Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    303s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/09/2024, 05:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    844987087405a578c916395785e083a9b71b1d84754c289c3321d4146a166e9f.exe
  • Size 1.8MB
  • Sample240930-fpsm3ayhln
  • SHA256 844987087405a578c916395785e083a9b71b1d84754c289c3321d4146a166e9f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylummaredlinestealcxworm9c9aa5@oleh_pspdefaultdefault2domafed3aalivetrafficnewbundle2tg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasionexecutioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • fed3aa

C2

  • http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 136.244.88.135:17615

Extracted

Family

  • redline

Botnet

  • @OLEH_PSP

C2

  • 65.21.18.51:45580

Extracted

Family

  • stealc

Botnet

  • default2

C2

  • http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

  • redline

Botnet

  • TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

  • 89.105.223.196:29862

Extracted

Family

  • redline

Botnet

  • newbundle2

C2

  • 185.215.113.67:15206

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • 188.190.10.161:4444

Mutex

  • TSXTkO0pNBdN2KNw

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

  • amadey

Version

  • 4.42

Botnet

  • 9c9aa5

C2

  • http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

  • stealc

Botnet

  • doma

C2

  • http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

  • lumma

C2

  • https://chaptermusu.store/api

  • https://possiwreeste.site/api

  • https://underlinemdsj.site/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 1 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 15 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 30 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 48 IoCs
  • Identifies Wine through registry keys 2 TTPs 15 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 7 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3472
      • C:\Users\Admin\AppData\Local\Temp\844987087405a578c916395785e083a9b71b1d84754c289c3321d4146a166e9f.exe
        "C:\Users\Admin\AppData\Local\Temp\844987087405a578c916395785e083a9b71b1d84754c289c3321d4146a166e9f.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4580
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:2104
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3068
            • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
              "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1848
              • C:\Users\Admin\AppData\Roaming\6Z4Dt5Dl9h.exe
                "C:\Users\Admin\AppData\Roaming\6Z4Dt5Dl9h.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:752
              • C:\Users\Admin\AppData\Roaming\kmEzdkTwCY.exe
                "C:\Users\Admin\AppData\Roaming\kmEzdkTwCY.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3156
            • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
              "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:756
              • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:420
                • C:\Users\Admin\AppData\Local\Temp\1000072001\javumarfirst.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000072001\javumarfirst.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  PID:5024
                  • C:\Users\Admin\AppData\Local\Temp\service123.exe
                    "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:6592
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:6136
            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4596
            • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
              "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2856
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:1708
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 1192
                  6⤵
                  • Program crash
                  PID:6164
            • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
              "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2744
            • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
              "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:936
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4760
            • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4264
            • C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
              "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4472
            • C:\Users\Admin\AppData\Local\Temp\1000354001\8d9881a82b.exe
              "C:\Users\Admin\AppData\Local\Temp\1000354001\8d9881a82b.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:6552
            • C:\Users\Admin\AppData\Local\Temp\1000355001\7cc082e7f2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000355001\7cc082e7f2.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4376
              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5232
            • C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
              "C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2860
            • C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
              "C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5992
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c start context.exe
                5⤵
                  PID:5284
                  • C:\Users\Admin\AppData\Local\Temp\context.exe
                    context.exe
                    6⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5176
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:6756
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        8⤵
                        • Enumerates processes with tasklist
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2448
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /I "wrsa opssvc"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:664
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        8⤵
                        • Enumerates processes with tasklist
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2864
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:1920
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c md 607698
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:6512
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:6812
                      • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                        Waters.pif Q
                        8⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:6568
                      • C:\Windows\SysWOW64\choice.exe
                        choice /d y /t 5
                        8⤵
                        • System Location Discovery: System Language Discovery
                        PID:6480
              • C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
                "C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
                4⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:3944
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1592
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    6⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5432
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "wrsa opssvc"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:4524
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    6⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3628
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:2860
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 607698
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:6388
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /V "MaskBathroomCompositionInjection" Participants
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:5852
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:6896
                  • C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
                    Waters.pif Q
                    6⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:7092
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:7148
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im "Waters.pif"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5892
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:3824
                  • C:\Windows\SysWOW64\choice.exe
                    choice /d y /t 5
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:3396
              • C:\Users\Admin\AppData\Local\Temp\1000376001\Ewpeloxttug.exe
                "C:\Users\Admin\AppData\Local\Temp\1000376001\Ewpeloxttug.exe"
                4⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Drops startup file
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:6008
              • C:\Users\Admin\AppData\Local\Temp\1000377001\CompleteStudio.exe
                "C:\Users\Admin\AppData\Local\Temp\1000377001\CompleteStudio.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:2068
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:6488
              • C:\Users\Admin\AppData\Local\Temp\1000378001\2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000378001\2.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:5832
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1604
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:5336
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5716
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6672
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
            2⤵
            • System Location Discovery: System Language Discovery
            PID:5192
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
              3⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:7084
          • C:\Windows\SysWOW64\cmd.exe
            cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
            2⤵
            • Drops startup file
            • System Location Discovery: System Language Discovery
            PID:5216
          • C:\Users\Admin\AppData\Local\Temp\1000376001\Ewpeloxttug.exe
            "C:\Users\Admin\AppData\Local\Temp\1000376001\Ewpeloxttug.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:5636
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:5144
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          1⤵
          • Executes dropped EXE
          PID:5644
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:5768
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:2476
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          1⤵
          • Executes dropped EXE
          PID:5856
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:5368
        • C:\Users\Admin\AppData\Local\Temp\service123.exe
          C:\Users\Admin\AppData\Local\Temp\/service123.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5752
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:6688
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          1⤵
          • Executes dropped EXE
          PID:4572
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:1720
        • C:\Users\Admin\AppData\Local\Temp\service123.exe
          C:\Users\Admin\AppData\Local\Temp\/service123.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1316
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:5932
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          1⤵
          • Executes dropped EXE
          PID:6368
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:5024
        • C:\Users\Admin\AppData\Local\Temp\service123.exe
          C:\Users\Admin\AppData\Local\Temp\/service123.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5452
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          1⤵
          • Executes dropped EXE
          PID:4764
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:5228
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:2892
        • C:\Users\Admin\AppData\Local\Temp\service123.exe
          C:\Users\Admin\AppData\Local\Temp\/service123.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2820

        Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Modify Registry

              2
              T1112

              Subvert Trust Controls

              1
              T1553

              Install Root Certificate

              1
              T1553.004

              Virtualization/Sandbox Evasion

              2
              T1497

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              4
              T1552.001

              Discovery

              Process Discovery

              1
              T1057

              Query Registry

              5
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Virtualization/Sandbox Evasion

              2
              T1497

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              RegAsm.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
              • Size 2KB
              • SHA256 4abf5062795d3f151ef6f2e6a099488102e6448db4649acf7b7b226f6210da30
              • MD5 SHA1 SHA512
              Submit Download

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              • Size 2KB
              • SHA256 413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
              • MD5 SHA1 SHA512
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 b5ccf97ea28defb7bdc82c9bd4f4e575650c4f5878bd2147d8360fb3f6ec246c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              gold.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
              • Size 314KB
              • SHA256 d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              12dsvc.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
              • Size 1006KB
              • SHA256 799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Nework.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
              • Size 416KB
              • SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              stealc_default2.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
              • Size 187KB
              • SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javumarfirst.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000072001\javumarfirst.exe
              • Size 9.5MB
              • SHA256 0fb82d8a8edd32ba4f80b129b228c9e74871f55f970b44c75af5aa4572b1b582
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              needmoney.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
              • Size 4.1MB
              • SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              penis.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
              • Size 409KB
              • SHA256 87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              crypted.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
              • Size 314KB
              • SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              newbundle2.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
              • Size 304KB
              • SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              rstxdhuj.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
              • Size 963KB
              • SHA256 0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              8d9881a82b.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000354001\8d9881a82b.exe
              • Size 1.8MB
              • SHA256 d71873f393259dc6b0998b4be7be61adbc24e0652716c2aaab2bbcb3d6cafabe
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7cc082e7f2.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000355001\7cc082e7f2.exe
              • Size 1.8MB
              • SHA256 5b7c78f3bc09b7882a600bd5561623c7c357ec89ac2c9b3419c889f8ee015ae7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              lummetc.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
              • Size 352KB
              • SHA256 13167320a0e8266a56694be70a9560c83e2c645d6eeaa147b9ae585c2960ebb2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              processclass.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
              • Size 6KB
              • SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              splwow64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
              • Size 1.3MB
              • SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Ewpeloxttug.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000376001\Ewpeloxttug.exe
              • Size 2.2MB
              • SHA256 21aaa5319a6729df0581203a0782ead837b848387e44cd1844ca8e19882a50af
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              CompleteStudio.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000377001\CompleteStudio.exe
              • Size 479KB
              • SHA256 d6872d521e977683f9fbf54b80e2a218aec4f0ae9caaa233ca9797f16c37b4d4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              2.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000378001\2.exe
              • Size 1.9MB
              • SHA256 7451a7613a173ab1c80d664892cb744c7f09925dedf9adb964b31861b74cb713
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              axplong.exe
              • Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              • Size 1.8MB
              • SHA256 844987087405a578c916395785e083a9b71b1d84754c289c3321d4146a166e9f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Q
              • Path C:\Users\Admin\AppData\Local\Temp\607698\Q
              • Size 794KB
              • SHA256 361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Emotions
              • Path C:\Users\Admin\AppData\Local\Temp\Emotions
              • Size 19KB
              • SHA256 2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Tmp7520.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp7520.tmp
              • Size 2KB
              • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
              • MD5 SHA1 SHA512
              Submit Download

              __PSScriptPolicyTest_zjlqbctk.3o0.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjlqbctk.3o0.ps1
              • Size 1B
              • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
              • MD5 SHA1 SHA512
              Submit Download

              svchost015.exe
              • Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              • Size 2.9MB
              • SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              6Z4Dt5Dl9h.exe
              • Path C:\Users\Admin\AppData\Roaming\6Z4Dt5Dl9h.exe
              • Size 490KB
              • SHA256 8707c03158ba6395a11bdfd8c1b11eeedc2e052d3b55d73d0a5c64417e5fbd3b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              76b53b3ec448f7ccdda2063b15d2bfc3_ebaa0802-254d-4be1-a642-a8a5c0b06224
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4106386276-4127174233-3637007343-1000\76b53b3ec448f7ccdda2063b15d2bfc3_ebaa0802-254d-4be1-a642-a8a5c0b06224
              • Size 2KB
              • SHA256 513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a
              • MD5 SHA1 SHA512
              Submit Download

              76b53b3ec448f7ccdda2063b15d2bfc3_ebaa0802-254d-4be1-a642-a8a5c0b06224
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4106386276-4127174233-3637007343-1000\76b53b3ec448f7ccdda2063b15d2bfc3_ebaa0802-254d-4be1-a642-a8a5c0b06224
              • Size 2KB
              • SHA256 304248f5943d1fb7f3bf70ad83a6598d44b9e434b5522133f1577be53bbbf1d6
              • MD5 SHA1 SHA512
              Submit Download

              76b53b3ec448f7ccdda2063b15d2bfc3_ebaa0802-254d-4be1-a642-a8a5c0b06224
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4106386276-4127174233-3637007343-1000\76b53b3ec448f7ccdda2063b15d2bfc3_ebaa0802-254d-4be1-a642-a8a5c0b06224
              • Size 2KB
              • SHA256 87ef6dce241efc8922a93132606104ef78b6658664994587aa5d70e07ae1a6aa
              • MD5 SHA1 SHA512
              Submit Download

              kmEzdkTwCY.exe
              • Path C:\Users\Admin\AppData\Roaming\kmEzdkTwCY.exe
              • Size 304KB
              • SHA256 5a00e3718afb5bfb18a6b1c824b680015733f0403af0d5663289a17ba8206cc3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Google Chrome.lnk
              • Path C:\Users\Public\Desktop\Google Chrome.lnk
              • Size 2KB
              • SHA256 02c8ec24d83d7f8532b8f3e6b28adae62c75945dc0e9e5c76375082563f2fdae
              • MD5 SHA1 SHA512
              Submit Download

              mozglue.dll
              • Path \ProgramData\mozglue.dll
              • Size 593KB
              • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              nss3.dll
              • Path \ProgramData\nss3.dll
              • Size 2.0MB
              • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/752-143-0x0000000009170000-0x00000000091D6000-memory.dmp
              Download

              memory/752-144-0x000000000A100000-0x000000000A2C2000-memory.dmp
              Download

              memory/752-145-0x000000000A800000-0x000000000AD2C000-memory.dmp
              Download

              memory/752-62-0x0000000000C10000-0x0000000000C90000-memory.dmp
              Download

              memory/936-231-0x0000000000EB0000-0x0000000000F04000-memory.dmp
              Download

              memory/1708-3237-0x0000000000400000-0x0000000000643000-memory.dmp
              Download

              memory/1708-312-0x0000000000400000-0x0000000000643000-memory.dmp
              Download

              memory/1708-315-0x0000000000400000-0x0000000000643000-memory.dmp
              Download

              memory/1708-317-0x0000000000400000-0x0000000000643000-memory.dmp
              Download

              memory/1720-3280-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/1964-12-0x0000000000BB0000-0x000000000105B000-memory.dmp
              Download

              memory/1964-5-0x0000000000BB0000-0x000000000105B000-memory.dmp
              Download

              memory/1964-3-0x0000000000BB0000-0x000000000105B000-memory.dmp
              Download

              memory/1964-2-0x0000000000BB1000-0x0000000000BDF000-memory.dmp
              Download

              memory/1964-1-0x00000000775B4000-0x00000000775B5000-memory.dmp
              Download

              memory/1964-0-0x0000000000BB0000-0x000000000105B000-memory.dmp
              Download

              memory/2068-3120-0x0000000000B30000-0x0000000000BAE000-memory.dmp
              Download

              memory/2068-3122-0x000000001DBD0000-0x000000001DC3E000-memory.dmp
              Download

              memory/2476-3236-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/2744-208-0x0000000000BC0000-0x0000000000C2C000-memory.dmp
              Download

              memory/2856-318-0x0000000000400000-0x000000000081B000-memory.dmp
              Download

              memory/2892-3359-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/2892-3363-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/3068-104-0x0000000006600000-0x000000000664B000-memory.dmp
              Download

              memory/3068-102-0x00000000065D0000-0x00000000065E2000-memory.dmp
              Download

              memory/3068-53-0x0000000005000000-0x000000000500A000-memory.dmp
              Download

              memory/3068-103-0x0000000006770000-0x00000000067AE000-memory.dmp
              Download

              memory/3068-36-0x0000000004F20000-0x0000000004FB2000-memory.dmp
              Download

              memory/3068-95-0x0000000005AA0000-0x0000000005B16000-memory.dmp
              Download

              memory/3068-33-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/3068-100-0x0000000006990000-0x0000000006F96000-memory.dmp
              Download

              memory/3068-35-0x0000000005420000-0x000000000591E000-memory.dmp
              Download

              memory/3068-101-0x0000000006660000-0x000000000676A000-memory.dmp
              Download

              memory/3068-96-0x0000000006160000-0x000000000617E000-memory.dmp
              Download

              memory/3156-183-0x0000000006F90000-0x0000000006FE0000-memory.dmp
              Download

              memory/3156-59-0x0000000000250000-0x00000000002A2000-memory.dmp
              Download

              memory/4264-288-0x00000000006E0000-0x0000000000732000-memory.dmp
              Download

              memory/4376-1796-0x0000000000B00000-0x0000000000FAE000-memory.dmp
              Download

              memory/4376-1947-0x0000000000B00000-0x0000000000FAE000-memory.dmp
              Download

              memory/4472-360-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-370-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-364-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-363-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-372-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-358-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-356-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-352-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-348-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-346-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-344-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-342-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-340-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-338-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-336-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-354-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-350-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-335-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-1411-0x00000000055B0000-0x0000000005618000-memory.dmp
              Download

              memory/4472-1412-0x0000000005620000-0x000000000566C000-memory.dmp
              Download

              memory/4472-1416-0x00000000056C0000-0x0000000005714000-memory.dmp
              Download

              memory/4472-334-0x0000000004D80000-0x0000000004E6E000-memory.dmp
              Download

              memory/4472-333-0x00000000001A0000-0x0000000000298000-memory.dmp
              Download

              memory/4472-368-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-366-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-378-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-376-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4472-374-0x0000000004D80000-0x0000000004E68000-memory.dmp
              Download

              memory/4580-31-0x0000000000B70000-0x0000000000BC4000-memory.dmp
              Download

              memory/4596-140-0x0000000000D30000-0x0000000000F73000-memory.dmp
              Download

              memory/4596-320-0x0000000000D30000-0x0000000000F73000-memory.dmp
              Download

              memory/4596-148-0x0000000061E00000-0x0000000061EF3000-memory.dmp
              Download

              memory/4760-239-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/4936-146-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-126-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-16-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-119-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-139-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-147-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-18-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-15-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-17-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-316-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/4936-14-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/5024-3321-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5144-1976-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/5144-1984-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/5228-3361-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5232-1946-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5232-2444-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5336-1419-0x0000000000190000-0x00000000001BE000-memory.dmp
              Download

              memory/5336-1420-0x00000000049A0000-0x0000000004A3C000-memory.dmp
              Download

              memory/5368-3232-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5368-3234-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5716-1432-0x0000000007E70000-0x0000000007E8C000-memory.dmp
              Download

              memory/5716-1431-0x00000000080E0000-0x0000000008430000-memory.dmp
              Download

              memory/5716-1427-0x0000000004C80000-0x0000000004CB6000-memory.dmp
              Download

              memory/5716-1428-0x0000000007720000-0x0000000007D48000-memory.dmp
              Download

              memory/5716-1671-0x0000000009AD0000-0x0000000009AD8000-memory.dmp
              Download

              memory/5716-1666-0x0000000009AE0000-0x0000000009AFA000-memory.dmp
              Download

              memory/5716-1429-0x00000000076D0000-0x00000000076F2000-memory.dmp
              Download

              memory/5716-1430-0x0000000007EA0000-0x0000000007F06000-memory.dmp
              Download

              memory/5716-1473-0x0000000009B30000-0x0000000009BC4000-memory.dmp
              Download

              memory/5716-1472-0x0000000009960000-0x0000000009A05000-memory.dmp
              Download

              memory/5716-1464-0x0000000009820000-0x0000000009853000-memory.dmp
              Download

              memory/5716-1467-0x0000000009800000-0x000000000981E000-memory.dmp
              Download

              memory/5716-1466-0x000000006BD90000-0x000000006BDDB000-memory.dmp
              Download

              memory/5768-1982-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5768-1979-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/5832-3140-0x0000000000E30000-0x0000000001014000-memory.dmp
              Download

              memory/5932-3319-0x0000000000830000-0x0000000000CDB000-memory.dmp
              Download

              memory/5992-1973-0x00000000009B0000-0x00000000009B8000-memory.dmp
              Download

              memory/6008-2028-0x0000000005510000-0x00000000055EC000-memory.dmp
              Download

              memory/6008-3115-0x0000000005660000-0x00000000056B8000-memory.dmp
              Download

              memory/6008-2027-0x0000000000980000-0x0000000000BB6000-memory.dmp
              Download

              memory/6552-1980-0x0000000000870000-0x0000000000F0E000-memory.dmp
              Download

              memory/6552-1465-0x0000000000870000-0x0000000000F0E000-memory.dmp
              Download

              memory/6672-1690-0x0000000008050000-0x00000000083A0000-memory.dmp
              Download

              memory/6672-1708-0x000000006BD90000-0x000000006BDDB000-memory.dmp
              Download

              memory/6672-1713-0x0000000009A30000-0x0000000009AD5000-memory.dmp
              Download

              memory/6688-3276-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download

              memory/6688-3278-0x0000000000330000-0x00000000007DE000-memory.dmp
              Download