Overview

overview

10

Static

static

3

Auto Clicker v1.exe

windows10-2004-x64

10

Auto Clicker v1.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/07/2026, 04:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Auto Clicker v1.exe
  • Size 34.3MB
  • Sample260724-evfp1sscpg
  • SHA256 551a6a5f0c07da8a2ec01febb47a0b381f47c7f9444168e8ee28e984474b859b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionexecutiondonutloaderneptuneratloaderpersistencepyinstallerspywaretrojan

Malware Config

Extracted

Family

  • neptunerat

C2

  • russn-48812.portmap.host:48812

Attributes
  • filename

    USB.exe

  • group

    MasonGroup

  • key

    FMyLVvjBTyADMJTG

  • rat_name

    MasonRAT

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat
  • Detects DonutLoader 3 IoCs
    loader
  • Detects NeptuneRAT stealer 1 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 22 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Windows directory 2 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:620
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:452
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Drops file in System32 directory
        PID:684
      • C:\Windows\System32\WUDFHost.exe
        "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-888ce475-a75c-4bcb-b7ef-313a7ab1c0e1 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-424f45f0-a3e9-47f1-b564-c4196175302d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f22c3176-2db1-4946-92ca-08051ca2873d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-337e034f-461f-4040-a641-f3c2f6a3f1ca -LifetimeId:e8b22b59-a692-44fb-bf28-a62c601986f0 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
        1⤵
          PID:876
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:1012
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:872
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:1040
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                1⤵
                  PID:1164
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                    PID:1188
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1200
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:1036
                      • C:\Users\Admin\AppData\Roaming\WUDFHost.exe
                        C:\Users\Admin\AppData\Roaming\WUDFHost.exe
                        2⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2808
                        • C:\Users\Admin\AppData\Local\Temp\kxe3whan.fcu.exe
                          "C:\Users\Admin\AppData\Local\Temp\kxe3whan.fcu.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1908
                      • C:\Users\Admin\AppData\Roaming\Explorer.EXE
                        C:\Users\Admin\AppData\Roaming\Explorer.EXE
                        2⤵
                        • Executes dropped EXE
                        PID:3780
                      • C:\Users\Admin\AppData\Roaming\Explorer.EXE
                        C:\Users\Admin\AppData\Roaming\Explorer.EXE
                        2⤵
                        • Executes dropped EXE
                        PID:3020
                      • C:\Users\Admin\AppData\Roaming\Explorer.EXE
                        C:\Users\Admin\AppData\Roaming\Explorer.EXE
                        2⤵
                        • Executes dropped EXE
                        PID:2668
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                      1⤵
                        PID:1208
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1280
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1340
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                            1⤵
                              PID:1412
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                              1⤵
                                PID:1420
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                1⤵
                                  PID:1428
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                  1⤵
                                    PID:1472
                                    • C:\Windows\system32\sihost.exe
                                      sihost.exe
                                      2⤵
                                        PID:3056
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                      1⤵
                                        PID:1720
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                        1⤵
                                          PID:1760
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                          1⤵
                                            PID:1776
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                            1⤵
                                              PID:1876
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                              1⤵
                                                PID:1900
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                1⤵
                                                  PID:1920
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                  1⤵
                                                    PID:2008
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:1768
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1820
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                        1⤵
                                                          PID:2096
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                          1⤵
                                                            PID:2144
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                            1⤵
                                                              PID:2168
                                                            • C:\Windows\System32\spoolsv.exe
                                                              C:\Windows\System32\spoolsv.exe
                                                              1⤵
                                                                PID:2264
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                1⤵
                                                                  PID:2380
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                  1⤵
                                                                    PID:2520
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                    1⤵
                                                                      PID:2648
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                      1⤵
                                                                        PID:2656
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                        1⤵
                                                                        • Drops file in System32 directory
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:2764
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2772
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2816
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2852
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                              1⤵
                                                                                PID:2088
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                1⤵
                                                                                  PID:1620
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                  1⤵
                                                                                    PID:3184
                                                                                  • C:\Windows\Explorer.EXE
                                                                                    C:\Windows\Explorer.EXE
                                                                                    1⤵
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    • Suspicious use of UnmapMainImage
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3272
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Auto Clicker v1.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Auto Clicker v1.exe"
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1484
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe"
                                                                                        3⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1388
                                                                                        • C:\Users\Admin\AppData\Local\Temp\c2007007-8f40-4d74-9fed-3541cde8bb10.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\c2007007-8f40-4d74-9fed-3541cde8bb10.exe"
                                                                                          4⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3440
                                                                                          • C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe"
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:384
                                                                                          • C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe"
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Checks system information in the registry
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4620
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorHost.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorHost.exe" --r
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              • Checks system information in the registry
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1136
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorHost.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorHost.exe" --wd 1136
                                                                                                7⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks system information in the registry
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:4248
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                cmd.exe /c chcp 65001 >nul && h òʳ¥·t
                                                                                                7⤵
                                                                                                • Executes a command shell one-liner
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3520
                                                                                                • C:\Windows\system32\chcp.com
                                                                                                  chcp 65001
                                                                                                  8⤵
                                                                                                    PID:2292
                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                  cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "SensorMonitorHost" /tr "\"C:\Users\Admin\AppData\Roaming\SensorMonitorHost.exe\"" /ru ""
                                                                                                  7⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4796
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    8⤵
                                                                                                      PID:4760
                                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                                      schtasks /create /f /sc onlogon /tn "SensorMonitorHost" /tr "\"C:\Users\Admin\AppData\Roaming\SensorMonitorHost.exe\"" /ru ""
                                                                                                      8⤵
                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                      PID:3264
                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                    cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorHost.exe"
                                                                                                    7⤵
                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3452
                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                      chcp 65001
                                                                                                      8⤵
                                                                                                        PID:1888
                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Network\SensorMonitorHost.exe"
                                                                                                        8⤵
                                                                                                        • Views/modifies file attributes
                                                                                                        PID:2556
                                                                                            • C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4388
                                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe"
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:396
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c "ver"
                                                                                                  5⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:4696
                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                            "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Explorer" /tr "C:\Users\Admin\AppData\Roaming\Explorer.EXE"
                                                                                            2⤵
                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                            PID:3592
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                          1⤵
                                                                                            PID:3396
                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                            1⤵
                                                                                              PID:3584
                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              PID:3740
                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                              1⤵
                                                                                                PID:4088
                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:4884
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                  1⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:4972
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                  1⤵
                                                                                                  • Drops file in System32 directory
                                                                                                  PID:3352
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                  1⤵
                                                                                                    PID:5060
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                    1⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:4988
                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:4500
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                      1⤵
                                                                                                        PID:1576
                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                        1⤵
                                                                                                        • Drops file in System32 directory
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        PID:1948
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                        1⤵
                                                                                                          PID:3704
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                          1⤵
                                                                                                            PID:2164
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                            1⤵
                                                                                                              PID:1728
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                              1⤵
                                                                                                                PID:2976
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                1⤵
                                                                                                                  PID:1408
                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                  1⤵
                                                                                                                    PID:2860
                                                                                                                  • C:\Users\Admin\AppData\Roaming\WUDFHost.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\WUDFHost.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4816
                                                                                                                  • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                    C:\Windows\System32\WaaSMedicAgent.exe fda44f776aa58e3199c476f20d085554 v5nA9T+Vt0KvbW+nRlI5yA.0.1.0.0.0
                                                                                                                    1⤵
                                                                                                                    • Sets service image path in registry
                                                                                                                    PID:4208
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      2⤵
                                                                                                                        PID:816
                                                                                                                    • C:\Users\Admin\AppData\Roaming\SensorMonitorHost.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\SensorMonitorHost.exe"
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks system information in the registry
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4564
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                      1⤵
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      PID:3840
                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                      1⤵
                                                                                                                      • Checks BIOS information in registry
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Enumerates system info in registry
                                                                                                                      PID:3988
                                                                                                                    • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                      C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                      1⤵
                                                                                                                        PID:2356
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        1⤵
                                                                                                                          PID:260
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Explorer.EXE
                                                                                                                          C:\Users\Admin\AppData\Roaming\Explorer.EXE
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5076
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                          1⤵
                                                                                                                            PID:2296
                                                                                                                          • C:\Windows\System32\mousocoreworker.exe
                                                                                                                            C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            PID:3652
                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:1152
                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                              1⤵
                                                                                                                              • Modifies registry class
                                                                                                                              PID:3944
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              1⤵
                                                                                                                                PID:1828
                                                                                                                              • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                                C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:1324

                                                                                                                                Network

                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                      Reconnaissance

                                                                                                                                      Resource Development

                                                                                                                                      Initial Access

                                                                                                                                      Execution

                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                      1
                                                                                                                                      T1059

                                                                                                                                      Windows Command Shell

                                                                                                                                      1
                                                                                                                                      T1059.003

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      Persistence

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      2
                                                                                                                                      T1547

                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                      2
                                                                                                                                      T1547.001

                                                                                                                                      Create or Modify System Process

                                                                                                                                      1
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      1
                                                                                                                                      T1543.003

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      Privilege Escalation

                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                      2
                                                                                                                                      T1547

                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                      2
                                                                                                                                      T1547.001

                                                                                                                                      Create or Modify System Process

                                                                                                                                      1
                                                                                                                                      T1543

                                                                                                                                      Windows Service

                                                                                                                                      1
                                                                                                                                      T1543.003

                                                                                                                                      Scheduled Task/Job

                                                                                                                                      1
                                                                                                                                      T1053

                                                                                                                                      Scheduled Task

                                                                                                                                      1
                                                                                                                                      T1053.005

                                                                                                                                      Defense Evasion

                                                                                                                                      Hide Artifacts

                                                                                                                                      2
                                                                                                                                      T1564

                                                                                                                                      Hidden Files and Directories

                                                                                                                                      2
                                                                                                                                      T1564.001

                                                                                                                                      Modify Registry

                                                                                                                                      3
                                                                                                                                      T1112

                                                                                                                                      Credential Access

                                                                                                                                      Discovery

                                                                                                                                      Peripheral Device Discovery

                                                                                                                                      1
                                                                                                                                      T1120

                                                                                                                                      Query Registry

                                                                                                                                      7
                                                                                                                                      T1012

                                                                                                                                      System Information Discovery

                                                                                                                                      7
                                                                                                                                      T1082

                                                                                                                                      Lateral Movement

                                                                                                                                      Collection

                                                                                                                                      Command and Control

                                                                                                                                      Web Service

                                                                                                                                      1
                                                                                                                                      T1102

                                                                                                                                      Exfiltration

                                                                                                                                      Impact

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      config.json
                                                                                                                                      • Path C:\ProgramData\Microsoft\Windows\OneSettings\config.json
                                                                                                                                      • Size 6KB
                                                                                                                                      • SHA256 a798dead9cfb0ce27e67b6298c9cc85df87d4af6f0c865742a76a4cf5c208068
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      WUDFHost.exe.log
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WUDFHost.exe.log
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 471356f5b299eaaaf1856e0f3d93a94c68321a326f5210a952e93ddb3848647c
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      thumbcache_idx.db
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                      • Size 28KB
                                                                                                                                      • SHA256 0ceae9b35faf6c5a62d5c8b9b1499c8134ec1ef485403c69120998b4a455ba3b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Auto Clicker top Verison.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe
                                                                                                                                      • Size 31.3MB
                                                                                                                                      • SHA256 5bfb220977d005db83d251b72121086c9a267b2fdf38415eafd20b063cbed736
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Bypassed.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe
                                                                                                                                      • Size 3.0MB
                                                                                                                                      • SHA256 d1a8f947732fa87ece61bd3b380246229a5f065561d3814cfa8cba5673c14ba3
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      injection.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe
                                                                                                                                      • Size 474KB
                                                                                                                                      • SHA256 27a5c4f69c991b2e6988537a27d16b1b75069021cbb2f705a5716560a57017a6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      msnrt.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe
                                                                                                                                      • Size 648KB
                                                                                                                                      • SHA256 78a1a59e103a0bdccec0fe1873c9fe13e9473aa8e388b54b33d4386e4e7a6de0
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _imaging.cp311-win_amd64.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\PIL\_imaging.cp311-win_amd64.pyd
                                                                                                                                      • Size 2.5MB
                                                                                                                                      • SHA256 e04dfdb2bdba09efc4bee07924e7be18b0b324a890eae81a12509d54370d4621
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      VCRUNTIME140.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\VCRUNTIME140.dll
                                                                                                                                      • Size 116KB
                                                                                                                                      • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _asyncio.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_asyncio.pyd
                                                                                                                                      • Size 63KB
                                                                                                                                      • SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _bz2.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_bz2.pyd
                                                                                                                                      • Size 82KB
                                                                                                                                      • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _ctypes.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_ctypes.pyd
                                                                                                                                      • Size 121KB
                                                                                                                                      • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _decimal.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_decimal.pyd
                                                                                                                                      • Size 249KB
                                                                                                                                      • SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _elementtree.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_elementtree.pyd
                                                                                                                                      • Size 125KB
                                                                                                                                      • SHA256 02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _hashlib.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_hashlib.pyd
                                                                                                                                      • Size 63KB
                                                                                                                                      • SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _lzma.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_lzma.pyd
                                                                                                                                      • Size 155KB
                                                                                                                                      • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _multiprocessing.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_multiprocessing.pyd
                                                                                                                                      • Size 33KB
                                                                                                                                      • SHA256 975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _overlapped.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_overlapped.pyd
                                                                                                                                      • Size 50KB
                                                                                                                                      • SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _queue.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_queue.pyd
                                                                                                                                      • Size 31KB
                                                                                                                                      • SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _socket.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_socket.pyd
                                                                                                                                      • Size 77KB
                                                                                                                                      • SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _ssl.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_ssl.pyd
                                                                                                                                      • Size 174KB
                                                                                                                                      • SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      cp1252.enc
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_tcl_data\encoding\cp1252.enc
                                                                                                                                      • Size 1KB
                                                                                                                                      • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      _tkinter.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\_tkinter.pyd
                                                                                                                                      • Size 62KB
                                                                                                                                      • SHA256 6f7bdc2f60a1795b58ec7015ec262d6b234aa8d0f022185de0f52bac4adab449
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      base_library.zip
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\base_library.zip
                                                                                                                                      • Size 1.4MB
                                                                                                                                      • SHA256 b17d13b8e49ef891343dff3117cd8290285fec9e1fcde794b141750c2d775409
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      blue.json
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\customtkinter\assets\themes\blue.json
                                                                                                                                      • Size 4KB
                                                                                                                                      • SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      libcrypto-3.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\libcrypto-3.dll
                                                                                                                                      • Size 5.0MB
                                                                                                                                      • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      libffi-8.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\libffi-8.dll
                                                                                                                                      • Size 38KB
                                                                                                                                      • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      libssl-3.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\libssl-3.dll
                                                                                                                                      • Size 768KB
                                                                                                                                      • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      pyexpat.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\pyexpat.pyd
                                                                                                                                      • Size 194KB
                                                                                                                                      • SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      python3.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\python3.dll
                                                                                                                                      • Size 65KB
                                                                                                                                      • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      python311.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\python311.dll
                                                                                                                                      • Size 5.5MB
                                                                                                                                      • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      select.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\select.pyd
                                                                                                                                      • Size 29KB
                                                                                                                                      • SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      tcl86t.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\tcl86t.dll
                                                                                                                                      • Size 1.8MB
                                                                                                                                      • SHA256 4e699ff2d6d147d0586c8c77be5a18f20ca0758f432d7b0f489223f2fa4dd221
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      tk86t.dll
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\tk86t.dll
                                                                                                                                      • Size 1.5MB
                                                                                                                                      • SHA256 b6af038120f2b8644c7ce1e11917f410009848287622135d7e386f90d28a831c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      unicodedata.pyd
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI43882\unicodedata.pyd
                                                                                                                                      • Size 1.1MB
                                                                                                                                      • SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      c2007007-8f40-4d74-9fed-3541cde8bb10.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\c2007007-8f40-4d74-9fed-3541cde8bb10.exe
                                                                                                                                      • Size 1.1MB
                                                                                                                                      • SHA256 c836f1e0b97cc0dc3d8942ba1858590df48f227d75ab955ddea3b2921abe4b2f
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      kxe3whan.fcu.exe
                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\kxe3whan.fcu.exe
                                                                                                                                      • Size 161KB
                                                                                                                                      • SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      TMPDD4B.tmp
                                                                                                                                      • Path C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\TMPDD4B.tmp
                                                                                                                                      • Size 18KB
                                                                                                                                      • SHA256 91347117faf3dd9dd254e2da8f9b0dfa29a9a0193562d8938b4005bae951d64c
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      sls.cab
                                                                                                                                      • Path C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\sls.cab
                                                                                                                                      • Size 29KB
                                                                                                                                      • SHA256 0f872c844e14b0384ba776a42cbcddc93cde1ace671fd705b7f17c1f0ae15f1b
                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Schedule Maintenance Work
                                                                                                                                      • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Schedule Maintenance Work
                                                                                                                                      • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Schedule Wake To Work
                                                                                                                                      • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Schedule Wake To Work
                                                                                                                                      • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Schedule Work
                                                                                                                                      • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      Schedule Work
                                                                                                                                      • Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                      • Size 2KB
                                                                                                                                      • SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                      Submit Download

                                                                                                                                      memory/384-180-0x0000000000590000-0x000000000060C000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/452-1183-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/452-1182-0x00000248C7730000-0x00000248C775B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/620-1165-0x000001AE3C800000-0x000001AE3C825000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/620-1167-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/620-1166-0x000001AE3C830000-0x000001AE3C85B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/684-1170-0x0000018DF2F60000-0x0000018DF2F8B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/684-1171-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/872-1187-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/872-1186-0x0000014610510000-0x000001461053B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/876-1174-0x0000024718500000-0x000002471852B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/876-1175-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1012-1179-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1012-1178-0x000002109B500000-0x000002109B52B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1040-1191-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1040-1190-0x0000015151C00000-0x0000015151C2B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1136-1159-0x00007FF6D4B90000-0x00007FF6D4C4F000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1164-1195-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1164-1194-0x000001D03B800000-0x000001D03B82B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1188-1198-0x000002EE86520000-0x000002EE8654B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1188-1199-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1200-1202-0x00000278BC2D0000-0x00000278BC2FB000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1200-1203-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1208-1207-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1208-1206-0x000001FCE4900000-0x000001FCE492B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1280-1210-0x000001ECA10B0000-0x000001ECA10DB000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1280-1211-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1340-1215-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1340-1214-0x000001A7FAEB0000-0x000001A7FAEDB000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1388-17-0x0000000000450000-0x0000000000754000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1412-1219-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1412-1218-0x00000177C1400000-0x00000177C142B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1420-1223-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1420-1222-0x0000025BF2460000-0x0000025BF248B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1428-1227-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1428-1226-0x00000236CF700000-0x00000236CF72B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1472-1231-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1472-1230-0x0000023A594B0000-0x0000023A594DB000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1484-157-0x00007FF7340D0000-0x00007FF7340DE000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1720-1234-0x0000017AB0D40000-0x0000017AB0D6B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1720-1235-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1760-1238-0x000002339C7A0000-0x000002339C7CB000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1760-1239-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1768-1262-0x000001EDCC760000-0x000001EDCC78B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1768-1263-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1776-1242-0x0000025569360000-0x000002556938B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1776-1243-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1820-1267-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1820-1266-0x0000023DC5060000-0x0000023DC508B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1876-1247-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1876-1246-0x0000018B97EF0000-0x0000018B97F1B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1900-1251-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1900-1250-0x000002B1D4E30000-0x000002B1D4E5B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1908-1158-0x00007FFB37650000-0x00007FFB37845000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1908-1161-0x00007FFB36760000-0x00007FFB3681E000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1920-1255-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/1920-1254-0x000002BB68F10000-0x000002BB68F3B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2008-1258-0x0000014B6FD70000-0x0000014B6FD9B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2008-1259-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2096-1270-0x000002191A5D0000-0x000002191A5FB000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2096-1271-0x00007FFAF76D0000-0x00007FFAF76E0000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2144-1274-0x0000020D38730000-0x0000020D3875B000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2808-1148-0x000000001B7E0000-0x000000001B82C000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2808-1160-0x000000001BC20000-0x000000001BC3C000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/2808-1151-0x0000000002ED0000-0x0000000002EFC000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3272-1162-0x0000000002440000-0x0000000002454000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3272-1163-0x0000000002B40000-0x0000000002B52000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/3440-558-0x00007FF6C9E10000-0x00007FF6C9E1D000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4564-1137-0x00007FF7C0310000-0x00007FF7C03CF000-memory.dmp
                                                                                                                                      Download

                                                                                                                                      memory/4620-592-0x00007FF757FC0000-0x00007FF75807F000-memory.dmp
                                                                                                                                      Download