laplas | c1fe20b075cd91dbe6454422825af7b98d5e4914c00f81612c18a5be7f8cd509

Resubmissions

30-04-2023 20:16

230430-y169psah37 7

30-04-2023 20:09

230430-yxckxsah25 10

30-04-2023 20:03

230430-ys13qaag96 7

30-04-2023 19:55

230430-ym5hyscf3w 7

Analysis

max time kernel
146s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2023 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChatGPT (Bot).zip
Size

7.1MB
MD5

d2f022536243004be4a21092f99b8d0f
SHA1

856b042c9fdf1604679be190acb1c2068cb52730
SHA256

c1fe20b075cd91dbe6454422825af7b98d5e4914c00f81612c18a5be7f8cd509
SHA512

076e79b7521467a3e204d5cf820f6a312bf9eb8d581b0d0c6a6d96235c9f8284fed92d8b3a546fa6b0603743d5b90f64f6b596e13b2b44efc63930e09e3e5852
SSDEEP

98304:3unHAbqD9nF3jbQD3l6rMgXneBMYFzxVyOax5Zg2ILh7shAUA:3unHAuD9ljzG3xAZ/TkshAUA

Score

10^/10

laplas vidar 71cdfc44f141586243159aa45037497d clipper evasion persistence spyware stealer themida trojan

Malware Config

Extracted

Family

vidar

Version

3.6

Botnet

71cdfc44f141586243159aa45037497d

https://steamcommunity.com/profiles/76561199499188534

https://t.me/nutalse

Attributes

profile_id_v2
71cdfc44f141586243159aa45037497d
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ChatGPT (Bot).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	38808872664776435797.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ChatGPT (Bot).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ChatGPT (Bot).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	38808872664776435797.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	38808872664776435797.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe

Executes dropped EXE 2 IoCs

pid	Process
2292	38808872664776435797.exe
4108	ntlhost.exe

Loads dropped DLL 2 IoCs

pid	Process
5072	AddInProcess32.exe
5072	AddInProcess32.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3224-133-0x0000000000BF0000-0x00000000010D8000-memory.dmp	themida
behavioral1/memory/3224-144-0x0000000000BF0000-0x00000000010D8000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	38808872664776435797.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	38808872664776435797.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3224	ChatGPT (Bot).exe
2292	38808872664776435797.exe
4108	ntlhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3224 set thread context of 5072	3224	ChatGPT (Bot).exe	113

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AddInProcess32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
484	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	76	Go-http-client/1.1

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2116	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
3224	ChatGPT (Bot).exe
5072	AddInProcess32.exe
5072	AddInProcess32.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	ChatGPT (Bot).exe
Token: SeDebugPrivilege	4532	taskmgr.exe
Token: SeSystemProfilePrivilege	4532	taskmgr.exe
Token: SeCreateGlobalPrivilege	4532	taskmgr.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe
4532	taskmgr.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1604	3224	ChatGPT (Bot).exe	103
PID 3224 wrote to memory of 1604	3224	ChatGPT (Bot).exe	103
PID 3224 wrote to memory of 3564	3224	ChatGPT (Bot).exe	104
PID 3224 wrote to memory of 3564	3224	ChatGPT (Bot).exe	104
PID 3224 wrote to memory of 4428	3224	ChatGPT (Bot).exe	105
PID 3224 wrote to memory of 4428	3224	ChatGPT (Bot).exe	105
PID 3224 wrote to memory of 1392	3224	ChatGPT (Bot).exe	106
PID 3224 wrote to memory of 1392	3224	ChatGPT (Bot).exe	106
PID 3224 wrote to memory of 1100	3224	ChatGPT (Bot).exe	107
PID 3224 wrote to memory of 1100	3224	ChatGPT (Bot).exe	107
PID 3224 wrote to memory of 1016	3224	ChatGPT (Bot).exe	108
PID 3224 wrote to memory of 1016	3224	ChatGPT (Bot).exe	108
PID 3224 wrote to memory of 796	3224	ChatGPT (Bot).exe	109
PID 3224 wrote to memory of 796	3224	ChatGPT (Bot).exe	109
PID 3224 wrote to memory of 3012	3224	ChatGPT (Bot).exe	110
PID 3224 wrote to memory of 3012	3224	ChatGPT (Bot).exe	110
PID 3224 wrote to memory of 1448	3224	ChatGPT (Bot).exe	111
PID 3224 wrote to memory of 1448	3224	ChatGPT (Bot).exe	111
PID 3224 wrote to memory of 1216	3224	ChatGPT (Bot).exe	112
PID 3224 wrote to memory of 1216	3224	ChatGPT (Bot).exe	112
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 3224 wrote to memory of 5072	3224	ChatGPT (Bot).exe	113
PID 5072 wrote to memory of 2292	5072	AddInProcess32.exe	116
PID 5072 wrote to memory of 2292	5072	AddInProcess32.exe	116
PID 5072 wrote to memory of 3024	5072	AddInProcess32.exe	117
PID 5072 wrote to memory of 3024	5072	AddInProcess32.exe	117
PID 5072 wrote to memory of 3024	5072	AddInProcess32.exe	117
PID 3024 wrote to memory of 484	3024	cmd.exe	119
PID 3024 wrote to memory of 484	3024	cmd.exe	119
PID 3024 wrote to memory of 484	3024	cmd.exe	119
PID 2292 wrote to memory of 4108	2292	38808872664776435797.exe	120
PID 2292 wrote to memory of 4108	2292	38808872664776435797.exe	120

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\ChatGPT (Bot).zip"
1⤵
PID:4952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4804

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ActiveReign\requirements.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2116

C:\Users\Admin\Desktop\ChatGPT (Bot).exe
"C:\Users\Admin\Desktop\ChatGPT (Bot).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:3564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:4428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:1392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:3012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:1448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
  2⤵
  PID:1216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\ProgramData\38808872664776435797.exe
    "C:\ProgramData\38808872664776435797.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:484

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\38808872664776435797.exe

Filesize
3.3MB

MD5
6929d9467cfa331fe33a18ebb69fc501

SHA1
245e282445efa25ecf3cc567d1a40462f4237b7a

SHA256
3ff364651520a6625602cb721499d4398a7aad5c3b8142e8b1d11d38cf35351b

SHA512
cf65f2aa902ce9456e2bfcfd4f7cd3d41602e81f7b73b56c220adf8ec973aaf2bf8c1610ca2d8acaa35aaa1a04f056a7e5a5e210665b2b39be561e89bf034513

Download Submit
C:\ProgramData\38808872664776435797.exe

Filesize
3.3MB

MD5
6929d9467cfa331fe33a18ebb69fc501

SHA1
245e282445efa25ecf3cc567d1a40462f4237b7a

SHA256
3ff364651520a6625602cb721499d4398a7aad5c3b8142e8b1d11d38cf35351b

SHA512
cf65f2aa902ce9456e2bfcfd4f7cd3d41602e81f7b73b56c220adf8ec973aaf2bf8c1610ca2d8acaa35aaa1a04f056a7e5a5e210665b2b39be561e89bf034513

Download Submit
C:\ProgramData\38808872664776435797.exe

Filesize
3.3MB

MD5
6929d9467cfa331fe33a18ebb69fc501

SHA1
245e282445efa25ecf3cc567d1a40462f4237b7a

SHA256
3ff364651520a6625602cb721499d4398a7aad5c3b8142e8b1d11d38cf35351b

SHA512
cf65f2aa902ce9456e2bfcfd4f7cd3d41602e81f7b73b56c220adf8ec973aaf2bf8c1610ca2d8acaa35aaa1a04f056a7e5a5e210665b2b39be561e89bf034513

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
717.7MB

MD5
fe950549272a1632212146060ce829b4

SHA1
ba33f41b8ffe4c73f06a69c502a0fa2acab218a1

SHA256
6cb3b293900ed5b17d7a7b15d55d66567a4593ca4f9053db868d7c27133e4a8c

SHA512
adeea13a764a6bcc0fe6337ddc6507ebef21cb55f2db59a07ae29141964860baaf433ed03938b565aeef095a1d05b2dff01bc405bf4997db77cf59f749414f98

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
541.1MB

MD5
a6dd845ed6de73b82d19c008c9b1de5b

SHA1
de852d7e5eed06404906175bceeb28c454a725a5

SHA256
520a469c3c7c827ff2ca8145d067c8e1839820691a5a98e293267581926c66d9

SHA512
53fc69d4cdb300a3c3d5c9738e7a5d44a0f9b2bf6633110845476cd29507454d87a72630922bcd92f4b5c08d739b734016e7deed7cc845d35a8049d20c66bb33

Download Submit
memory/2292-240-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-266-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-262-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-251-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-260-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-259-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-258-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-256-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-248-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/2292-244-0x0000000000310000-0x0000000000C5C000-memory.dmp

Filesize
9.3MB

Download
memory/3224-133-0x0000000000BF0000-0x00000000010D8000-memory.dmp

Filesize
4.9MB

Download
memory/3224-144-0x0000000000BF0000-0x00000000010D8000-memory.dmp

Filesize
4.9MB

Download
memory/3224-135-0x00007FFF00000000-0x00007FFF00002000-memory.dmp

Filesize
8KB

Download
memory/3224-136-0x00007FFF00030000-0x00007FFF00031000-memory.dmp

Filesize
4KB

Download
memory/3224-134-0x0000000000BF0000-0x00000000010D8000-memory.dmp

Filesize
4.9MB

Download
memory/3224-137-0x00000260ED9D0000-0x00000260EDA46000-memory.dmp

Filesize
472KB

Download
memory/3224-139-0x00000260EDAD0000-0x00000260EDAE0000-memory.dmp

Filesize
64KB

Download
memory/3224-138-0x00000260EDA50000-0x00000260EDA6E000-memory.dmp

Filesize
120KB

Download
memory/4108-275-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-282-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-271-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-270-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-269-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-279-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-278-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-268-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-267-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-273-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-274-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-280-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-272-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4108-276-0x0000000000FA0000-0x00000000018EC000-memory.dmp

Filesize
9.3MB

Download
memory/4532-241-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-250-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-257-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-242-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-254-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-255-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-243-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-252-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-253-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/4532-249-0x0000018CD0B10000-0x0000018CD0B11000-memory.dmp

Filesize
4KB

Download
memory/5072-224-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5072-143-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5072-140-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5072-146-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5072-156-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/5072-145-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5072-236-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5072-225-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/5072-239-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download