neptunerat | 204c079c3a48db2ff3a2c6726e1d7ab002de2124209c0114361ef0ce13e017d0

Analysis

user interaction
yes
max time kernel
120s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Valorant1.exe
Size 3.0MB
Sample260730-gseq2svtds
SHA256 204c079c3a48db2ff3a2c6726e1d7ab002de2124209c0114361ef0ce13e017d0
MD5 042a9c6a9a035cbf7377869fec3e219f
SHA1 b35d5da0654691b5c59f0010c8946280e5a5b7f0
SHA512 922c64e7125a9c2d5e8cf30c66e221cd9f353361da9a09919c62db2afb17c4307dd60f4c79c08a11f82ec04b23d74808ad6278557ac2f351c7861b14c14f6654
SSDEEP 49152:hINVbshSP80DassxpY/RpsgXZDjIhB5wHrr:hINV4AJDadY5psgXn
TLSH
T13BE59D2ABD9105D2E286EBBCC99719069AF0B9375391CA0F06030CF7F4272D67465DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution neptunerat persistence trojan

Malware Config

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/4344-313-0x000001FCBC8E0000-0x000001FCBC8F4000-memory.dmp	family_neptunerat

Executes dropped EXE 5 IoCs

pid	Process
5088	arvxznny.nzd.exe
1712	Valorant1.exe
4612	2oqijzds.obb.exe
6104	Valorant1.exe
5876	fehrjkcg.dkt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Valorant1 = "C:\\Users\\Admin\\AppData\\Roaming\\Valorant1.exe"	Valorant1.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
9	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Valorant1	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={057FD109-768C-4771-9426-9204C3D31808}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 29 Jul 2026 11:24:28 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1785391458"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5928	SCHTASKS.exe
5648	SCHTASKS.exe
5384	SCHTASKS.exe
4084	SCHTASKS.exe
5740	SCHTASKS.exe
3520	SCHTASKS.exe
2060	schtasks.exe
352	SCHTASKS.exe
3220	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe
5088	arvxznny.nzd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5724	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	Valorant1.exe
Token: SeDebugPrivilege	5088	arvxznny.nzd.exe
Token: SeShutdownPrivilege	5724	explorer.exe
Token: SeCreatePagefilePrivilege	5724	explorer.exe
Token: SeShutdownPrivilege	5724	explorer.exe
Token: SeCreatePagefilePrivilege	5724	explorer.exe
Token: SeShutdownPrivilege	5724	explorer.exe
Token: SeCreatePagefilePrivilege	5724	explorer.exe
Token: SeShutdownPrivilege	5724	explorer.exe
Token: SeCreatePagefilePrivilege	5724	explorer.exe
Token: SeDebugPrivilege	4344	Valorant1.exe
Token: SeAssignPrimaryTokenPrivilege	3688	svchost.exe
Token: SeIncreaseQuotaPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeTakeOwnershipPrivilege	3688	svchost.exe
Token: SeLoadDriverPrivilege	3688	svchost.exe
Token: SeSystemtimePrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeRestorePrivilege	3688	svchost.exe
Token: SeShutdownPrivilege	3688	svchost.exe
Token: SeSystemEnvironmentPrivilege	3688	svchost.exe
Token: SeUndockPrivilege	3688	svchost.exe
Token: SeManageVolumePrivilege	3688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3688	svchost.exe
Token: SeIncreaseQuotaPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeTakeOwnershipPrivilege	3688	svchost.exe
Token: SeLoadDriverPrivilege	3688	svchost.exe
Token: SeSystemtimePrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeRestorePrivilege	3688	svchost.exe
Token: SeShutdownPrivilege	3688	svchost.exe
Token: SeSystemEnvironmentPrivilege	3688	svchost.exe
Token: SeUndockPrivilege	3688	svchost.exe
Token: SeManageVolumePrivilege	3688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3688	svchost.exe
Token: SeIncreaseQuotaPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeTakeOwnershipPrivilege	3688	svchost.exe
Token: SeLoadDriverPrivilege	3688	svchost.exe
Token: SeSystemtimePrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeRestorePrivilege	3688	svchost.exe
Token: SeShutdownPrivilege	3688	svchost.exe
Token: SeSystemEnvironmentPrivilege	3688	svchost.exe
Token: SeUndockPrivilege	3688	svchost.exe
Token: SeManageVolumePrivilege	3688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3688	svchost.exe
Token: SeIncreaseQuotaPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeTakeOwnershipPrivilege	3688	svchost.exe
Token: SeLoadDriverPrivilege	3688	svchost.exe
Token: SeSystemtimePrivilege	3688	svchost.exe
Token: SeBackupPrivilege	3688	svchost.exe
Token: SeRestorePrivilege	3688	svchost.exe
Token: SeShutdownPrivilege	3688	svchost.exe
Token: SeSystemEnvironmentPrivilege	3688	svchost.exe
Token: SeUndockPrivilege	3688	svchost.exe
Token: SeManageVolumePrivilege	3688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3688	svchost.exe
Token: SeIncreaseQuotaPrivilege	3688	svchost.exe
Token: SeSecurityPrivilege	3688	svchost.exe
Token: SeTakeOwnershipPrivilege	3688	svchost.exe
Token: SeLoadDriverPrivilege	3688	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2608	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 5088	4344	Valorant1.exe	89
PID 4344 wrote to memory of 5928	4344	Valorant1.exe	90
PID 5088 wrote to memory of 748	5088	arvxznny.nzd.exe	5
PID 5088 wrote to memory of 972	5088	arvxznny.nzd.exe	9
PID 5088 wrote to memory of 980	5088	arvxznny.nzd.exe	10
PID 5088 wrote to memory of 1008	5088	arvxznny.nzd.exe	11
PID 5088 wrote to memory of 1036	5088	arvxznny.nzd.exe	13
PID 5088 wrote to memory of 1136	5088	arvxznny.nzd.exe	14
PID 5088 wrote to memory of 1168	5088	arvxznny.nzd.exe	15
PID 5088 wrote to memory of 1240	5088	arvxznny.nzd.exe	16
PID 5088 wrote to memory of 1268	5088	arvxznny.nzd.exe	17
PID 5088 wrote to memory of 1320	5088	arvxznny.nzd.exe	18
PID 5088 wrote to memory of 1364	5088	arvxznny.nzd.exe	19
PID 5088 wrote to memory of 1508	5088	arvxznny.nzd.exe	22
PID 5088 wrote to memory of 1516	5088	arvxznny.nzd.exe	23
PID 5088 wrote to memory of 1640	5088	arvxznny.nzd.exe	24
PID 5088 wrote to memory of 1652	5088	arvxznny.nzd.exe	25
PID 5088 wrote to memory of 1804	5088	arvxznny.nzd.exe	26
PID 5088 wrote to memory of 1836	5088	arvxznny.nzd.exe	27
PID 5088 wrote to memory of 1920	5088	arvxznny.nzd.exe	28
PID 5088 wrote to memory of 1160	5088	arvxznny.nzd.exe	29
PID 5088 wrote to memory of 1332	5088	arvxznny.nzd.exe	30
PID 5088 wrote to memory of 1480	5088	arvxznny.nzd.exe	31
PID 5088 wrote to memory of 2124	5088	arvxznny.nzd.exe	32
PID 5088 wrote to memory of 2200	5088	arvxznny.nzd.exe	33
PID 5088 wrote to memory of 2236	5088	arvxznny.nzd.exe	34
PID 5088 wrote to memory of 2316	5088	arvxznny.nzd.exe	35
PID 5088 wrote to memory of 2412	5088	arvxznny.nzd.exe	36
PID 5088 wrote to memory of 2424	5088	arvxznny.nzd.exe	37
PID 5088 wrote to memory of 2564	5088	arvxznny.nzd.exe	38
PID 5088 wrote to memory of 2576	5088	arvxznny.nzd.exe	39
PID 5088 wrote to memory of 2660	5088	arvxznny.nzd.exe	40
PID 5088 wrote to memory of 2684	5088	arvxznny.nzd.exe	41
PID 5088 wrote to memory of 2952	5088	arvxznny.nzd.exe	42
PID 5088 wrote to memory of 3000	5088	arvxznny.nzd.exe	43
PID 5088 wrote to memory of 3032	5088	arvxznny.nzd.exe	44
PID 5088 wrote to memory of 3088	5088	arvxznny.nzd.exe	45
PID 5088 wrote to memory of 3152	5088	arvxznny.nzd.exe	47
PID 5088 wrote to memory of 3300	5088	arvxznny.nzd.exe	49
PID 5088 wrote to memory of 3452	5088	arvxznny.nzd.exe	50
PID 5088 wrote to memory of 3628	5088	arvxznny.nzd.exe	51
PID 5088 wrote to memory of 3644	5088	arvxznny.nzd.exe	52
PID 5088 wrote to memory of 3680	5088	arvxznny.nzd.exe	53
PID 5088 wrote to memory of 3688	5088	arvxznny.nzd.exe	54
PID 5088 wrote to memory of 3708	5088	arvxznny.nzd.exe	55
PID 5088 wrote to memory of 3736	5088	arvxznny.nzd.exe	56
PID 5088 wrote to memory of 3336	5088	arvxznny.nzd.exe	57
PID 5088 wrote to memory of 3624	5088	arvxznny.nzd.exe	58
PID 5088 wrote to memory of 4352	5088	arvxznny.nzd.exe	59
PID 5088 wrote to memory of 4412	5088	arvxznny.nzd.exe	60
PID 5088 wrote to memory of 4424	5088	arvxznny.nzd.exe	61
PID 5088 wrote to memory of 4660	5088	arvxznny.nzd.exe	62
PID 5088 wrote to memory of 4676	5088	arvxznny.nzd.exe	63
PID 5088 wrote to memory of 3716	5088	arvxznny.nzd.exe	64
PID 5088 wrote to memory of 2272	5088	arvxznny.nzd.exe	65
PID 5088 wrote to memory of 5140	5088	arvxznny.nzd.exe	66
PID 5088 wrote to memory of 5184	5088	arvxznny.nzd.exe	67
PID 5088 wrote to memory of 5496	5088	arvxznny.nzd.exe	70
PID 5088 wrote to memory of 5580	5088	arvxznny.nzd.exe	72
PID 5088 wrote to memory of 2724	5088	arvxznny.nzd.exe	74
PID 5088 wrote to memory of 5780	5088	arvxznny.nzd.exe	75
PID 5088 wrote to memory of 2052	5088	arvxznny.nzd.exe	78
PID 5088 wrote to memory of 3148	5088	arvxznny.nzd.exe	79
PID 5088 wrote to memory of 5172	5088	arvxznny.nzd.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:748
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:980
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1168

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:972

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8a7dd176-f077-442b-8ec4-df17a6463a35 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7a42b055-688f-4d33-8613-26b20bf1178d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e3a7d350-5594-4314-8646-c7ec45fda4c8 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-da71b97d-9680-4182-85f3-45dbe8365497 -LifetimeId:15fda0b6-5416-4ed6-b15e-3431cb0ef813 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1640
- C:\Users\Admin\AppData\Roaming\Valorant1.exe
  "C:\Users\Admin\AppData\Roaming\Valorant1.exe"
  2⤵
  - Executes dropped EXE
  PID:6104
- - C:\Users\Admin\AppData\Local\Temp\fehrjkcg.dkt.exe
    "C:\Users\Admin\AppData\Local\Temp\fehrjkcg.dkt.exe"
    3⤵
    - Executes dropped EXE
    PID:5876
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Roaming\Valorant1.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:352
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:704
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Roaming\Valorant1.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3220
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6108
- C:\Users\Admin\AppData\Roaming\Valorant1.exe
  "C:\Users\Admin\AppData\Roaming\Valorant1.exe"
  2⤵
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\dgkcf5c0.x41.exe
    "C:\Users\Admin\AppData\Local\Temp\dgkcf5c0.x41.exe"
    3⤵
    PID:3496
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Roaming\Valorant1.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5740
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Roaming\Valorant1.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1160
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5172
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Valorant1.exe
      "C:\Users\Admin\AppData\Local\Temp\Valorant1.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\arvxznny.nzd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\arvxznny.nzd.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5088
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Valorant1.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5928
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Valorant1.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5648
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3436
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Valorant1" /tr "C:\Users\Admin\AppData\Roaming\Valorant1.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2060
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2412
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3088

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3300

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3624

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4424

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4676

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2272

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5140

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2052

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:4400

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Enumerates system info in registry
PID:4944

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:108

C:\Users\Admin\AppData\Roaming\Valorant1.exe
C:\Users\Admin\AppData\Roaming\Valorant1.exe
1⤵
- Executes dropped EXE
PID:1712
- C:\Users\Admin\AppData\Local\Temp\2oqijzds.obb.exe
  "C:\Users\Admin\AppData\Local\Temp\2oqijzds.obb.exe"
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Roaming\Valorant1.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3220
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "MasonValorant1.exe" /tr "'C:\Users\Admin\AppData\Roaming\Valorant1.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4084
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arvxznny.nzd.exe

Path C:\Users\Admin\AppData\Local\Temp\arvxznny.nzd.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Valorant1.exe

Path C:\Users\Admin\AppData\Roaming\Valorant1.exe
Size 3.0MB
SHA256 204c079c3a48db2ff3a2c6726e1d7ab002de2124209c0114361ef0ce13e017d0
MD5 042a9c6a9a035cbf7377869fec3e219f
SHA1 b35d5da0654691b5c59f0010c8946280e5a5b7f0
SHA512 922c64e7125a9c2d5e8cf30c66e221cd9f353361da9a09919c62db2afb17c4307dd60f4c79c08a11f82ec04b23d74808ad6278557ac2f351c7861b14c14f6654
SSDEEP 49152:hINVbshSP80DassxpY/RpsgXZDjIhB5wHrr:hINV4AJDadY5psgXn
TLSH
T13BE59D2ABD9105D2E286EBBCC99719069AF0B9375391CA0F06030CF7F4272D67465DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 63KB
SHA256 3d3040ab5857d82d3457985d3e21cd924a771ae33fe8a4deedd7e5e93b9d37ad
MD5 61c6b93d520498e975c32fa1d2ed5daa
SHA1 a93fd4d5e9e019a5f7ec61d72e69df406a74d296
SHA512 8066be9073a026fe182a147a8fdff50ca1f76a72a48f900803f6ede393a05268aad96ccbd31c047f103145fa5a2bae1d85d21c06b458bdb8a8effe24915c6b40
SSDEEP 1536:Nu7Et/xoToXuvBKoZaL6TNX9FgwcwHC8SCs8o8WcMv1K0Rw7gN4Tkl1bvzwLM65r:L1Lk
TLSH
T152534D0580DC8519C5B60BA272A7EE72C92E59CA770B1EE931ED7301D8C2B552F7A07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 c52b935b5b4f0542d0784f51e2d6150cd5bb9e0b5f8a8078f36ba13e82e7aede
MD5 0cead22ba6cd73297316b4fc8b5f88d1
SHA1 51e739dbfa72c091efa974ef32ec54ac26573424
SHA512 9260dd95ce06a661e1d84ad48fb6816a109a32bb75a21e36f4b04598801f811900f85efccdf1f59566bfa31967f37a34a6fe6d34cf811e99ed43adee60b90839
TLSH
T140E0C2113EA84218E5730B3CA93365499E377367AE01CEDD0734008E4C34FA1C832729
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 ef67575f4289c3368394d83b66c93055023733b807d1448490e97c57251f18aa
MD5 dc7695cc649d157203beec510836349b
SHA1 d09973f560a4f48b242f113719ea3383fd9ec060
SHA512 3049fbae6927d7699cd438d12c5aa7ae490c74e30e00211702db108f9bbe969211e9f9435a01d53685e030bcfb994934986f7ffdc6908fbfc7a6bb3a469c8104
TLSH
T131E0C62422FF602CF0E4E07D8BE56A2187AAF032081AF2B91FE05700A242A00EC02934
MD5 SHA1 SHA512 TLSH

Submit Download

memory/748-16-0x000001C5B1050000-0x000001C5B1075000-memory.dmp

Download

memory/748-20-0x000001C5B1080000-0x000001C5B10AB000-memory.dmp

Download

memory/748-17-0x000001C5B1080000-0x000001C5B10AB000-memory.dmp

Download

memory/748-18-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/972-276-0x000001F4586D0000-0x000001F4586FB000-memory.dmp

Download

memory/972-25-0x000001F4586D0000-0x000001F4586FB000-memory.dmp

Download

memory/972-26-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/980-23-0x000001B8F69A0000-0x000001B8F69CB000-memory.dmp

Download

memory/980-24-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/980-278-0x000001B8F69A0000-0x000001B8F69CB000-memory.dmp

Download

memory/1008-321-0x000002AD6DC50000-0x000002AD6DC7B000-memory.dmp

Download

memory/1008-283-0x000002AD6DC50000-0x000002AD6DC7B000-memory.dmp

Download

memory/1008-104-0x000002AD6DC50000-0x000002AD6DC7B000-memory.dmp

Download

memory/1008-105-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1036-107-0x00000131BE8E0000-0x00000131BE90B000-memory.dmp

Download

memory/1036-108-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1136-111-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1136-110-0x000001CB450D0000-0x000001CB450FB000-memory.dmp

Download

memory/1160-141-0x00000229D9540000-0x00000229D956B000-memory.dmp

Download

memory/1160-142-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1168-34-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1168-279-0x0000024ABE700000-0x0000024ABE72B000-memory.dmp

Download

memory/1168-33-0x0000024ABE700000-0x0000024ABE72B000-memory.dmp

Download

memory/1240-113-0x000002216ED40000-0x000002216ED6B000-memory.dmp

Download

memory/1240-114-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1268-116-0x0000020F14390000-0x0000020F143BB000-memory.dmp

Download

memory/1320-119-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1320-118-0x00000273CC9C0000-0x00000273CC9EB000-memory.dmp

Download

memory/1332-145-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1332-144-0x000002095CFB0000-0x000002095CFDB000-memory.dmp

Download

memory/1364-121-0x00000259BAF90000-0x00000259BAFBB000-memory.dmp

Download

memory/1364-122-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1480-148-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1480-147-0x0000024948700000-0x000002494872B000-memory.dmp

Download

memory/1508-125-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1508-124-0x00000236EC440000-0x00000236EC46B000-memory.dmp

Download

memory/1516-42-0x00000257F7190000-0x00000257F71BB000-memory.dmp

Download

memory/1516-280-0x00000257F7190000-0x00000257F71BB000-memory.dmp

Download

memory/1516-43-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1640-128-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1640-127-0x0000016108880000-0x00000161088AB000-memory.dmp

Download

memory/1652-131-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1652-130-0x00000270046B0000-0x00000270046DB000-memory.dmp

Download

memory/1712-355-0x0000023F91640000-0x0000023F91940000-memory.dmp

Download

memory/1804-133-0x0000018AD9D70000-0x0000018AD9D9B000-memory.dmp

Download

memory/1804-134-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/1836-136-0x000001B624390000-0x000001B6243BB000-memory.dmp

Download

memory/1920-138-0x0000025C34D80000-0x0000025C34DAB000-memory.dmp

Download

memory/1920-139-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2124-151-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2124-150-0x00000184E3F90000-0x00000184E3FBB000-memory.dmp

Download

memory/2200-153-0x00000206BE7F0000-0x00000206BE81B000-memory.dmp

Download

memory/2200-154-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2236-156-0x000001D60FDC0000-0x000001D60FDEB000-memory.dmp

Download

memory/2236-157-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2316-159-0x000002B5A0710000-0x000002B5A073B000-memory.dmp

Download

memory/2316-160-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2412-162-0x00000230D6FD0000-0x00000230D6FFB000-memory.dmp

Download

memory/2412-163-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2424-165-0x000001B99A970000-0x000001B99A99B000-memory.dmp

Download

memory/2424-166-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2564-168-0x0000014C04820000-0x0000014C0484B000-memory.dmp

Download

memory/2564-169-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2576-171-0x0000020A4BF50000-0x0000020A4BF7B000-memory.dmp

Download

memory/2576-172-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/2660-174-0x000002076A890000-0x000002076A8BB000-memory.dmp

Download

memory/3716-89-0x000001DF071D0000-0x000001DF071FB000-memory.dmp

Download

memory/3716-90-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download

memory/3716-281-0x000001DF071D0000-0x000001DF071FB000-memory.dmp

Download

memory/4284-749-0x000001AE6CF70000-0x000001AE6D270000-memory.dmp

Download

memory/4344-5-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-320-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-1-0x00007FF89765F000-0x00007FF897660000-memory.dmp

Download

memory/4344-2-0x000001FCA38C0000-0x000001FCA38EC000-memory.dmp

Download

memory/4344-6-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-309-0x000001FCBC5E0000-0x000001FCBC8AE000-memory.dmp

Download

memory/4344-310-0x000001FCA3B70000-0x000001FCA3B80000-memory.dmp

Download

memory/4344-313-0x000001FCBC8E0000-0x000001FCBC8F4000-memory.dmp

Download

memory/4344-319-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-0-0x000001FCA19C0000-0x000001FCA1CC0000-memory.dmp

Download

memory/4344-4-0x00007FF8974D0000-0x00007FF897E74000-memory.dmp

Download

memory/4344-322-0x000001FCA3B70000-0x000001FCA3B80000-memory.dmp

Download

memory/5088-14-0x00007FF8B8880000-0x00007FF8B8AE3000-memory.dmp

Download

memory/5088-15-0x00007FF8B7300000-0x00007FF8B73C7000-memory.dmp

Download

memory/5724-282-0x0000000003BE0000-0x0000000003C0B000-memory.dmp

Download

memory/5724-101-0x0000000003BE0000-0x0000000003C0B000-memory.dmp

Download

memory/5724-102-0x00007FF8789C0000-0x00007FF8789D0000-memory.dmp

Download