547ad72b4d4ba3de76d3d61ed9bf5b92e7f7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_queue.pyd
Filesize
25KB

MD5
4a313dc23f9d0a1f328c74dd5cf3b9ab

SHA1
494f1f5ead41d41d324c82721ab7ca1d1b72c062

SHA256
2163010bfde88a6cc15380516d31955935e243b7ad43558a89380bf5fe86337e

SHA512
42c712b758b35c0005b3528af586233298c2df4ed9f5133b8469bca9ec421ab151ce63f3929898c73d616cd9707594fa5f96d623fc150e214a4b2276c23c296e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_socket.pyd
Filesize
43KB

MD5
67897f8c3262aecb8c9f15292dd1e1f0

SHA1
74f1ef77dd3265846a504f98f2e2f080eadbf58a

SHA256
ddbfa852e32e20d67a0c3d718ce68e9403c858d5cad44ea6404aff302556aba7

SHA512
200b6570db2fbb2eac7f51cae8e16ffb89cd46d13fba94a7729a675f10f4432fc89a256fd6bd804feac528191bd116407fd58a0573487d905fc8fca022c1abba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_sqlite3.pyd
Filesize
56KB

MD5
230025cf18b0c20c5f4abba63d733ca8

SHA1
336248fde1973410a0746599e14485d068771e30

SHA256
30a3bc9ed8f36e3065b583d56503b81297f32b4744bff72dcf918407978ce332

SHA512
2c4d943c6587d28763cf7c21ad37cc4762674a75c643994b3e8e7c7b20576d5674cf700fdfaddc1a834d9bf034bf2f449d95351c236fde720505ccdd03369bb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\_ssl.pyd
Filesize
62KB

MD5
0d15b2fdfa03be76917723686e77823c

SHA1
efd799a4a5e4f9d15226584dd2ee03956f37bdaf

SHA256
2fc63abe576c0d5fe031cf7ee0e2f11d9c510c6dbacfc5dd2e79e23da3650ee8

SHA512
e21ab5ebe8b97243cf32ca9181c311978e203852847e4beb5e6ada487038c37dec18a2b683e11e420e05ace014aca2172b2dda15930bab944053843e25623227

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\base_library.zip
Filesize
1.4MB

MD5
5011d68fbea0156fe813d00c1f7d9af2

SHA1
d76d817cac04d830707ce97b4d0d582a988e1dbd

SHA256
b9e9569931047cd6a455ec826791c2e6c249c814dc0fa71f0bd7fa7f49b8948d

SHA512
6a5affde07b5150b5aee854851f9f68c727b0f5ba83513c294d27461546a5ef67bf6c5869fc4abdadaa9bf1767ea897910c640c5494b659a29004050c9c5d099

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\blank.aes
Filesize
120KB

MD5
d327f95ce6828db909357a23704693cb

SHA1
bef945fba44e447647cc93bde6fcfa0c481f7bfa

SHA256
d010028449eb4fc8a33fb3da6bb7ab0288509d949a31e0ba747bc43fba59f44c

SHA512
ec4ffd8aec6ecdbd85ee2232de985b3ec51ce84a5de2004580d06d287adbdb11d57f449c2a6fb60b1af619f2d69cc9ed7d93c73042c15bf0f7460d61851ea772

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\blank.aes
Filesize
120KB

MD5
71d7ecf735f8ef7e075300b93e3fa76e

SHA1
f62fca5f38c433e2702655cf91cbdb4c3d74af98

SHA256
3097ec56fee6345bae0702627c9d05c30d37aa99f90f1db09465acf2389e6786

SHA512
45a005961feb6784913895aeb4076926553e01929c1fcf2210592e21a009ecc05050ad1c6e87218158e5049d63a369fdab06dbadcb2a42efd10a2ea0fc7f3c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\bound.blank
Filesize
177KB

MD5
05f04ee72dd6a32cfdc92df575e32005

SHA1
d1289853744f70c66b55aa81bb8407f12c6e12d2

SHA256
054d92782fb6b280ce2df3e5f7099cb49691df0681b6b18bdf6eb1c5ae7e006b

SHA512
355b6bbe81770535f35bac0364b4cff1241b7917edec8d2b9788b7c32673e7112f7c2a8596130632e8d52ad2b7ffda1626bc35dee216e0cd357966411254596e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\libcrypto-1_1.dll
Filesize
1.1MB

MD5
bbc1fcb5792f226c82e3e958948cb3c3

SHA1
4d25857bcf0651d90725d4fb8db03ccada6540c3

SHA256
9a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47

SHA512
3137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\libssl-1_1.dll
Filesize
204KB

MD5
ad0a2b4286a43a0ef05f452667e656db

SHA1
a8835ca75768b5756aa2445ca33b16e18ceacb77

SHA256
2af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1

SHA512
cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\python311.dll
Filesize
1.6MB

MD5
9e985651962ccbccdf5220f6617b444f

SHA1
9238853fe1cff8a49c2c801644d6aa57ed1fe4d2

SHA256
3373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e

SHA512
8b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\rar.exe
Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\rarreg.key
Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\select.pyd
Filesize
25KB

MD5
27703f9a7c7e90e049d5542fb7746988

SHA1
bc9c6f5271def4cc4e9436efa00f231707c01a55

SHA256
fcc744cfccc1c47f6f918e66cfc1b73370d2cecdb776984fabb638745ebe3a38

SHA512
0875ad48842bbac73e59d4b0b5d7083280bde98336c8856160493cc63f7c3a419f4471f19c8537e5c8515e194c6604f9efa07d9d9af5def2f374406d316436a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\sqlite3.dll
Filesize
610KB

MD5
08ce33649d6822ff0776ede46cc65650

SHA1
941535dabdb62c7ca74c32f791d2f4b263ec7d48

SHA256
48f50e8a693f3b1271949d849b9a70c76acaa4c291608d869efe77de1432d595

SHA512
8398e54645093e3f169c0b128cbeda3799d905173c9cb9548962ecbaf3d305620f0316c7c3f27077b148b8f6d3f6146b81c53b235f04ac54668dab05b929d52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39842\unicodedata.pyd
Filesize
295KB

MD5
f86f9b7eb2cb16fb815bb0650d9ef452

SHA1
b9e217146eb6194fc38923af5208119286c365ad

SHA256
b37d56ad48a70b802fb337d721120d753270dbda0854b1bfb600893fb2ce4e7a

SHA512
6c448f6d6c069ba950c555529557f678dfd17c748b2279d5eec530d7eb5db193aa1ca18dd3ce9f5220e8681a0e50b00d7de93c6744476c0e1872dafd9d5de775

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bbpcjbzu.caz.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bound.exe
Filesize
348KB

MD5
e8865c99090822d1527f207d10150db2

SHA1
a28eff2dc4cf726924fa4f916f3ca700eb3cd8f4

SHA256
40037d3459266d5c439db103b007e7fbd39355be90f47091c47059bb5e1d4b2c

SHA512
e8cad9186d82e2a86e80fbc4577b184e64243a9ef38a55b5416f940388330c8be106bcf23b3f490adea53e5e3a3f745eb8b40a7201b2e90bf230beecf1b0d093

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39842\libffi-8.dll
Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
memory/704-77-0x00007FFEB9310000-0x00007FFEB98F9000-memory.dmp

Filesize
5.9MB

Download
memory/704-233-0x00007FFEB9310000-0x00007FFEB98F9000-memory.dmp

Filesize
5.9MB

Download
memory/704-72-0x00007FFEC97E0000-0x00007FFEC980E000-memory.dmp

Filesize
184KB

Download
memory/704-74-0x00007FFEC9360000-0x00007FFEC9418000-memory.dmp

Filesize
736KB

Download
memory/704-78-0x00007FFEB8F90000-0x00007FFEB9309000-memory.dmp

Filesize
3.5MB

Download
memory/704-80-0x00007FFECC720000-0x00007FFECC743000-memory.dmp

Filesize
140KB

Download
memory/704-79-0x0000028E21BC0000-0x0000028E21F39000-memory.dmp

Filesize
3.5MB

Download
memory/704-68-0x00007FFECC660000-0x00007FFECC679000-memory.dmp

Filesize
100KB

Download
memory/704-85-0x00007FFECC430000-0x00007FFECC43D000-memory.dmp

Filesize
52KB

Download
memory/704-84-0x00007FFECC6B0000-0x00007FFECC6C9000-memory.dmp

Filesize
100KB

Download
memory/704-83-0x00007FFEC9720000-0x00007FFEC9734000-memory.dmp

Filesize
80KB

Download
memory/704-89-0x00007FFEC8940000-0x00007FFEC8A5C000-memory.dmp

Filesize
1.1MB

Download
memory/704-88-0x00007FFECC680000-0x00007FFECC6A3000-memory.dmp

Filesize
140KB

Download
memory/704-66-0x00007FFEC8A60000-0x00007FFEC8BD0000-memory.dmp

Filesize
1.4MB

Download
memory/704-30-0x00007FFEB9310000-0x00007FFEB98F9000-memory.dmp

Filesize
5.9MB

Download
memory/704-244-0x00007FFEB8F90000-0x00007FFEB9309000-memory.dmp

Filesize
3.5MB

Download
memory/704-54-0x00007FFECFFB0000-0x00007FFECFFBF000-memory.dmp

Filesize
60KB

Download
memory/704-245-0x00007FFEC9720000-0x00007FFEC9734000-memory.dmp

Filesize
80KB

Download
memory/704-247-0x00007FFEC8940000-0x00007FFEC8A5C000-memory.dmp

Filesize
1.1MB

Download
memory/704-64-0x00007FFECC680000-0x00007FFECC6A3000-memory.dmp

Filesize
140KB

Download
memory/704-248-0x00007FFECC720000-0x00007FFECC743000-memory.dmp

Filesize
140KB

Download
memory/704-70-0x00007FFECC440000-0x00007FFECC44D000-memory.dmp

Filesize
52KB

Download
memory/704-240-0x00007FFECC660000-0x00007FFECC679000-memory.dmp

Filesize
100KB

Download
memory/704-257-0x00007FFEC9360000-0x00007FFEC9418000-memory.dmp

Filesize
736KB

Download
memory/704-256-0x00007FFEC97E0000-0x00007FFEC980E000-memory.dmp

Filesize
184KB

Download
memory/704-255-0x00007FFECC440000-0x00007FFECC44D000-memory.dmp

Filesize
52KB

Download
memory/704-254-0x00007FFECC430000-0x00007FFECC43D000-memory.dmp

Filesize
52KB

Download
memory/704-253-0x00007FFEC8A60000-0x00007FFEC8BD0000-memory.dmp

Filesize
1.4MB

Download
memory/704-252-0x00007FFECC680000-0x00007FFECC6A3000-memory.dmp

Filesize
140KB

Download
memory/704-62-0x00007FFECC6B0000-0x00007FFECC6C9000-memory.dmp

Filesize
100KB

Download
memory/704-53-0x00007FFECC720000-0x00007FFECC743000-memory.dmp

Filesize
140KB

Download
memory/704-251-0x00007FFECC6B0000-0x00007FFECC6C9000-memory.dmp

Filesize
100KB

Download
memory/704-250-0x00007FFECC6F0000-0x00007FFECC71D000-memory.dmp

Filesize
180KB

Download
memory/704-249-0x00007FFECFFB0000-0x00007FFECFFBF000-memory.dmp

Filesize
60KB

Download
memory/704-60-0x00007FFECC6F0000-0x00007FFECC71D000-memory.dmp

Filesize
180KB

Download
memory/1316-109-0x000001ECF5030000-0x000001ECF50A6000-memory.dmp

Filesize
472KB

Download
memory/1824-105-0x000001DAF47E0000-0x000001DAF4802000-memory.dmp

Filesize
136KB

Download
memory/2944-258-0x00000000062F0000-0x0000000006302000-memory.dmp

Filesize
72KB

Download
memory/2944-232-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/2944-113-0x00000000056A0000-0x0000000005732000-memory.dmp

Filesize
584KB

Download
memory/2944-112-0x0000000005CB0000-0x00000000061AE000-memory.dmp

Filesize
5.0MB

Download
memory/2944-108-0x0000000000DB0000-0x0000000000E0E000-memory.dmp

Filesize
376KB

Download
memory/2944-275-0x00000000066E0000-0x000000000671E000-memory.dmp

Filesize
248KB

Download
memory/2944-277-0x0000000006B40000-0x0000000006B4A000-memory.dmp

Filesize
40KB

Download