donutloader | 551a6a5f0c07da8a2ec01febb47a0b381f47c7f9444168e8ee28e984474b859b

Analysis

max time kernel
137s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Auto Clicker v1.exe
Size 34.3MB
Sample260724-evfp1sscpg
SHA256 551a6a5f0c07da8a2ec01febb47a0b381f47c7f9444168e8ee28e984474b859b
MD5 2e51d734471f981c4d5d97be882147ee
SHA1 ea41ab36159d43f3d58db71f3ded337f6ec50cea
SHA512 43f537abc69b7e61755b3e774f2162d24f1df0030be67af51b15323c76de5cfa8f303c45b24ba7b360a4e2c3e31a7001bd15df8b6e6db9b51c78f383b440469c
SSDEEP 786432:83GwSEGCoW830A1QtIJ2j6+s7LWB75zuXVgiCuAHsMrwHNeNFRmqhx8:lwSEWWrMiIJ2qHWB75il4ZH5FsV
TLSH
T1B487012439EB101DF3F3AABA5FD4B9AF9D5EF673270A20B9106103468722D81DD91739
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion execution donutloader neptunerat loader persistence pyinstaller spyware trojan

Malware Config

Extracted

Family

neptunerat

russn-48812.portmap.host:48812

Attributes

filename
USB.exe
group
MasonGroup
key
FMyLVvjBTyADMJTG
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 3 IoCs

loader

resource	yara_rule
behavioral2/memory/2460-1145-0x0000000003230000-0x0000000003244000-memory.dmp	family_donutloader
behavioral2/memory/2076-1144-0x000000001B650000-0x000000001B66C000-memory.dmp	family_donutloader
behavioral2/memory/2076-1136-0x0000000002800000-0x000000000284C000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/2460-1146-0x00000000034D0000-0x00000000034E2000-memory.dmp	family_neptunerat

Executes dropped EXE 15 IoCs

pid	Process
4064	Bypassed.exe
4676	d7c9a467-7c03-4ed4-b5db-de38b0559219.exe
2140	Auto Clicker top Verison.exe
3752	injection.exe
4276	msnrt.exe
6100	ThermalServiceAgent.exe
5496	ThermalServiceAgent.exe
1204	WUDFHost.exe
4280	Auto Clicker top Verison.exe
4180	ThermalServiceAgent.exe
2076	WUDFHost.exe
3356	xvs2tpxy.l4l.exe
900	explorer.exe
2836	explorer.exe
6044	explorer.exe

Loads dropped DLL 17 IoCs

pid	Process
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe
4280	Auto Clicker top Verison.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyApplication	WUDFHost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Checks system information in the registry 2 TTPs 8 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	ThermalServiceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	ThermalServiceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	ThermalServiceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msnrt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msnrt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	ThermalServiceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	ThermalServiceAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	ThermalServiceAgent.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\explorer	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2052	cmd.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d00000001c4f5-12.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1052	cmd.exe
4952	cmd.exe
1644	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1784866562"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={783C2401-F9C0-4679-B460-CE4F7B469EBB}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 23 Jul 2026 10:54:27 GMT"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2432	schtasks.exe
3852	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2460	explorer.exe
2460	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4276	msnrt.exe
4276	msnrt.exe
4276	msnrt.exe
4276	msnrt.exe
6100	ThermalServiceAgent.exe
6100	ThermalServiceAgent.exe
6100	ThermalServiceAgent.exe
6100	ThermalServiceAgent.exe
5496	ThermalServiceAgent.exe
5496	ThermalServiceAgent.exe
5496	ThermalServiceAgent.exe
5496	ThermalServiceAgent.exe
4180	ThermalServiceAgent.exe
4180	ThermalServiceAgent.exe
4180	ThermalServiceAgent.exe
4180	ThermalServiceAgent.exe
2076	WUDFHost.exe
2076	WUDFHost.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe
3356	xvs2tpxy.l4l.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3752	injection.exe
Token: SeDebugPrivilege	1204	WUDFHost.exe
Token: SeDebugPrivilege	2076	WUDFHost.exe
Token: SeDebugPrivilege	2460	explorer.exe
Token: SeDebugPrivilege	3356	xvs2tpxy.l4l.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeAuditPrivilege	3124	svchost.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeShutdownPrivilege	2460	explorer.exe
Token: SeCreatePagefilePrivilege	2460	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3624	svchost.exe
Token: SeIncreaseQuotaPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeTakeOwnershipPrivilege	3624	svchost.exe
Token: SeLoadDriverPrivilege	3624	svchost.exe
Token: SeSystemtimePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeShutdownPrivilege	3624	svchost.exe
Token: SeSystemEnvironmentPrivilege	3624	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2460	explorer.exe
2460	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe
2460	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4280	Auto Clicker top Verison.exe
3008	Conhost.exe
2932	Conhost.exe
4252	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 4064	1424	Auto Clicker v1.exe	89
PID 4064 wrote to memory of 4676	4064	Bypassed.exe	90
PID 1424 wrote to memory of 2140	1424	Auto Clicker v1.exe	91
PID 4676 wrote to memory of 3752	4676	d7c9a467-7c03-4ed4-b5db-de38b0559219.exe	92
PID 4676 wrote to memory of 4276	4676	d7c9a467-7c03-4ed4-b5db-de38b0559219.exe	93
PID 4276 wrote to memory of 6100	4276	msnrt.exe	95
PID 6100 wrote to memory of 5496	6100	ThermalServiceAgent.exe	96
PID 6100 wrote to memory of 1052	6100	ThermalServiceAgent.exe	97
PID 1052 wrote to memory of 2308	1052	cmd.exe	100
PID 2140 wrote to memory of 4280	2140	Auto Clicker top Verison.exe	101
PID 6100 wrote to memory of 4952	6100	ThermalServiceAgent.exe	102
PID 4952 wrote to memory of 2624	4952	cmd.exe	104
PID 4952 wrote to memory of 3852	4952	cmd.exe	105
PID 4280 wrote to memory of 1644	4280	Auto Clicker top Verison.exe	106
PID 6100 wrote to memory of 2052	6100	ThermalServiceAgent.exe	108
PID 2052 wrote to memory of 2468	2052	cmd.exe	111
PID 2052 wrote to memory of 1756	2052	cmd.exe	112
PID 2076 wrote to memory of 3356	2076	WUDFHost.exe	115
PID 2076 wrote to memory of 2460	2076	WUDFHost.exe	81
PID 2460 wrote to memory of 2208	2460	explorer.exe
PID 2460 wrote to memory of 2432	2460	explorer.exe	117
PID 3356 wrote to memory of 740	3356	xvs2tpxy.l4l.exe	5
PID 3356 wrote to memory of 956	3356	xvs2tpxy.l4l.exe	9
PID 3356 wrote to memory of 952	3356	xvs2tpxy.l4l.exe	10
PID 3356 wrote to memory of 984	3356	xvs2tpxy.l4l.exe	11
PID 3356 wrote to memory of 416	3356	xvs2tpxy.l4l.exe	13
PID 3356 wrote to memory of 1116	3356	xvs2tpxy.l4l.exe	14
PID 3356 wrote to memory of 1148	3356	xvs2tpxy.l4l.exe	15
PID 3356 wrote to memory of 1212	3356	xvs2tpxy.l4l.exe	16
PID 3356 wrote to memory of 1264	3356	xvs2tpxy.l4l.exe	17
PID 3356 wrote to memory of 1312	3356	xvs2tpxy.l4l.exe	18
PID 3356 wrote to memory of 1352	3356	xvs2tpxy.l4l.exe	19
PID 3356 wrote to memory of 1412	3356	xvs2tpxy.l4l.exe	21
PID 3356 wrote to memory of 1452	3356	xvs2tpxy.l4l.exe	22
PID 3356 wrote to memory of 1552	3356	xvs2tpxy.l4l.exe	23
PID 3356 wrote to memory of 1684	3356	xvs2tpxy.l4l.exe	24
PID 3356 wrote to memory of 1712	3356	xvs2tpxy.l4l.exe	25
PID 3356 wrote to memory of 1748	3356	xvs2tpxy.l4l.exe	26
PID 3356 wrote to memory of 1892	3356	xvs2tpxy.l4l.exe	27
PID 3356 wrote to memory of 1904	3356	xvs2tpxy.l4l.exe	28
PID 3356 wrote to memory of 1928	3356	xvs2tpxy.l4l.exe	29
PID 3356 wrote to memory of 1140	3356	xvs2tpxy.l4l.exe	31
PID 3356 wrote to memory of 2064	3356	xvs2tpxy.l4l.exe	32
PID 3356 wrote to memory of 2148	3356	xvs2tpxy.l4l.exe	33
PID 3356 wrote to memory of 2228	3356	xvs2tpxy.l4l.exe	34
PID 3356 wrote to memory of 2332	3356	xvs2tpxy.l4l.exe	35
PID 3356 wrote to memory of 2372	3356	xvs2tpxy.l4l.exe	36
PID 3356 wrote to memory of 2528	3356	xvs2tpxy.l4l.exe	37
PID 3356 wrote to memory of 2604	3356	xvs2tpxy.l4l.exe	38
PID 3356 wrote to memory of 2656	3356	xvs2tpxy.l4l.exe	39
PID 3356 wrote to memory of 2692	3356	xvs2tpxy.l4l.exe	40
PID 3356 wrote to memory of 2756	3356	xvs2tpxy.l4l.exe	41
PID 3356 wrote to memory of 2792	3356	xvs2tpxy.l4l.exe	42
PID 3356 wrote to memory of 2904	3356	xvs2tpxy.l4l.exe	43
PID 3356 wrote to memory of 1888	3356	xvs2tpxy.l4l.exe	44
PID 3356 wrote to memory of 3096	3356	xvs2tpxy.l4l.exe	46
PID 3356 wrote to memory of 3124	3356	xvs2tpxy.l4l.exe	47
PID 3356 wrote to memory of 3192	3356	xvs2tpxy.l4l.exe	48
PID 3356 wrote to memory of 3440	3356	xvs2tpxy.l4l.exe	50
PID 3356 wrote to memory of 3504	3356	xvs2tpxy.l4l.exe	51
PID 3356 wrote to memory of 3524	3356	xvs2tpxy.l4l.exe	52
PID 3356 wrote to memory of 3584	3356	xvs2tpxy.l4l.exe	53
PID 3356 wrote to memory of 3608	3356	xvs2tpxy.l4l.exe	54
PID 3356 wrote to memory of 3624	3356	xvs2tpxy.l4l.exe	55

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1756	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:952
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1148

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:956

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-839a70bd-d0f5-4643-97d1-da5df2c18aab -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3f7e4f8b-8146-4d2b-a7c2-451da5b2f41e -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-29449c73-7fde-4d41-8801-6c183bd77ff7 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c779164b-db2a-4cfb-9272-0cccced02ab0 -LifetimeId:93215f76-878b-4d37-bfeb-d990fffcf8b4 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1552
- C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  "C:\Users\Admin\AppData\Roaming\WUDFHost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\xvs2tpxy.l4l.exe
    "C:\Users\Admin\AppData\Local\Temp\xvs2tpxy.l4l.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3356
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2836
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:6044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1140
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4292
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Drops desktop.ini file(s)
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Auto Clicker v1.exe
      "C:\Users\Admin\AppData\Local\Temp\Auto Clicker v1.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\d7c9a467-7c03-4ed4-b5db-de38b0559219.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d7c9a467-7c03-4ed4-b5db-de38b0559219.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe"
        7⤵
        Executes dropped EXE
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ThermalServiceAgent.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ThermalServiceAgent.exe" --r
        8⤵
        Executes dropped EXE
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:6100
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ThermalServiceAgent.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ThermalServiceAgent.exe" --wd 6100
        9⤵
        Executes dropped EXE
        Checks system information in the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5496
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && hòÊ³¥·t
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2308
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "ThermalServiceAgent" /tr "\"C:\Users\Admin\AppData\Roaming\ThermalServiceAgent.exe\"" /ru ""
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2624
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /tn "ThermalServiceAgent" /tr "\"C:\Users\Admin\AppData\Roaming\ThermalServiceAgent.exe\"" /ru ""
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3852
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ThermalServiceAgent.exe"
        9⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2468
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\ThermalServiceAgent.exe"
        10⤵
        Views/modifies file attributes
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        Executes a command shell one-liner
        
        PID:1644
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2432
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2528
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000250;0000000000000248;
  2⤵
  PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2904

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3192

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3800

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4708

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5160

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2888

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:4832

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:3244

C:\Users\Admin\AppData\Roaming\WUDFHost.exe
C:\Users\Admin\AppData\Roaming\WUDFHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Users\Admin\AppData\Roaming\ThermalServiceAgent.exe
"C:\Users\Admin\AppData\Roaming\ThermalServiceAgent.exe"
1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:4180

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4252

C:\Users\Admin\AppData\Roaming\explorer.exe
C:\Users\Admin\AppData\Roaming\explorer.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:900

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2824

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Auto Clicker top Verison.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\Auto Clicker top Verison.exe
Size 31.3MB
SHA256 5bfb220977d005db83d251b72121086c9a267b2fdf38415eafd20b063cbed736
MD5 a6a618a9e3e1df9a6e631cf6b095d51b
SHA1 86bced9a73f69d23a806421123c1dec9f6b48451
SHA512 b68737db311c40912c69410e123b5ae8e342e8349e812a5ab16d71fe3d6cf6d7802e8bbe8e1c8b17de2096e4ff97002cc2ccca3c8396fec0699eff130f497b3d
SSDEEP 786432:93GwSEGCoW830A1QtIJ2j6+s7LWB75zuXVgiCuAHsMrwHNeNFRmqhx:AwSEWWrMiIJ2qHWB75il4ZH5Fs
TLSH
T17B77338A37A604B5F4ED853FD5E582A762E2387A0370C19F9BF00A531A5F1D6DF38612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bypassed.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\Bypassed.exe
Size 3.0MB
SHA256 d1a8f947732fa87ece61bd3b380246229a5f065561d3814cfa8cba5673c14ba3
MD5 5fd4ff65b965ac6dead02257b107ebbb
SHA1 65f57fdc25f8821b794f6f8c24aee3ff2182a16a
SHA512 45aa94954b1ea3c007da9b7177f750b21dca901690a5607b8de742b3333454a9da047408ac6bd9b24fbfcb0ce6dea46ed6b47d69cb24b7da2ff84b841bdb8c35
SSDEEP 49152:e45n60CMVDMcPnVk2uAJ9WswnqNgwOirQTJyMg2x:
TLSH
T1B6E5962439FF501DB3B3AEAA5FD4B9AF9D5EF633270B20B9106103468722D819D91739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injection.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\injection.exe
Size 474KB
SHA256 27a5c4f69c991b2e6988537a27d16b1b75069021cbb2f705a5716560a57017a6
MD5 30d6a0127cc7dd90fa225e08d546d03c
SHA1 d3fcff577b391b502387d58fa2aaaae44a4ab317
SHA512 dced7edef3cb73ec3a51041dc334d00a97eee68b0b739ad5804a0efd8c9e3ff122f2b30258e30d3948084ec19ca30f77b05937b130ec0229e84c010d12694364
SSDEEP 12288:keCGDdog0ttPLmXGn3s78CSTGZPtAsA1cif:PUBUTAqi
TLSH
T12AA4A0013B988697F5AD33B9A0A30311D778E9595A51E78FB8DC47EA2F9334119033AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msnrt.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\msnrt.exe
Size 648KB
SHA256 78a1a59e103a0bdccec0fe1873c9fe13e9473aa8e388b54b33d4386e4e7a6de0
MD5 e7a4d3aee51a5571972514333474dce6
SHA1 a2422860e1336671a658716bfecc20ed17ef07d5
SHA512 387ce0bc1e263f0a18e62b0726c32df59107037582ae4c5633f9b2d838909d40a02543fdc1c6ef54745a75dd8a9cd175d880788b2627ed06a2d2500d37a945d5
SSDEEP 6144:a3zWXIs81huxaQKC6kZmwcOcq/ypHj4igrpfuZgisDPXsJOUS5qA:mqYs82xl6kmp34duCDTX73
TLSH
T1CCE4294AF653A1BCD52BC1718BAF6633B932B81C4135797F5A14C77A3EA1E500638F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\PIL\_imaging.cp311-win_amd64.pyd
Size 2.5MB
SHA256 e04dfdb2bdba09efc4bee07924e7be18b0b324a890eae81a12509d54370d4621
MD5 55a6f4a6dfdfd6d0337620983d62410d
SHA1 2cbc68c504314a0a349d6f7edd2a7d32d10478bd
SHA512 31da1855758b95e37e87de94ee98b1b3ddb8c0008fc48d5e029b6361563858aec5dd79740934c10ee9da60cec48e950db3c04fe5f0487ffdfcb3caa87611d74e
SSDEEP 49152:mGKTDSsuV3o7qRYR54isPrqYLrBfFavHIyRKsFbMp:BxnqOFavP1y
TLSH
T162C56C06E9E19599C6B28034CDA6C216E3B1B80D17F187F77684A7F53E23BD0353A396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_asyncio.pyd
Size 63KB
SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
MD5 07a6e6dcc30e1c4c7e0cdc41a457a887
SHA1 53bc820b63d88cbe889944e242b50662b4b2cb42
SHA512 837f1e40db9bdf1bc73b2a700df6086a3acdb7d52afc903239410b2d226ffd1dd5e8b5f317401bcf58dd042bd56787af6cdc49af96fcb588bcf0127d536b6c6d
SSDEEP 1536:/0f8MOytWQazE6XWpkJONIYOnsO7SyLzx1z:cf8X2sE6XWpkJONIYOndx
TLSH
T174538D83E2808595D957A074D8B30F56E771F6500B0403DE62A8D29E2F733229BFFB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_decimal.pyd
Size 249KB
SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
MD5 c88282908ba54510eda3887c488198eb
SHA1 94ed1b44f99642b689f5f3824d2e490252936899
SHA512 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd
SSDEEP 6144:E7W/Dmi0FD5KaN7VqqO9a3juVQt07Ou9qWM53pLW1AT3Otjm1+Br:L/Ki0FdVI9a3juKeqcO+Br
TLSH
T11C446C57A2490CA4DE738474D89B9B47FBB278854320C3CF03A48AA76F577A323B9744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_elementtree.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_elementtree.pyd
Size 125KB
SHA256 02e30b6a2bee5be5336e40a9c89575603051bde86f9c9cdc78b7fa7d9b7bd1f0
MD5 e31fd445c65aec18c32a99828732264a
SHA1 1e7e9505954b8143faeee6ce0b459712f73018b1
SHA512 20802cae1b75f28a83e76b529caf16c8d00bc050e66f6d8665c4238c4579e391c78f121dccb369f64511fdf892619720f8c626a39a28c9aa44f2bff7472cf0f9
SSDEEP 3072:DJeqwp57DnMInmugVdkub0cTGugGdWp/g1Ap3ZrBvdL5bFIY6fvmU:mnMInmuoNb0ci0opQAp9BvHbk
TLSH
T146C34A6B6295C0AFE462407C95674F06D7B2FCA50E4083CF6284F6AD9F333923EA9355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_hashlib.pyd
Size 63KB
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
TLSH
T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_multiprocessing.pyd
Size 33KB
SHA256 975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9
MD5 cf0b31f01a95e9f181d87197786b96ca
SHA1 6214361452f7eaef5c710719a5cfb6109906975c
SHA512 d56b096780bb263e3f7282f163da02353ed5d8767f964937deaff997156e95749312180f25582d5963d3c351260b8ff196221652e7bf088a8c6a4e766118abd3
SSDEEP 768:z4MsRxarHWQXqTdywb7y9IYWt85YiSyv/AMxkEhERx:YzFQ6Tdywb7y9IYWtG7SyHxGRx
TLSH
T118F28D43AA54285AD837C97294A39E29D932F757075087DF2314C29E0F323837FEA75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_overlapped.pyd
Size 50KB
SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
MD5 78e8049e26df6fd3a4011562ff8e74a0
SHA1 d5a91c720e4672c40e1dd6d54b3197b4a1f8b633
SHA512 ea7a54d38cefed870cee65dd9460b6c51131ae5219933ddc998a86d12bb093784242cb5471c77bc324ccf59fa42c2914865dcf582f74c440fa52b7d15d9faeac
SSDEEP 768:OiqKtLpqCvqlB1QIb1D1N+gpOUpEkCZ9hIYXth5YiSyveAMxkEs:+KzqC/A1hNekCZ9hIYXtP7SyExA
TLSH
T193337B02670404DADD67C2BDD8735F16EA71B4D2470183AF52A8CA4A0F737C16BEEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_queue.pyd
Size 31KB
SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
MD5 7f52ef40b083f34fd5e723e97b13382f
SHA1 626d47df812738f28bc87c7667344b92847fdf6a
SHA512 48f7723a8c039abd6ccb2906fbd310f0cfa170dcbdf89a6437dd02c8f77f20e6c7c402d29b922cdaabd357d3a33e34c3ad826127134f38d77a4d6d9c83371949
SSDEEP 768:R7Vej6rsdmxUnJIYQUA5YiSyvyAMxkEbF:R7LsdWUnJIYQUS7SyIx3F
TLSH
T1D1E29F83AA586C46C437C47594E25E39E876FA42570183EF2219C25D1F333427BBA765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_socket.pyd
Size 77KB
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
TLSH
T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_ssl.pyd
Size 174KB
SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
MD5 0f02eccd7933b7a7c2bdedca2a72aab6
SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
TLSH
T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_tcl_data\auto.tcl
Size 21KB
SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
MD5 08edf746b4a088cb4185c165177bd604
SHA1 395cda114f23e513eef4618da39bb86d034124bf
SHA512 c1727e265a6b0b54773c886a1bce73512e799ba81a4fceeeb84cdc33f5505a5e0984e96326a78c46bf142bc4652a80e213886f60eb54adf92e4dffe953c87f6b
SSDEEP 384:UqT9XC9VZv9QXCTxsCTHI7672ORgS0mzBvxFRTX7Xvt3wBTnFXhCUvuyqz:LT9XC9VZviXCVsCLI7JlmzBvTxvt3gTW
TLSH
T199A2C7635F9542A630B1C22B553DB9A4EF2F81B70675801D38FC912C37F1815C6BEAEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_tcl_data\encoding\cp1252.enc
Size 1KB
SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
MD5 e9117326c06fee02c478027cb625c7d8
SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
TLSH
T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
MD5 SHA1 SHA512 TLSH

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_tcl_data\init.tcl
Size 25KB
SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
MD5 982eae7a49263817d83f744ffcd00c0e
SHA1 81723dfea5576a0916abeff639debe04ce1d2c83
SHA512 31370d8390c4608e7a727eed9ee7f4c568ecb913ae50184b6f105da9c030f3b9f4b5f17968d8975b2f60df1b0c5e278512e74267c935fe4ec28f689ac6a97129
SSDEEP 768:rXugPHudKlExBG+Xg3Qonlm6ofRRECLSQDjr5vkhzx/i:ygGdKli4eonlm6offLzehNi
TLSH
T1C3B2A7112384917932B343368AB9B598ED7EC1F715AD41BCB8CC825C777150A4AFDBD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_tcl_data\tclIndex
Size 5KB
SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
MD5 c62fb22f4c9a3eff286c18421397aaf4
SHA1 4a49b8768cff68f2effaf21264343b7c632a51b2
SHA512 558d401cb6af8ce3641af55caebc9c5005ab843ee84f60c6d55afbbc7f7129da9c58c2f55c887c3159107546fa6bc13ffc4cca63ea8841d7160b8aa99161a185
SSDEEP 96:eOaVhNUMUuUQU2UsUIUbUEUEeUkgU6UWSO0DT5RTdcvsilrvs+jscMK57ehXowrz:ejVHRRLP3LWDXewTbSO0DT5RTdcvsilg
TLSH
T14FC1301AA756C72803F481074999FE283ADED1E4D33DC93E99A491CD10B30076FEE9E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_tk_data\tk.tcl
Size 23KB
SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
MD5 338184e46bd23e508daedbb11a4f0950
SHA1 437db31d487c352472212e8791c8252a1412cb0e
SHA512 8fb8a353eecd0d19638943f0a9068dccebf3fb66d495ea845a99a89229d61a77c85b530f597fd214411202055c1faa9229b6571c591c9f4630490e1eb30b9cd3
SSDEEP 384:Nuyxt+WaB9USY15gSgC3DbTbXLXKr3cIXyDAbK2LMGgtewT+3oFQRyH5bAy59Hmc:NuItNe9USZblXysm7GgteoFQRYMSySL
TLSH
T1DEB2D7195DC062B3513BC13F53BB2A00E87558FB2776644978DC48B92F6883B06FE9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\_tkinter.pyd
Size 62KB
SHA256 6f7bdc2f60a1795b58ec7015ec262d6b234aa8d0f022185de0f52bac4adab449
MD5 730c89fc98ade903787589a935aeb36d
SHA1 e9c7337ad9251f0b12d136c725ad1049bd261f42
SHA512 d3fffc5a7f435f7e0bf40c3b7259a25c2ecb838d752a1bb76ab88fc2ec039b8469e494a023d8f53363b23cbbf4967531cb92f493276f7a91fd8a18102f7505e4
SSDEEP 1536:4hSQpzjZEK1hP81CvguSiDaHNIYOSP7Sy+6xnz/:1QpzVEK1JpvguS0aHNIYOSPZ
TLSH
T1F3538D6BA764009ACE6BC17DC5B35B23E675B5510B10834F0294C35A1F337A3ABFAB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\base_library.zip
Size 1.4MB
SHA256 b17d13b8e49ef891343dff3117cd8290285fec9e1fcde794b141750c2d775409
MD5 79596b837657bc37d7c1129c3150545b
SHA1 15c54a024545a15dc8f6fd5d9044fcffeb8ddcf4
SHA512 c10459ddb4e443b2674ae663010ca807d358b7c3d188d0ca0fd249db690fc74b70ed63abff1c097022ec1e4eca1bf0e943e89390839ed73653e77ef55d6f49ae
SSDEEP 24576:AZv/Rb37TMHHoafPWdmzF3cnz/bucEvUFivQR5pXwjwhx:Al/RbqQR5pSI
TLSH
T1716509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blue.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\customtkinter\assets\themes\blue.json
Size 4KB
SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
MD5 05eb3947ce9a8c3bef66c14d0f938671
SHA1 06ffc811ee51609809d88894022e222b339aefee
SHA512 4db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13
SSDEEP 96:KupscLUBH2cEyzmGvtu/XaNgdacgWu/Bwg+Y51hlk2cEdVJFvLpwZdIunacEkGgC:KupNUtMiPQ/XXIRp/v+Y51hT/vlggf+4
TLSH
T167912814C5280EA723FB9B2A1607EA043C9C95D36FA8FE54385881DD0F4F43EC6B5BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\pyexpat.pyd
Size 194KB
SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
MD5 79561bc9f70383f8ae073802a321adfb
SHA1 5f378f47888e5092598c20c56827419d9f480fa7
SHA512 476c839f544b730c5b133e2ae08112144cac07b6dfb8332535058f5cbf54ce7ed4a72efb38e6d56007ae755694b05e81e247d0a10210c993376484a057f2217c
SSDEEP 6144:VK/lLDYZL1p13eiG7eDT9AmNfLVuOgOgOgOgOgOgNltwZSm:VglkZHLVuOgOgOgOgOgOgN0sm
TLSH
T131146C5BB1A2C0EBD8838038D6D34A0BDBB1B865039197CF52C4EB7D5F277523A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\python3.DLL
Size 65KB
SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
MD5 7e07c63636a01df77cd31cfca9a5c745
SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729
SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS0:v/5k8cnzeJWJIYL0D7Sy7x9
TLSH
T134636E529B58F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\tcl86t.dll
Size 1.8MB
SHA256 4e699ff2d6d147d0586c8c77be5a18f20ca0758f432d7b0f489223f2fa4dd221
MD5 50be441afc42714cb7fe98677f304807
SHA1 0604a2992f698e45d1524c44a924b7451d8ad003
SHA512 a99c7b5c9d42c53cf51ace16871bb2f1dfc9424077b0a758ec1b8583eb1be3cdd413d005188fa82dd61093b56882cd72b32f15b55599c5f0fcbce34321afb639
SSDEEP 24576:cNJSAyrJZwdI3xpXxBX4Crw9yilqy+uVUD5Wbsr+Qt682zhPlkPkGqTvI92jHBHd:cNgjid2LD5W4ac6xdLvIkhHP4ATdeDI
TLSH
T1C385AF1BEB6411E8D4ABD1BCC227EA0BDBF1B4191350A6DB51A08F512F23FE1277A345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\tk86t.dll
Size 1.5MB
SHA256 b6af038120f2b8644c7ce1e11917f410009848287622135d7e386f90d28a831c
MD5 50be514d4234103d49fb2a600a272fce
SHA1 e441b77a421598998d24814afd4af8090d306e57
SHA512 d93467b688f68f15eb46dc1aef4bd4f4d0b91193a2c40a1d4b5cc6e906a443343e261225df530527491a01c58803b91a138d5147d7a02aedeb9cddd3adc77fef
SSDEEP 24576:f1Bvnu8AyQD9FLi543GLUKuPO6EinYTVAiueFoC+vMvE58aVJkwd98ydeyRP/oA/:fIyQD9FU43GLUKuPO6EinYTVAFSvESa9
TLSH
T1EB655B06A261C198C26EE134C91796BAEBF17C04931457DB76A0BE6D3F33BD2277A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI21402\unicodedata.pyd
Size 1.1MB
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
SSDEEP 12288:bdYbfjwR6nbYonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD85U:RYbM10IDJcjEwPgPOG6Xyd4685U
TLSH
T195355BC9BB828D66D87B31B944D2212F1361C273476B133BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7c9a467-7c03-4ed4-b5db-de38b0559219.exe

Path C:\Users\Admin\AppData\Local\Temp\d7c9a467-7c03-4ed4-b5db-de38b0559219.exe
Size 1.1MB
SHA256 c836f1e0b97cc0dc3d8942ba1858590df48f227d75ab955ddea3b2921abe4b2f
MD5 3f1a6a648115ad71bd6e5adfb7d746a2
SHA1 2f1a9d7cf05e4646c2dc6381a09e5086e1bf6215
SHA512 453d8e4a00ddb903b06932321c64fe4ae791188598b8edf8fdc38d6235c75732d9472c8f85eae01372433225ef01db4ddbc46c3bc5f831437ddd58d455256eee
SSDEEP 12288:seCGDdog0ttPLmXGn3s78CSTGZPtAsA1cif/qYs82xl6kmp34duCDTX73L:XUBUTAqiHqYdpkmFCvLL
TLSH
T1FF458D46F75391BDD52BC1758AAB1633F632B80C4135BB7F5A5487BA3F92B000628B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvs2tpxy.l4l.exe

Path C:\Users\Admin\AppData\Local\Temp\xvs2tpxy.l4l.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-1168-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/416-1167-0x000001A8B6E40000-0x000001A8B6E6B000-memory.dmp

Download

memory/740-1150-0x0000012DDE4C0000-0x0000012DDE4E5000-memory.dmp

Download

memory/740-1151-0x0000012DDE4F0000-0x0000012DDE51B000-memory.dmp

Download

memory/740-1152-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/952-1159-0x000001CDBDFD0000-0x000001CDBDFFB000-memory.dmp

Download

memory/952-1160-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/956-1155-0x0000028C8C7C0000-0x0000028C8C7EB000-memory.dmp

Download

memory/956-1156-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/984-1164-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/984-1163-0x000001C39E860000-0x000001C39E88B000-memory.dmp

Download

memory/1116-1172-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1116-1171-0x00000233CA0D0000-0x00000233CA0FB000-memory.dmp

Download

memory/1140-1232-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1140-1231-0x0000014B671C0000-0x0000014B671EB000-memory.dmp

Download

memory/1148-1176-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1148-1175-0x0000012B63FC0000-0x0000012B63FEB000-memory.dmp

Download

memory/1212-1179-0x0000017CE6CC0000-0x0000017CE6CEB000-memory.dmp

Download

memory/1212-1180-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1264-1183-0x00000214A8040000-0x00000214A806B000-memory.dmp

Download

memory/1264-1184-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1312-1188-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1312-1187-0x0000018D58D70000-0x0000018D58D9B000-memory.dmp

Download

memory/1352-1192-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1352-1191-0x000001ABEDF50000-0x000001ABEDF7B000-memory.dmp

Download

memory/1412-1195-0x0000020486F40000-0x0000020486F6B000-memory.dmp

Download

memory/1412-1196-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1424-153-0x00007FF784750000-0x00007FF78475E000-memory.dmp

Download

memory/1452-1200-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1452-1199-0x00000293D8C50000-0x00000293D8C7B000-memory.dmp

Download

memory/1552-1203-0x0000025A89ED0000-0x0000025A89EFB000-memory.dmp

Download

memory/1552-1204-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1684-1207-0x000001A112A20000-0x000001A112A4B000-memory.dmp

Download

memory/1684-1208-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1712-1212-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1712-1211-0x00000221C9850000-0x00000221C987B000-memory.dmp

Download

memory/1748-1215-0x0000016C34BE0000-0x0000016C34C0B000-memory.dmp

Download

memory/1748-1216-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1892-1219-0x0000016A09FB0000-0x0000016A09FDB000-memory.dmp

Download

memory/1892-1220-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1904-1223-0x00000266FFD00000-0x00000266FFD2B000-memory.dmp

Download

memory/1904-1224-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1928-1228-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/1928-1227-0x00000155BA8C0000-0x00000155BA8EB000-memory.dmp

Download

memory/2064-1236-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/2064-1235-0x0000023EC0FC0000-0x0000023EC0FEB000-memory.dmp

Download

memory/2076-1144-0x000000001B650000-0x000000001B66C000-memory.dmp

Download

memory/2076-1137-0x0000000002850000-0x000000000287C000-memory.dmp

Download

memory/2076-1136-0x0000000002800000-0x000000000284C000-memory.dmp

Download

memory/2148-1240-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/2148-1239-0x0000023354D30000-0x0000023354D5B000-memory.dmp

Download

memory/2228-1244-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/2228-1243-0x00000240C1EA0000-0x00000240C1ECB000-memory.dmp

Download

memory/2332-1248-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/2332-1247-0x000002746C750000-0x000002746C77B000-memory.dmp

Download

memory/2372-1251-0x0000020418900000-0x000002041892B000-memory.dmp

Download

memory/2372-1252-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/2460-1145-0x0000000003230000-0x0000000003244000-memory.dmp

Download

memory/2460-1147-0x00000000034F0000-0x00000000034F1000-memory.dmp

Download

memory/2460-1146-0x00000000034D0000-0x00000000034E2000-memory.dmp

Download

memory/2528-1256-0x00007FFDFBDE0000-0x00007FFDFBDF0000-memory.dmp

Download

memory/2528-1255-0x000001C1AEC30000-0x000001C1AEC5B000-memory.dmp

Download

memory/2604-1259-0x0000021F8ED50000-0x0000021F8ED7B000-memory.dmp

Download

memory/3356-1149-0x00007FFE3A0F0000-0x00007FFE3A1B7000-memory.dmp

Download

memory/3356-1148-0x00007FFE3BCA0000-0x00007FFE3BF03000-memory.dmp

Download

memory/3752-281-0x0000000000640000-0x00000000006BC000-memory.dmp

Download

memory/4064-18-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/4064-30-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/4064-17-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/4064-16-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/4064-14-0x00007FFE1914F000-0x00007FFE19150000-memory.dmp

Download

memory/4064-13-0x0000000000DA0000-0x00000000010A4000-memory.dmp

Download

memory/4180-1135-0x00007FF685D00000-0x00007FF685DBF000-memory.dmp

Download

memory/4276-867-0x00007FF6A4050000-0x00007FF6A410F000-memory.dmp

Download

memory/4676-749-0x00007FF684890000-0x00007FF68489D000-memory.dmp

Download