quasar | b4f6e6290b1e185bff0baf1b1f3a16291bb2ceb3528051a2aa9528c43231e710

Resubmissions

17-04-2023 11:32

230417-nnmdnafe8v 10

05-08-2022 09:37

220805-lll9rshgh8 10

Analysis

max time kernel
143s
max time network
179s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
17-04-2023 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bby.exe
Size

16.0MB
MD5

d7e48e5a49efe9ed774546fa7d35d71a
SHA1

06212065ffe07d1321c8d85bf5c45871683fb197
SHA256

b4f6e6290b1e185bff0baf1b1f3a16291bb2ceb3528051a2aa9528c43231e710
SHA512

7dcfc267f527d27d6cb58bd950241b4a8a658b34bc4696f308fd5448b4111d64b93078fedf8d2c138eef83b6148372d8c887b74aae8291fc05c665fbe3d4eeb1
SSDEEP

393216:2U6K+uYp1UjvoWFd6vtcUyPaqIddvWiV3lbqSV6htNQcfzlRFGH:2zKnjvpK1cUhZWwbqM6htNQcffFGH

Score

10^/10

quasar redline venomrat office04 evasion infostealer rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

cable-cp.at.playit.gg:21596

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
GDDG0qqm5dHuoT6GjWWz
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft one Drive
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 7 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000900000001aee9-131.dat	disable_win_def
behavioral2/files/0x000900000001aee9-133.dat	disable_win_def
behavioral2/memory/4176-137-0x0000000000120000-0x00000000001CE000-memory.dmp	disable_win_def
behavioral2/files/0x000200000001af00-220.dat	disable_win_def
behavioral2/files/0x000200000001af00-250.dat	disable_win_def
behavioral2/files/0x000200000001af00-253.dat	disable_win_def
behavioral2/files/0x000900000001aee9-739.dat	disable_win_def

Detects Redline Stealer samples 2 IoCs

This rule detects the presence of Redline Stealer samples based on their unique strings.

stealer

resource	yara_rule
behavioral2/memory/4176-189-0x0000000004DF0000-0x0000000004E56000-memory.dmp	redline_stealer
behavioral2/memory/5020-260-0x0000000007010000-0x0000000007638000-memory.dmp	redline_stealer

Modifies Windows Defender Real-time Protection settings 3 TTPs 3 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	paypal.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	paypal.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	paypal.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 7 IoCs

resource	yara_rule
behavioral2/files/0x000900000001aee9-131.dat	family_quasar
behavioral2/files/0x000900000001aee9-133.dat	family_quasar
behavioral2/memory/4176-137-0x0000000000120000-0x00000000001CE000-memory.dmp	family_quasar
behavioral2/files/0x000200000001af00-220.dat	family_quasar
behavioral2/files/0x000200000001af00-250.dat	family_quasar
behavioral2/files/0x000200000001af00-253.dat	family_quasar
behavioral2/files/0x000900000001aee9-739.dat	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 4 IoCs

pid	Process
4176	paypal.exe
2160	Proxy Shifter.exe
5048	Client.exe
4428	Paypal.exe

Loads dropped DLL 2 IoCs

pid	Process
2160	Proxy Shifter.exe
2160	Proxy Shifter.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	paypal.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	paypal.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SubDir\Client.exe	paypal.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\Client.exe	paypal.exe
File created	C:\Windows\SysWOW64\SubDir\r77-x64.dll	paypal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	5048	WerFault.exe	76

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1128	schtasks.exe
3636	schtasks.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3992	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2152	PING.EXE
3432	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2192	powershell.exe
2192	powershell.exe
2192	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
2160	Proxy Shifter.exe
2160	Proxy Shifter.exe
2160	Proxy Shifter.exe
2160	Proxy Shifter.exe
2160	Proxy Shifter.exe
2160	Proxy Shifter.exe
4176	paypal.exe
4176	paypal.exe
4176	paypal.exe
4176	paypal.exe
4176	paypal.exe
4176	paypal.exe
4176	paypal.exe
4428	Paypal.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	4176	paypal.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	5048	Client.exe
Token: SeDebugPrivilege	5048	Client.exe
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeDebugPrivilege	4428	Paypal.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5048	Client.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 4176	2908	bby.exe	66
PID 2908 wrote to memory of 4176	2908	bby.exe	66
PID 2908 wrote to memory of 4176	2908	bby.exe	66
PID 2908 wrote to memory of 2160	2908	bby.exe	68
PID 2908 wrote to memory of 2160	2908	bby.exe	68
PID 2160 wrote to memory of 1456	2160	Proxy Shifter.exe	70
PID 2160 wrote to memory of 1456	2160	Proxy Shifter.exe	70
PID 1456 wrote to memory of 1956	1456	cmd.exe	71
PID 1456 wrote to memory of 1956	1456	cmd.exe	71
PID 1456 wrote to memory of 2192	1456	cmd.exe	72
PID 1456 wrote to memory of 2192	1456	cmd.exe	72
PID 4176 wrote to memory of 3636	4176	paypal.exe	74
PID 4176 wrote to memory of 3636	4176	paypal.exe	74
PID 4176 wrote to memory of 3636	4176	paypal.exe	74
PID 4176 wrote to memory of 5048	4176	paypal.exe	76
PID 4176 wrote to memory of 5048	4176	paypal.exe	76
PID 4176 wrote to memory of 5048	4176	paypal.exe	76
PID 4176 wrote to memory of 5020	4176	paypal.exe	77
PID 4176 wrote to memory of 5020	4176	paypal.exe	77
PID 4176 wrote to memory of 5020	4176	paypal.exe	77
PID 2192 wrote to memory of 4948	2192	powershell.exe	78
PID 2192 wrote to memory of 4948	2192	powershell.exe	78
PID 4948 wrote to memory of 5100	4948	csc.exe	80
PID 4948 wrote to memory of 5100	4948	csc.exe	80
PID 5048 wrote to memory of 1128	5048	Client.exe	81
PID 5048 wrote to memory of 1128	5048	Client.exe	81
PID 5048 wrote to memory of 1128	5048	Client.exe	81
PID 5048 wrote to memory of 1488	5048	Client.exe	83
PID 5048 wrote to memory of 1488	5048	Client.exe	83
PID 5048 wrote to memory of 1488	5048	Client.exe	83
PID 1488 wrote to memory of 4624	1488	cmd.exe	87
PID 1488 wrote to memory of 4624	1488	cmd.exe	87
PID 1488 wrote to memory of 4624	1488	cmd.exe	87
PID 1488 wrote to memory of 2152	1488	cmd.exe	88
PID 1488 wrote to memory of 2152	1488	cmd.exe	88
PID 1488 wrote to memory of 2152	1488	cmd.exe	88
PID 2160 wrote to memory of 1672	2160	Proxy Shifter.exe	89
PID 2160 wrote to memory of 1672	2160	Proxy Shifter.exe	89
PID 1672 wrote to memory of 3992	1672	cmd.exe	90
PID 1672 wrote to memory of 3992	1672	cmd.exe	90
PID 4176 wrote to memory of 3112	4176	paypal.exe	91
PID 4176 wrote to memory of 3112	4176	paypal.exe	91
PID 4176 wrote to memory of 3112	4176	paypal.exe	91
PID 4176 wrote to memory of 3760	4176	paypal.exe	93
PID 4176 wrote to memory of 3760	4176	paypal.exe	93
PID 4176 wrote to memory of 3760	4176	paypal.exe	93
PID 3112 wrote to memory of 392	3112	cmd.exe	95
PID 3112 wrote to memory of 392	3112	cmd.exe	95
PID 3112 wrote to memory of 392	3112	cmd.exe	95
PID 3760 wrote to memory of 4800	3760	cmd.exe	96
PID 3760 wrote to memory of 4800	3760	cmd.exe	96
PID 3760 wrote to memory of 4800	3760	cmd.exe	96
PID 3760 wrote to memory of 3432	3760	cmd.exe	97
PID 3760 wrote to memory of 3432	3760	cmd.exe	97
PID 3760 wrote to memory of 3432	3760	cmd.exe	97
PID 3760 wrote to memory of 4428	3760	cmd.exe	98
PID 3760 wrote to memory of 4428	3760	cmd.exe	98
PID 3760 wrote to memory of 4428	3760	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\bby.exe
"C:\Users\Admin\AppData\Local\Temp\bby.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\paypal.exe
  "C:\Users\Admin\AppData\Local\Temp\paypal.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Microsoft one Drive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\paypal.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3636
- - C:\Windows\SysWOW64\SubDir\Client.exe
    "C:\Windows\SysWOW64\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Microsoft one Drive" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lzp8eloHjKWN.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4624
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:2152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1864
      4⤵
      Program crash
      PID:2652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XZaygvPgDJHT.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Paypal.exe
      "C:\Users\Admin\AppData\Local\Temp\paypal.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4428
- C:\Users\Admin\AppData\Local\Temp\Proxy Shifter.exe
  "C:\Users\Admin\AppData\Local\Temp\Proxy Shifter.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "type .\temp.ps1 | powershell.exe -noprofile -"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type .\temp.ps1 "
      4⤵
      PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -noprofile -
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e0rg1jmi\e0rg1jmi.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4948
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES714.tmp" "c:\Users\Admin\AppData\Local\Temp\e0rg1jmi\CSC550B2A6214D34D05A9A34B2E98711C87.TMP"
        6⤵
        
        PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Paypal.exe.log

Filesize
1KB

MD5
1efce85e583a7a2f123317a20f889d04

SHA1
60f71aa73ea2e2a48ed1c17e3c6d440abf39c914

SHA256
2b5532a94879134a876b11c188ade1a61deaba6a80fe1f3a3a77cc442f1cca0d

SHA512
45a5cd283e6a6ac34c3d8b1a6d73dc1cf52d8c974cf84624e8e9924eddaf354ccda929bce728b47db2b62175e47bdc3eaca6bc6b84d3565881fa87c50319d24c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Paypal.exe

Filesize
672KB

MD5
561a7ddda53177362dc0ac85ec84421e

SHA1
1d0f2a9dd397a6d435063fcdd76f02dd04ab1b7a

SHA256
b3e2c9fbc435b5e2f552234b0e1c4ec7bb2ebe5f53413268b1089038cfe5748b

SHA512
8dfcaf20f68e0c9ba7e768929e12e930a466d352ae8f5b452af0e603722e048b60fb4272c280a52f87eb3d3f25ce691ed6afd4285f440f18d68af22fe8d6f6d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Paypal.exe

Filesize
672KB

MD5
561a7ddda53177362dc0ac85ec84421e

SHA1
1d0f2a9dd397a6d435063fcdd76f02dd04ab1b7a

SHA256
b3e2c9fbc435b5e2f552234b0e1c4ec7bb2ebe5f53413268b1089038cfe5748b

SHA512
8dfcaf20f68e0c9ba7e768929e12e930a466d352ae8f5b452af0e603722e048b60fb4272c280a52f87eb3d3f25ce691ed6afd4285f440f18d68af22fe8d6f6d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Proxy Shifter.exe

Filesize
36.8MB

MD5
7cbac120d865d4c4c218b06144580b0a

SHA1
19afc5f464e84dc362459ab53dd3b6947b708d2e

SHA256
77f211fe4f26bbf491ee2a4eb6ac07a123a1ae40b59062d88c222e61b60c082b

SHA512
439ffd9e287b9c7468c9f85b52f0734b8b98e4b917576b2e87a6775b0d65b3da3103341c743b93722726795eadf86148c1b2c573a6f4a7b1c2cf5f307cfca625

Download Submit
C:\Users\Admin\AppData\Local\Temp\Proxy Shifter.exe

Filesize
36.8MB

MD5
7cbac120d865d4c4c218b06144580b0a

SHA1
19afc5f464e84dc362459ab53dd3b6947b708d2e

SHA256
77f211fe4f26bbf491ee2a4eb6ac07a123a1ae40b59062d88c222e61b60c082b

SHA512
439ffd9e287b9c7468c9f85b52f0734b8b98e4b917576b2e87a6775b0d65b3da3103341c743b93722726795eadf86148c1b2c573a6f4a7b1c2cf5f307cfca625

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES714.tmp

Filesize
1KB

MD5
001db702d57763bf3a3f10dbe6bd7c9f

SHA1
384d42a6626863635d72b088fcc3677686528e1e

SHA256
d69c5f85195754e8220a34c643a0ce32e27152f8445be3331a37c98398fbb618

SHA512
e75018188c8420bd1edb2fd5f330bbe7ed03d89d545a5675b743ccb50f761246efb4e1546c4efe564b3707d31a952787ccd1b1ee6a4a8f62bdeb7d344cb5470a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XZaygvPgDJHT.bat

Filesize
203B

MD5
d4180895c407c662bf596df86a552f11

SHA1
1fba8d772cc824ad44977e03ea56ea5e55d321e1

SHA256
2459f0d5f78fe329355db9ca3f5a856e4a5e1836ab14eac4358d1e38f6b88bc7

SHA512
33fd1844386eaa440338bbbdeaec9ca5bd517794820241e7b0764ab41fad5d6c489bb2f0818f51e21222f3d3dbcd5bb65e8a35b501aa1ff1ddc4be23f63b60bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uepvey1y.z43.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0rg1jmi\e0rg1jmi.dll

Filesize
3KB

MD5
40a35eb4a4c5a731d48921bfbe23b779

SHA1
0523f279dcb36ac8b74a75879a63b2a7e6fe0f20

SHA256
fb5ba944ee578b661783883b1a2285ae29f7b066745d401f147319fc6cf3d27a

SHA512
a25115d21a25646ef65f6a6b51b1883190d898c0db278a76142f6bd4956dafef8e63fa48c561d6f7dbcae7b11c5c5ec5d901303e577293387673c67f5a2d4b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\lzp8eloHjKWN.bat

Filesize
196B

MD5
b6b99bf33ced020616129f1ba959957d

SHA1
58a55396084255eb033a8471a3281ac2ae8f284c

SHA256
710e135854f72bf92bc32e7bbbf9d86c31add373e8b987d8206df0324383902f

SHA512
2da7ac69899a0fee8c111402053203cc7eb64a5ac3a24cd1d2ddfbde91ed1a5650bc5503073c36127e757cdbf506479e88ce500fb6c2ffaa950028994c930b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\paypal.exe

Filesize
672KB

MD5
561a7ddda53177362dc0ac85ec84421e

SHA1
1d0f2a9dd397a6d435063fcdd76f02dd04ab1b7a

SHA256
b3e2c9fbc435b5e2f552234b0e1c4ec7bb2ebe5f53413268b1089038cfe5748b

SHA512
8dfcaf20f68e0c9ba7e768929e12e930a466d352ae8f5b452af0e603722e048b60fb4272c280a52f87eb3d3f25ce691ed6afd4285f440f18d68af22fe8d6f6d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\53b88af8a78050718e1a282af077701921f1e2c7e0b4592d197eab2018240282\better-sqlite3\build\Release\better_sqlite3.node

Filesize
2.6MB

MD5
4b25dfb983845ff57360c720a429eef4

SHA1
51a9cad777b37f1c521c6d50b6f49379fb6d0a06

SHA256
53b88af8a78050718e1a282af077701921f1e2c7e0b4592d197eab2018240282

SHA512
b808133885ef35cba2ea81d37a9f996b121a91e459c68cf5b98cab2a53f783927a0023ecc095b5664fef1bcd463f8b8b42b51f8511fda25e21141693aed4ec77

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\81aab2bb7227d24493d1f0d2483a307be716c84a733b54f69e671071715e10c2\win-dpapi\build\Release\node-dpapi.node

Filesize
141KB

MD5
dc92b8e77d869866a6af82409fae0af2

SHA1
a0edf2ddf35304854a134eac14637239fe319292

SHA256
81aab2bb7227d24493d1f0d2483a307be716c84a733b54f69e671071715e10c2

SHA512
dbfb1656b9aeb116993e9034d8a422a8d61d89f861221e15491d8dde04231eaa357573de59eab65b49533e03f06699a508dd27ed6b85ac94c882f505d22a0bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.ps1

Filesize
419B

MD5
bf77c98084bde13aa379a5527a0f5850

SHA1
8a4d1307c3952d00ab3279baee4a03f899de7f1c

SHA256
c88eb353b4e1fe7f02529f9e8b48b21cee2c813674b32843136861f885053e3f

SHA512
8237fb209695c2568f4d3ada3181eb9a65ad16140896a5f8013ae267048ecd6994cddb25fc7ca0849bb0c484ba7be7a738a3ca0cad6e85d75587c4a2c37c60ef

Download Submit
C:\Windows\SysWOW64\SubDir\Client.exe

Filesize
672KB

MD5
561a7ddda53177362dc0ac85ec84421e

SHA1
1d0f2a9dd397a6d435063fcdd76f02dd04ab1b7a

SHA256
b3e2c9fbc435b5e2f552234b0e1c4ec7bb2ebe5f53413268b1089038cfe5748b

SHA512
8dfcaf20f68e0c9ba7e768929e12e930a466d352ae8f5b452af0e603722e048b60fb4272c280a52f87eb3d3f25ce691ed6afd4285f440f18d68af22fe8d6f6d1

Download Submit
C:\Windows\SysWOW64\SubDir\Client.exe

Filesize
672KB

MD5
561a7ddda53177362dc0ac85ec84421e

SHA1
1d0f2a9dd397a6d435063fcdd76f02dd04ab1b7a

SHA256
b3e2c9fbc435b5e2f552234b0e1c4ec7bb2ebe5f53413268b1089038cfe5748b

SHA512
8dfcaf20f68e0c9ba7e768929e12e930a466d352ae8f5b452af0e603722e048b60fb4272c280a52f87eb3d3f25ce691ed6afd4285f440f18d68af22fe8d6f6d1

Download Submit
C:\Windows\SysWOW64\SubDir\Client.exe

Filesize
672KB

MD5
561a7ddda53177362dc0ac85ec84421e

SHA1
1d0f2a9dd397a6d435063fcdd76f02dd04ab1b7a

SHA256
b3e2c9fbc435b5e2f552234b0e1c4ec7bb2ebe5f53413268b1089038cfe5748b

SHA512
8dfcaf20f68e0c9ba7e768929e12e930a466d352ae8f5b452af0e603722e048b60fb4272c280a52f87eb3d3f25ce691ed6afd4285f440f18d68af22fe8d6f6d1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e0rg1jmi\CSC550B2A6214D34D05A9A34B2E98711C87.TMP

Filesize
652B

MD5
b0e328ebd580fba5dff592de9b69d2d4

SHA1
4555606bc8f6bdc273b758a366e2f9b9fda79d8f

SHA256
be6e88d03b56bea78f3ef38241fd17fb339307a575013f3107a2a223f7d5d2f3

SHA512
3d1f6fb38f1bbf548781a771164c4cc994f155a4d5fcf555746ad18a0b75bb9b7901547394743619a43cb69564fd9139d9cdd01de7d447b4c36966361bc0e365

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e0rg1jmi\e0rg1jmi.0.cs

Filesize
331B

MD5
290cee718da5975e051415a46af47a4a

SHA1
8099250c47bb93d821def350b467521e7cf8d5de

SHA256
26d220f0926af717fb195e1ec05f2ecccee3fbd37fa92148774bb5604557c9c9

SHA512
306d86ec0c4bc64594b4ca336822030926eaea0873ccdbcf989a721d307b19831761a15b3a222f6ec0dcc44ba0fbacac6ffbe7da0f7a447d5d34d76f3f029510

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e0rg1jmi\e0rg1jmi.cmdline

Filesize
369B

MD5
5a640408da1646ed0b97d84832adc5ce

SHA1
803d1da20d0e5b7653343537f2fce5f98c9f18a5

SHA256
62ec0557114c5eb62d1770485ffb91bebeed0195ebeb59c7ebc6c7d1a4f094fa

SHA512
5d2680246dbb7f38224a0d26a06705389eddcfb0a6223125a6ea74b99ce8af75453994bee3d9afa436bf89ba926a64535af68ab08de0bf892f2d05e175dbf32c

Download Submit
\Users\Admin\AppData\Local\Temp\pkg\53b88af8a78050718e1a282af077701921f1e2c7e0b4592d197eab2018240282\better-sqlite3\build\Release\better_sqlite3.node

Filesize
2.6MB

MD5
4b25dfb983845ff57360c720a429eef4

SHA1
51a9cad777b37f1c521c6d50b6f49379fb6d0a06

SHA256
53b88af8a78050718e1a282af077701921f1e2c7e0b4592d197eab2018240282

SHA512
b808133885ef35cba2ea81d37a9f996b121a91e459c68cf5b98cab2a53f783927a0023ecc095b5664fef1bcd463f8b8b42b51f8511fda25e21141693aed4ec77

Download Submit
\Users\Admin\AppData\Local\Temp\pkg\81aab2bb7227d24493d1f0d2483a307be716c84a733b54f69e671071715e10c2\win-dpapi\build\Release\node-dpapi.node

Filesize
141KB

MD5
dc92b8e77d869866a6af82409fae0af2

SHA1
a0edf2ddf35304854a134eac14637239fe319292

SHA256
81aab2bb7227d24493d1f0d2483a307be716c84a733b54f69e671071715e10c2

SHA512
dbfb1656b9aeb116993e9034d8a422a8d61d89f861221e15491d8dde04231eaa357573de59eab65b49533e03f06699a508dd27ed6b85ac94c882f505d22a0bdb

Download Submit
memory/2192-188-0x0000020299FB0000-0x000002029A026000-memory.dmp

Filesize
472KB

Download
memory/2192-272-0x00000202999D0000-0x00000202999D8000-memory.dmp

Filesize
32KB

Download
memory/2192-147-0x0000020299880000-0x00000202998A2000-memory.dmp

Filesize
136KB

Download
memory/2192-151-0x0000020299870000-0x0000020299880000-memory.dmp

Filesize
64KB

Download
memory/2192-177-0x00000202999F0000-0x0000020299A2C000-memory.dmp

Filesize
240KB

Download
memory/2192-152-0x0000020299870000-0x0000020299880000-memory.dmp

Filesize
64KB

Download
memory/4176-189-0x0000000004DF0000-0x0000000004E56000-memory.dmp

Filesize
408KB

Download
memory/4176-199-0x0000000005D70000-0x0000000005DAE000-memory.dmp

Filesize
248KB

Download
memory/4176-150-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/4176-140-0x0000000004A50000-0x0000000004AE2000-memory.dmp

Filesize
584KB

Download
memory/4176-194-0x0000000005980000-0x0000000005992000-memory.dmp

Filesize
72KB

Download
memory/4176-139-0x0000000004E80000-0x000000000537E000-memory.dmp

Filesize
5.0MB

Download
memory/4176-137-0x0000000000120000-0x00000000001CE000-memory.dmp

Filesize
696KB

Download
memory/4428-741-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/4428-742-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/5020-263-0x0000000006FE0000-0x0000000007002000-memory.dmp

Filesize
136KB

Download
memory/5020-516-0x0000000009490000-0x0000000009524000-memory.dmp

Filesize
592KB

Download
memory/5020-259-0x0000000001140000-0x0000000001176000-memory.dmp

Filesize
216KB

Download
memory/5020-306-0x0000000008290000-0x00000000082DB000-memory.dmp

Filesize
300KB

Download
memory/5020-498-0x00000000091D0000-0x0000000009203000-memory.dmp

Filesize
204KB

Download
memory/5020-499-0x0000000008E30000-0x0000000008E4E000-memory.dmp

Filesize
120KB

Download
memory/5020-298-0x0000000007980000-0x000000000799C000-memory.dmp

Filesize
112KB

Download
memory/5020-274-0x0000000007AD0000-0x0000000007E20000-memory.dmp

Filesize
3.3MB

Download
memory/5020-510-0x0000000009300000-0x00000000093A5000-memory.dmp

Filesize
660KB

Download
memory/5020-346-0x0000000008070000-0x00000000080E6000-memory.dmp

Filesize
472KB

Download
memory/5020-523-0x00000000011A0000-0x00000000011B0000-memory.dmp

Filesize
64KB

Download
memory/5020-600-0x00000000011A0000-0x00000000011B0000-memory.dmp

Filesize
64KB

Download
memory/5020-602-0x00000000011A0000-0x00000000011B0000-memory.dmp

Filesize
64KB

Download
memory/5020-713-0x0000000009190000-0x00000000091AA000-memory.dmp

Filesize
104KB

Download
memory/5020-718-0x0000000009100000-0x0000000009108000-memory.dmp

Filesize
32KB

Download
memory/5020-266-0x0000000007790000-0x00000000077F6000-memory.dmp

Filesize
408KB

Download
memory/5020-262-0x00000000011A0000-0x00000000011B0000-memory.dmp

Filesize
64KB

Download
memory/5020-260-0x0000000007010000-0x0000000007638000-memory.dmp

Filesize
6.2MB

Download
memory/5048-261-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/5048-401-0x0000000006270000-0x000000000627A000-memory.dmp

Filesize
40KB

Download