njrat | 4d4ae64ec93ce503e31ad963d15812fcc926dbc655512271cb616ff94a4bb78a

Analysis

user interaction
yes
max time kernel
376s
max time network
559s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DiscordPTB.exe
Size 55KB
Sample260922-llxeqsshnc
SHA256 4d4ae64ec93ce503e31ad963d15812fcc926dbc655512271cb616ff94a4bb78a
MD5 0dea77fe8d0331a6373fa10f81a6e813
SHA1 ab08a27e8e867650fd83325339186db2482af9a8
SHA512 b072fbd2f7f932a88d20deed9582ec1d49e25455e05599340cfbeb39936360aa14aeb4aff4c07e79d59995752104f8337fed526a7af5c84942b059c4e539bcb0
SSDEEP 768:U0CPl+t1Man0KI2NO5SioJ3Q8kSNCmwFvfu0YMDHPsxL7XJSxI3pmqm:U02sDnXNO5SiKlDfwsNMDAXExI3pmqm
TLSH
T11F432744BFEA4A05E2BD8F3468F659150A34AA63F532EB1F48D568DB13327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution njrat persistence privilege_escalation spyware trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	reg.exe

Manipulates Digital Signatures 1 TTPs 12 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPublisher	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\trust\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\trust\CRLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\trust\CTLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\trust	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\SystemCertificates\TrustedPeople	reg.exe

Creates a file in the Startup directory 1 TTPs 11 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe	DiscordPTB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe	Squidward.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe	Squidward.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe	Squidward.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe	Squidward.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR.exe	Squidward.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smil.exe	DiscordPTB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Commandos.exe	DiscordPTB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe	Squidward.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe	Squidward.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR.exe	Squidward.exe

Executes dropped EXE 5 IoCs

pid	Process
8	Squidward.exe
4800	MasonMBR-SLEEP.exe
5288	MasonRootkit.exe
5976	MasonGDI.exe
3244	804de8a9ecf94b6090f2245d39a543e1.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key opened	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5168	cmd.exe
1520	cmd.exe
2796	cmd.exe
4196	cmd.exe
1268	cmd.exe
5600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiscordPTB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Checks processor information in registry 2 TTPs 31 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	reg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	reg.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4292	timeout.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	reg.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	reg.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	reg.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	reg.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9d9ef7a6_0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\34	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LinksBar	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Settings	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\IETld	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\ade652bd_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\New Windows	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-excel	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\VersionManager	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Help_Menu_URLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\18	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\5	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\8	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Toolbar	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\31	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\4	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\7	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\SQM	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\GPU	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\38	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\17	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\20	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9d9ef7a6_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\804de8a9ecf94b6090f2245d39a543e1.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\23	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\25	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\30	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\35	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\26	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\powerpoint	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\9d9ef7a6_0	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\19	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\28	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Services	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\TypedURLs	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\ProtocolExecute	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Security	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\10	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\16	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\21	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\33	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\39	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\ade652bd_0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\IntelliForms	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\13	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\International\Scripts\27	reg.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2TS\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ms-windows-store-license	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.prc\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.chk	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpga	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msrcincident	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sys\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.a52	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2T\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sr_\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lzh	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.nvr	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sit\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.TS\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ani	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dotm\ShellEx\PropertyHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sdp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dll	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pch\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.flac\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.json	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tiff\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.inf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2V	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4a\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ofs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\PDXFileType\ShellNew	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.secstore	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mka	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.srw\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sym\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dotm\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.art\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lgn\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.idl	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4b	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg1	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1xml	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pst\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tdl	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.otf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.eip\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxr	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ics\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.p12	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pab	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.thp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.arw\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ics\OpenWithProgIDs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.srw\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5924	reg.exe
6064	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe
5288	MasonRootkit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe
Token: SeIncBasePriorityPrivilege	3420	DiscordPTB.exe
Token: 33	3420	DiscordPTB.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5100	ctfmon.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3348	Conhost.exe
2672	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 8	3420	DiscordPTB.exe	93
PID 8 wrote to memory of 4800	8	Squidward.exe	94
PID 8 wrote to memory of 5288	8	Squidward.exe	95
PID 8 wrote to memory of 5976	8	Squidward.exe	96
PID 8 wrote to memory of 5716	8	Squidward.exe	97
PID 5288 wrote to memory of 748	5288	MasonRootkit.exe	5
PID 5288 wrote to memory of 968	5288	MasonRootkit.exe	9
PID 5288 wrote to memory of 976	5288	MasonRootkit.exe	10
PID 5288 wrote to memory of 548	5288	MasonRootkit.exe	11
PID 5288 wrote to memory of 1032	5288	MasonRootkit.exe	13
PID 5288 wrote to memory of 1116	5288	MasonRootkit.exe	14
PID 5288 wrote to memory of 1168	5288	MasonRootkit.exe	15
PID 5288 wrote to memory of 1252	5288	MasonRootkit.exe	16
PID 5288 wrote to memory of 1280	5288	MasonRootkit.exe	17
PID 5288 wrote to memory of 1356	5288	MasonRootkit.exe	18
PID 5288 wrote to memory of 1552	5288	MasonRootkit.exe	22
PID 5288 wrote to memory of 1604	5288	MasonRootkit.exe	23
PID 5288 wrote to memory of 1668	5288	MasonRootkit.exe	24
PID 5288 wrote to memory of 1696	5288	MasonRootkit.exe	25
PID 5288 wrote to memory of 1768	5288	MasonRootkit.exe	26
PID 5288 wrote to memory of 1804	5288	MasonRootkit.exe	27
PID 5288 wrote to memory of 2008	5288	MasonRootkit.exe	28
PID 5288 wrote to memory of 1848	5288	MasonRootkit.exe	29
PID 5288 wrote to memory of 1996	5288	MasonRootkit.exe	30
PID 5288 wrote to memory of 2064	5288	MasonRootkit.exe	31
PID 5288 wrote to memory of 2072	5288	MasonRootkit.exe	32
PID 5288 wrote to memory of 2176	5288	MasonRootkit.exe	33
PID 5288 wrote to memory of 2248	5288	MasonRootkit.exe	34
PID 5288 wrote to memory of 2320	5288	MasonRootkit.exe	35
PID 5288 wrote to memory of 2420	5288	MasonRootkit.exe	36
PID 5288 wrote to memory of 2480	5288	MasonRootkit.exe	37
PID 5288 wrote to memory of 2580	5288	MasonRootkit.exe	38
PID 5288 wrote to memory of 2624	5288	MasonRootkit.exe	39
PID 5288 wrote to memory of 2808	5288	MasonRootkit.exe	40
PID 5288 wrote to memory of 2820	5288	MasonRootkit.exe	41
PID 5288 wrote to memory of 2872	5288	MasonRootkit.exe	42
PID 5288 wrote to memory of 2932	5288	MasonRootkit.exe	43
PID 2420 wrote to memory of 4996	2420	svchost.exe	99
PID 5288 wrote to memory of 4996	5288	MasonRootkit.exe	99
PID 5288 wrote to memory of 2980	5288	MasonRootkit.exe	44
PID 8 wrote to memory of 4196	8	Squidward.exe	100
PID 5288 wrote to memory of 2208	5288	MasonRootkit.exe	46
PID 5288 wrote to memory of 3096	5288	MasonRootkit.exe	47
PID 5288 wrote to memory of 3180	5288	MasonRootkit.exe	48
PID 5288 wrote to memory of 3472	5288	MasonRootkit.exe	50
PID 5288 wrote to memory of 3544	5288	MasonRootkit.exe	51
PID 5288 wrote to memory of 3560	5288	MasonRootkit.exe	52
PID 5288 wrote to memory of 3608	5288	MasonRootkit.exe	53
PID 5288 wrote to memory of 3620	5288	MasonRootkit.exe	54
PID 5288 wrote to memory of 3636	5288	MasonRootkit.exe	55
PID 5288 wrote to memory of 3644	5288	MasonRootkit.exe	56
PID 5288 wrote to memory of 3336	5288	MasonRootkit.exe	57
PID 5288 wrote to memory of 920	5288	MasonRootkit.exe	58
PID 5288 wrote to memory of 4368	5288	MasonRootkit.exe	59
PID 5288 wrote to memory of 4440	5288	MasonRootkit.exe	60
PID 5288 wrote to memory of 4508	5288	MasonRootkit.exe	61
PID 5288 wrote to memory of 4564	5288	MasonRootkit.exe	62
PID 5288 wrote to memory of 4816	5288	MasonRootkit.exe	63
PID 5288 wrote to memory of 5100	5288	MasonRootkit.exe	64
PID 5288 wrote to memory of 5176	5288	MasonRootkit.exe	65
PID 5288 wrote to memory of 5280	5288	MasonRootkit.exe	66
PID 5288 wrote to memory of 5504	5288	MasonRootkit.exe	69
PID 5288 wrote to memory of 2436	5288	MasonRootkit.exe	71
PID 5288 wrote to memory of 6100	5288	MasonRootkit.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:748
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:968
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1168
- C:\Windows\system32\userinit.exe
  C:\Windows\system32\userinit.exe
  2⤵
  PID:1524
- - C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    3⤵
    PID:2916

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:976

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5d89752f-2362-4da9-8be8-c40a767142f2 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3efb6255-6aea-4e84-a870-7b5103fef50c -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-febf2fb6-7764-4715-b1fa-a21d38c1d052 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e7befb9a-1c24-4a90-aafe-64240798d12c -LifetimeId:8b892297-c373-4b12-bee0-3fa40f7466fc -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1848
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1532
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Checks processor information in registry
    PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\DiscordPTB.exe
      "C:\Users\Admin\AppData\Local\Temp\DiscordPTB.exe"
      4⤵
      Creates a file in the Startup directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe"
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:8
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe"
        6⤵
        Executes dropped EXE
        
        PID:4800
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5288
      - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5976
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\MasonMBR.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA2F.tmp.bat""
        6⤵
        Executes a command shell one-liner
        
        PID:4196
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5996
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\804de8a9ecf94b6090f2245d39a543e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\804de8a9ecf94b6090f2245d39a543e1.exe"
        5⤵
        Executes dropped EXE
        
        PID:3244
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
        6⤵
        Executes a command shell one-liner
        
        PID:1268
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4208
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCR /f
        7⤵
        Modifies registry class
        
        PID:1408
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKCU /f
        6⤵
        Executes a command shell one-liner
        
        PID:5600
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4888
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCU /f
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Manipulates Digital Signatures
        Accesses Microsoft Outlook profiles
        Modifies Internet Explorer settings
        Modifies registry key
        outlook_office_path
        
        PID:5924
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKLM /f
        6⤵
        Executes a command shell one-liner
        
        PID:5168
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2672
        
        C:\Windows\system32\reg.exe
        
        reg delete HKLM /f
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry key
        
        PID:6064
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKU /f
        6⤵
        Executes a command shell one-liner
        
        PID:1520
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4964
        
        C:\Windows\system32\reg.exe
        
        reg delete HKU /f
        7⤵
        
        PID:1336
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete HKCC /f
        6⤵
        Executes a command shell one-liner
        
        PID:2796
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCC /f
        7⤵
        
        PID:2976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D0
  2⤵
  PID:4996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2480
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:5100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2932

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3180

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Modifies data under HKEY_USERS
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4564

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4816

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5176

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:6100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5552

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4088

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:2192

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3416

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4348

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6292

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6364

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:7104

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:7132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.70d2ca0d-fbe9-453f-a2a4-5b9e45bc54c5.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.70d2ca0d-fbe9-453f-a2a4-5b9e45bc54c5.tmp.csv
Size 46KB
SHA256 8befc8561840a80110f5b894945f5f764114becc5233614a2be83ab2c43fbc9f
MD5 ada3c176bceb1963b35e72cc879ce9d7
SHA1 60366f3d0aaefa690eadfb593302b5f178e2f83d
SHA512 2a28b850947122b30695c1db00b4c0dbcbdeff0638e5f49965de995a99897a7967f75a8ee0fb433b8229d20d9a9fe5d03c4ed304531a1aece449e49ab43ee457
SSDEEP 768:vPWRENuZZMxtLC4UnmVZww5l0O3FH5IWtcMY9PJYNspYimsI0s4XYk6IZEkE/f0:vPVNuZ8LC4UnmzV5lZjbt34P5eAR6HP0
TLSH
T17123273ECEE9023FC2B6DA1CC8EA4607F895A453361DED4D94D3678A4567583BCD022E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.abd3a97e-b5ff-46e7-a593-65e8e5330db3.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.abd3a97e-b5ff-46e7-a593-65e8e5330db3.tmp.txt
Size 13KB
SHA256 ffb80251d4adeff4ec229c1fef234283d0b914cf973f167562e0cbad56293168
MD5 ffe4bb70f4482778d3648b5030d4200f
SHA1 49f637e537c4bd4a20bdb26d101b38ecd26f48b7
SHA512 8c528fb988d530c2ba392bd2db5d11e3946c2a5ebe07258de731edf9085fdb7cdbf5e1a640362008b8bf182f2f92bf770d4a8a547f3ae2f14eaee1b05fcc41aa
SSDEEP 96:4iefAPtQZoXYBY9pqSBQHLYEZqTtrivF5bRwVQkBHa2htjMrtOImt3:NefA7Gqg4a2bjMrtZmt3
TLSH
T12C52705616E80319F2F75E84A5F020A19773F872AE39CA4D01DE134E47E3E41D866FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

804de8a9ecf94b6090f2245d39a543e1.exe

Path C:\Users\Admin\AppData\Local\Temp\804de8a9ecf94b6090f2245d39a543e1.exe
Size 11KB
SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
MD5 5870c114ead5c7fe9c360e763f315824
SHA1 86376c63ab2f442c21d1f59fa56e91c77ce9d55b
SHA512 f6148e2041086d55a280e8540ad5c4ae563e025ca6339c3a2611a863d9a623c7cdfa97e260e7e1a46a1f5f2b9b2771aada8ab0772e0a1b3541eca2766ebb8958
SSDEEP 192:9YJsjftImptoisXPebmjsTytSiV0zQGE6X:y6pK7ebQsetSiafH
TLSH
T10532E94CB7E84534D2BE4B3608B6D3125770F0038D27CB5E1DEE64EE2D2671569A2F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpA2F.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpA2F.tmp.bat
Size 203B
SHA256 76ade7df9a0c4a0c4a3f05b55ca0de4be0512a0933aacc7d2d86e068181e50d9
MD5 aa956f3c1b8ad2c5e0f8900c70885c49
SHA1 9208dfce311c0916afa318929923db2ce55769e0
SHA512 9f7bbd957e6914dec6bc7e4b98b7f1a9d93e70aa024cc6ea2b84a6383e05b5f7e21260ee2637871f174dea4121b1664880536fcff24b44ca5351713b8b2978af
TLSH
T130D0220010DDF21FA95B382302BAD24D81A69C833A05AB20A34C0019680446CE0B8243
MD5 SHA1 SHA512 TLSH

Submit Download

Commandos.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Commandos.exe
Size 79KB
SHA256 e0c0bb0b89ded0bcad1a4fbd9d7d989cacffe9c2dd963a89e86e13582cdf8262
MD5 fe571936aa4654825c1c5df9cfe49227
SHA1 c1ffe14039561511724621bf385ddc4c4291b156
SHA512 646a1b1e5b02973df005c084d3a70f65a1f572563aa971b0247fbd4c1877ed7cd58d77c507e4f44bf7ac85f78b779b355025259cba9e5aec728aaf09a9dbec42
SSDEEP 768:4Kxnvyx9lZYS8tu7Qi4eyulHCuytnY9QRcgQorIbjWqor2hCaK:1nqx975EQQi4LaHC1Y9QR/rIbjUP
TLSH
T1BD83E40235736D85C7BC25F706974AE443E5EC8106F189876A7BA60EFDEC6A84C47E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Commandos.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Commandos.exe
Size 77KB
SHA256 19f14d83d05bb843ac1708cfe237d158660d669e3c3df56f3cd9b3c3a2474f14
MD5 55d85b3ac0befc99fa4cec7f37e80be4
SHA1 56d92590f4daed1fb1f4303bf29e9df44684e255
SHA512 af6c7ef03b6e08612ec397fa584c43a12a71125758fbb1b0c73eb294beb13c19a7761b7a14b76e62b99ae53fe42b36b39d91219faada0f2c8b68ba9709cad762
SSDEEP 768:4Kxnvyx9lZYS8tu7Qi4eyulHCuytnY9QRcgQorIbjWqor2hCaKL:1nqx975EQQi4LaHC1Y9QR/rIbjUPL
TLSH
T14E73E40235736D85C7BC25F706974AE443E5EC8106F189876A7BA60EFDEC6A84C47E83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonGDI.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Smil.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smil.exe
Size 365KB
SHA256 f534bb9d7cc4c0f8abf8adcc592a328a64a902211ab66bafd9a0c7a333e86a20
MD5 ea210a16c2cd0f7d84d3961bccbfe73a
SHA1 598a97e9c7aef20ccc65ed04aa9449564b53f48f
SHA512 baad73a63e0e4c56bea3283f0072ff7682e37afa96403c99e714373ab49b20e990044f6a221a89d27fd8c763af06e7418886880d41cc557be9892daeb3877c65
SSDEEP 6144:iT+DPxVn9PvkYyeryYpaVexc6dJ1QYsjHf6EnJrNlT9Fb+3jqSd6A5n6n9TCX+Ct:iT+rxV93k4HpaVexd/FuHfFLEjdnC9At
TLSH
T18A84135561BDF193EAF9917318FFA004961A972FA3056BAF1C84D937AF0AF84320791C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Smil.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Smil.exe
Size 70KB
SHA256 7b704f6e262172a1cfbcf5c2f9fcc64d7fcc62988aea309955f83680511eb4b3
MD5 6839e5b4a98db8fa065a2852e44f1e27
SHA1 c9b9040f8749ec5527ad69dd941fec7928e278f7
SHA512 c31eae80ca518537dad7ab688cf3114019390f89237d79c8c9d2ca936957f05749f0117ea2780d8b71ed67ba28ccd870428f66397b659e51530caf22e29b86cc
SSDEEP 1536:nibHNHZmDG8oyP7p50097NRnmiQKPvkSVp7/VoZp4V1d:iT+DGPytxVnmiPvkurVoZed
TLSH
T12C63E082676C6A91EB7EF1364A3EB048D73A413B0342E65F1DC9C6B17D8ABE1274442C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Squidward.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Squidward.exe
Size 535KB
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
Size 174B
SHA256 cdb11958506a5ba5478e22ed472fa3ae422fe9916d674f290207e1fc29ae5a76
MD5 7f1698bab066b764a314a589d338daae
SHA1 524abe4db03afef220a2cc96bf0428fd1b704342
SHA512 4f94ad0fe3df00838b288a0ef4c12d37e175c37cbf306bdb1336ff44d0e4d126cd545c636642c0e88d8c6b8258dc138a495f4d025b662f40a9977d409d6b5719
TLSH
T119C08C38D2E9322141728D33BCB4A002DBB1F8212C1BCF9E06C0918B08A0A09EB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Contacts\desktop.ini
Size 412B
SHA256 48a6703a09f1197ee85208d5821032b77d20b3368c6b4de890c44fb482149cf7
MD5 449f2e76e519890a212814d96ce67d64
SHA1 a316a38e1a8325bef6f68f18bc967b9aaa8b6ebd
SHA512 c66521ed261dcbcc9062a81d4f19070216c6335d365bac96b64d3f6be73cd44cbfbd6f3441be606616d13017a8ab3c0e7a25d0caa211596e97a9f7f16681b738
TLSH
T15DE0921463FC2510B2738F17B9F490228B76FC222C09898D42C992861CF2960D232B63
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Documents\desktop.ini
Size 402B
SHA256 cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
MD5 ecf88f261853fe08d58e2e903220da14
SHA1 f72807a9e081906654ae196605e681d5938a2e6c
SHA512 82c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
TLSH
T18DE0ED19A2FD661052719F26BC78D011CBB1B8216C1B8E9E86C4918A18D5E14FA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Downloads\desktop.ini
Size 282B
SHA256 b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
MD5 3a37312509712d4e12d27240137ff377
SHA1 30ced927e23b584725cf16351394175a6d2a9577
SHA512 dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
TLSH
T1AFD0121496E8221052714E26BD789005DBB1B8212C1BCA9E5680918B18E6A45E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Links\desktop.ini
Size 504B
SHA256 a4234e2cf44c57609fd7cb0f9f0a33ee136b542fba5121ac02d85b38fb2ea02d
MD5 3b960da228cc489b622697659c885d64
SHA1 00686a12f1a43501f6eea2140da9be141a11bd3b
SHA512 3cc46f016865b3d541506cb15d7b22c83e1434bf73de23b158101aff08532eac29a6d9709060e9681cbeb375e2f843497ce80c3085579a8266c7f22b9567efd6
TLSH
T138F0824A92E8372051718E21FDF49055DBB6B8116C1ACB5E16C0918A09F5B45EA32BA7
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Music\desktop.ini
Size 504B
SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
MD5 06e8f7e6ddd666dbd323f7d9210f91ae
SHA1 883ae527ee83ed9346cd82c33dfc0eb97298dc14
SHA512 f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
TLSH
T155F05E19A2F9521052719F27FCB8D0018BB1BC212C1B8F9E86C4918A18D5A18F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Pictures\desktop.ini
Size 504B
SHA256 88856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
MD5 29eae335b77f438e05594d86a6ca22ff
SHA1 d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA512 5d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
TLSH
T1AAF0FE19A2F9561052719F27FC78D0119BB1B8226C1BCF9E87C4A18E18D5A19F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Saved Games\desktop.ini
Size 282B
SHA256 e6fdf8ed07b19b2a3b8eff05de7bc71152c85b377b9226f126dc54b58b930311
MD5 b441cf59b5a64f74ac3bed45be9fadfc
SHA1 3da72a52e451a26ca9a35611fa8716044a7c0bbc
SHA512 fdc26609a674d36f5307fa3f1c212da1f87a5c4cd463d861ce1bd2e614533f07d943510abed0c2edeb07a55f1dccff37db7e1f5456705372d5da8e12d83f0bb3
TLSH
T144D05B0492FC221052714E23FDB8D041DBB1B8217C1BCF9E478091CF18E5A45E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Searches\desktop.ini
Size 524B
SHA256 a9e8ad0792b546a4a8ce49eda82b327ad9581141312efec3ac6f2d3ad5a05f17
MD5 089d48a11bff0df720f1079f5dc58a83
SHA1 88f1c647378b5b22ebadb465dc80fcfd9e7b97c9
SHA512 f0284a3cc46e9c23af22fec44ac7bbde0b72f5338260c402564242c3dd244f8f8ca71dd6ceabf6a2b539cacc85a204d9495f43c74f6876317ee8e808d4a60ed8
TLSH
T17FF0824597EC2310B1768E11FD74A0118FB17831AC1A8E6C56C1618A1CF2F04E932F53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\desktop.ini
Size 504B
SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
MD5 50a956778107a4272aae83c86ece77cb
SHA1 10bce7ea45077c0baab055e0602eef787dba735e
SHA512 d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
TLSH
T1EAF01209A6F956105271DF27FCB8D0119BB1B8212C1BCF9E97C491CA18D5A18F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Public\AccountPictures\desktop.ini
Size 196B
SHA256 658d53a476592db7e0e09ecd0073b80315dc2d9041b2fb3bf96eb84ff89676cc
MD5 2971c89bfb3b06e591694b9a78e467b9
SHA1 baf00e198c8e9fc8e2333487da48325cbf221ad3
SHA512 0811c2971886be520472b928c7730ad7cc9733aa7ba24095da343c2a247ea9e2f2dfe8846786985421fa0eddfba81eef34f34b775a84aa7ba61535b38f876475
TLSH
T1ECD01225A2EC322491F30E16B97070455BB1FC265C15CA5D068061870CA4600C931E73
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
Size 174B
SHA256 1d9dcd07e5fa1748da3e7e4d57eca2e88a4c42e4f2cead9192e94325c32c2e4f
MD5 8f91870452433a5555c9d453f714698c
SHA1 bc648af5e3c22408df3f388410b7250710cd0b26
SHA512 15e39b452358e36d81c5c52bf0ad7b844182ab87e44018710f522bae83e887f72f6d8dcd494a651c69f095a97775a38573aa986817d3d6f67d7915e1591aca5d
TLSH
T133C0801492E9311041314D267CF49003CBB1B8212C17CF5D0684528B04A4614D631753
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
Size 174B
SHA256 feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
MD5 e0fd7e6b4853592ac9ac73df9d83783f
SHA1 2834e77dfa1269ddad948b87d88887e84179594a
SHA512 289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
TLSH
T17FC0801892E9311041718D12FC749001DBB1B8216C17CF5E07C0518B04A0605E631747
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_48.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
Size 1024KB
SHA256 10ef5c281972cac30f6df36af447ce2271b1d46dd309b052954070003be5b153
MD5 1d41d647faf0c99af43c89459acc8e9f
SHA1 0012ef2ce91e7a8e0286bafe1f51d1251120bfec
SHA512 5c09c6a6dcf4f5c26c073d8d989ce3d2ebb179d5bdff78d9a8488da992f9cfafee150388bcc6581da57912d3178a87535139661a0c488ef527553161f08498ef
SSDEEP 192:nxH6gVU1Bud//K1uwuyYaIlmaLwvLifWoYkG4rFyD4:nd6gm1Bud//KeQv+fWorx
TLSH
T1C1259C2677F22E78FDDCD9BA7B82D1761A037C7206C2011622DE775705618F8AAF162C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iconcache_idx.db

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 7KB
SHA256 9e0429155152888f9864a61f48c5f5f4f7da6095ab79afd71a803a59ed5478cd
MD5 bbe70a516ccc8b65668330f36fc864a1
SHA1 64d22473429d43f2efdedb04d2b7e21cdee5a8f5
SHA512 916d965c0ed403058d03462d20cc7a657986a9d262cf3aa47034da8909ecf41e481d52bc4241516c114dec6d2d43ae50d4765b098373e6749ff47b7b319f2f5e
SSDEEP 3:tn4lblFnl9TGQmRC/Ld//mTZmPRJ/AaRd//cFO/HRZSRd//:aBBGQoC/LdXm85JxdXcFO/xZ0dX
TLSH
T1B0E192033082CE42DD0D2A709E9CC0D84A08BF008C20834B34C1F36F0BF35C01030004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini
Size 196B
SHA256 4e252dbee2058e1cf6f78fc67568759a8ad213bcafe33192e55dd5712d7e4abd
MD5 08e1b7b2fd872cdcc42af67707dc2a98
SHA1 512644da4aa90a3919bc29f65e878e9870874f67
SHA512 b3835a7d38131aaf42781a103a6b6ec398389b9e5ce5f51916234ddd96f05b66bcfdc74c65cf2d1d5ebeddd955e528a1316a351e707cae846ca59e5094d3704b
TLSH
T1B7D01225A2EC322491F30E52B97070419BB1FC265C15CA5D068062860CA0600C931E77
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
Size 302B
SHA256 873bcd7fc25e21142bdfcd6c8f2bea3e294a055e3f132d8a2b3407aba45074e1
MD5 99d72adf4e683fa1e6f1a435ff5be9b3
SHA1 007ac135b547c29a9419eaf5b9c422b562f7cd2f
SHA512 fe623875d8ce38b7533333af24d6331459b7bd4a35df2212d666c8ad2eaf16b7f1101ed778a3114d70c3e3731da947d5ff7e272949ec21db194e2389398444ff
TLSH
T129E0E67ED3458774FAE1AAE9AB19751A543F60891147F60444F522A7F8BE00E8370EF1
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
Size 432B
SHA256 eb315c9d165b4916e3b00e4d148b53a6c03a2f0694a6a8821d98e76f935ca6a8
MD5 f107d0270e21a2fe91099fdc15918d44
SHA1 dabc2f24f4a4e90053743166e5c4175dcf2b2d2d
SHA512 b5d51c0d6abe99121d4f4f1d236def4260b7d5c26c501d7735eba4f58e2597db0e89b2b1df16545e49fc39649806e5305efb912328541bdd31c01ff3d2bda49c
TLSH
T132E0E52596F8222151708E57BEB09013DB71F8222C1B8E5E02C0628608D1E49E677B17
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Size 174B
SHA256 be49aff1e82fddfc2ab9dfffcb7e7be100800e3653fd1d12b6f8fa6a0957fcac
MD5 548b310fbc7a26d0b9da3a9f2d604a0c
SHA1 1e20c38b721dff06faa8aa69a69e616c228736c1
SHA512 fa5bb7ba547a370160828fe720e6021e7e3a6f3a0ce783d81071292739cef6cac418c4bc57b377b987e69d5f633c2bd97a71b7957338472c67756a02434d89f1
TLSH
T1D7C0121892E9312041718D127C7490019AB1B4212C168A5E06C0518B04A4A04E631643
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Desktop\desktop.ini
Size 282B
SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
MD5 9e36cc3537ee9ee1e3b10fa4e761045b
SHA1 7726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA512 5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
TLSH
T1B6D0121496E8221052714E22BD789001DBB1B8213C1BCF9E4680918B18E1A44E632B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Documents\desktop.ini
Size 418B
SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
MD5 93c8b5c191bdcf8aca86d7463d77e6c8
SHA1 a0062ab159018ee5cfbc78d8894ed9bb3590e93d
SHA512 885762c81afd007e43bbb09d4eee4552a3ef4497e93210eddbfc4e339d2612a940f338ce99264f8b89f5952bce1d817daef4381f93de2437889b3f1d3840b954
TLSH
T1EFE0ED19A2FD661462719F26BC789011CBB1F8216C1BCA9E87C0918A18D1E14F633B57
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Downloads\desktop.ini
Size 298B
SHA256 d5e7d3ffbfeffe8c91236b30b1cd3c4cbb80059d16ff6edf52c2027874e1ebdf
MD5 819c27ae07898f1a5efda4e146dbb174
SHA1 24e7bb0390e2c475922c5727d71404a339ac1269
SHA512 70618753f2f65544495bae56496a541dfb6f65a61c310e5489660536654a24b0569469c0da207b0287c1ba5f72696607a3a5a3d0ad50de81de74ee18feb18736
TLSH
T155E01214A6F8222462724E26B9749014DBB1F8216C1BCA9D5380908B1CE6A41E636B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
Size 402B
SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
MD5 881dfac93652edb0a8228029ba92d0f5
SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
TLSH
T113E06D04A2F9261012319E22BC78D001CBB1B8212C1BCE8E8680918A18D0A18EA33B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Music\desktop.ini
Size 520B
SHA256 7edc1c721b5402e489554f848f85ccc8e190852a0ddcac22a6123c8263841340
MD5 af5909700768a888173cbd32998cf3da
SHA1 194ed60ed8923749078816fc2c69614d975ba325
SHA512 d436b95a509f759269fda3ff398d2fe402306f88624e6a15256dc663f2709173f4d503e203ca3184e2a3f6e47ec11e8712ee2c1708932b89edf753aa9aee5c6d
TLSH
T19FF05E19A2F96210A2719F27FCB8D0118BB1BC212C1BCFDE87C0918A18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Pictures\desktop.ini
Size 520B
SHA256 3d643252d2ab50d0e5078aced4cb1ab19b5e8d1ff0bedf03f3243ebf3caa5884
MD5 7a985a80859ee46e35031543cf0d142f
SHA1 b331daec4b97bfb9c6133baaad17477509630cd6
SHA512 d400143911f23f9b7c457847fdd1a1619943065c237917a1478eadc6d6befee63c2f9e37afa43a57319965b56605505bfc32f71f3a687483a60cbabab1f2d01d
TLSH
T124F05E09A2F96210A2719F27FC78D0119BB1B8226C1BCFDE87C0A18E18D1A14F633B53
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\System32\config\systemprofile\Videos\desktop.ini
Size 520B
SHA256 b41bdfe903bf4ab529adf9a2624c5733f5e044d42a6cd6fed18fd2c281f7fcc5
MD5 a882cf89da04eb72950e65080a5cf857
SHA1 fa359f8d2e4502e5944bdadf46f05f9bf380a1cf
SHA512 c5de397435424ea9f807f00f44ee1d57d87e71d8afebbfcea6f5a365bf20c1b971cfbb50e40e29430672b022634f8bc8bded25ae9061f0dc6407f3f44d5cc990
TLSH
T106F05E09A6F96610A2719F27FCB8D0118BB1B8212C1BCFDD97C0918A18D1A14F637B53
MD5 SHA1 SHA512 TLSH

Submit Download

RGI1AE4.tmp

Path C:\Windows\Temp\RGI1AE4.tmp
Size 24KB
SHA256 04a0fbd0b5c3e4f7e3558a3871fe3f3cce5013a330941c3e72b4cdb19c81f2ad
MD5 033649d7b623b2f8cd29854ccb6d6a4b
SHA1 9772f7b7b11625fc3dea7598cdf5b6d0fc511ae6
SHA512 90df8c97c8d8062970d76af2235c3ab78208c95c332bbc04e72e2782cb926ab12dbb1098914f453eb7b095ee7dc50f80d4cb96c5931a51a25efb5d91a3c50989
SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsLIn8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSwIzw3VgYJQT
TLSH
T1CAB2BF295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 422B
SHA256 533e0d6e3b297d5d1246201317742457957dc48b05b4a80ea74a26eb04089270
MD5 a34eacc8a8b5c774457a0605378109c2
SHA1 a91f7b44c411ca654f961b27eef1b7b39dc6b50a
SHA512 7d626fa25f3ca6ad0ed7d08c7f55be7da384084d3615e1871cc28b34c26d5e15211a3d9592ce5a44ffc1f55b7b5b5e3efbe067d0eece5eb40e0a9f7fa63356af
TLSH
T128E0C01828FE4029E332AEBC47D95A3E4A3EF153580467782720021CD1A6D900C39B32
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 a7009aa1f3edc79e8e3b6e04142fd429178fb99e4451e41ace8845303f3e16a0
MD5 b078dfe41d9f8519b47af4466bb7c6cd
SHA1 46bbe69ca04c9fb3140e95047e395359b3f5d014
SHA512 d2d4cf089c4228731ad9cfb3525281069eb02eed071dab9dc2bf87e7893761a5a74bc7307cfa8a48979832523be8f761ca9ba12f3df907519805c25cfe8e6199
TLSH
T1DCE0281415FB422CF1F4D1351BDD74B0C45BF0571410E5F55ED41705B302644DC11D30
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-341-0x00007FFB91230000-0x00007FFB91BD4000-memory.dmp

Download

memory/8-45-0x00007FFB91230000-0x00007FFB91BD4000-memory.dmp

Download

memory/8-41-0x00007FFB913BF000-0x00007FFB913C0000-memory.dmp

Download

memory/8-42-0x00000000009E0000-0x0000000000A6C000-memory.dmp

Download

memory/8-43-0x00007FFB91230000-0x00007FFB91BD4000-memory.dmp

Download

memory/8-44-0x00000000012E0000-0x0000000001322000-memory.dmp

Download

memory/548-130-0x0000021E9F790000-0x0000021E9F7BB000-memory.dmp

Download

memory/548-131-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/748-79-0x000001510B890000-0x000001510B8B5000-memory.dmp

Download

memory/748-81-0x000001510B8C0000-0x000001510B8EB000-memory.dmp

Download

memory/748-82-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/968-84-0x000001E9B6560000-0x000001E9B658B000-memory.dmp

Download

memory/968-85-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/976-89-0x0000017C805B0000-0x0000017C805DB000-memory.dmp

Download

memory/976-90-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1032-133-0x000001BB0FE60000-0x000001BB0FE8B000-memory.dmp

Download

memory/1032-134-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1116-136-0x000001750C870000-0x000001750C89B000-memory.dmp

Download

memory/1116-137-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1168-98-0x0000025FD8970000-0x0000025FD899B000-memory.dmp

Download

memory/1168-99-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1252-207-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1252-139-0x0000020E119C0000-0x0000020E119EB000-memory.dmp

Download

memory/1280-141-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1280-140-0x000002218ACD0000-0x000002218ACFB000-memory.dmp

Download

memory/1356-143-0x00000133D7920000-0x00000133D794B000-memory.dmp

Download

memory/1356-144-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1552-110-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1552-109-0x0000018E47540000-0x0000018E4756B000-memory.dmp

Download

memory/1604-146-0x0000028D298D0000-0x0000028D298FB000-memory.dmp

Download

memory/1604-147-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1668-149-0x000001A8889E0000-0x000001A888A0B000-memory.dmp

Download

memory/1668-150-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1696-153-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1696-152-0x000002779FB10000-0x000002779FB3B000-memory.dmp

Download

memory/1768-155-0x0000010FDEF20000-0x0000010FDEF4B000-memory.dmp

Download

memory/1768-156-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1804-159-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1804-158-0x000002AC44830000-0x000002AC4485B000-memory.dmp

Download

memory/1848-164-0x000001ACB4FD0000-0x000001ACB4FFB000-memory.dmp

Download

memory/1848-165-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1996-168-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/1996-167-0x0000023F1CF30000-0x0000023F1CF5B000-memory.dmp

Download

memory/2008-161-0x00000198E9080000-0x00000198E90AB000-memory.dmp

Download

memory/2008-162-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2064-171-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2064-170-0x000001BA29A20000-0x000001BA29A4B000-memory.dmp

Download

memory/2072-173-0x00000226C7EA0000-0x00000226C7ECB000-memory.dmp

Download

memory/2072-174-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2176-176-0x000001CD9E440000-0x000001CD9E46B000-memory.dmp

Download

memory/2176-177-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2248-179-0x000002A79FF70000-0x000002A79FF9B000-memory.dmp

Download

memory/2320-183-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2320-182-0x00000205AE8F0000-0x00000205AE91B000-memory.dmp

Download

memory/2420-186-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2420-185-0x0000013CC1AF0000-0x0000013CC1B1B000-memory.dmp

Download

memory/2480-188-0x0000010BDFBE0000-0x0000010BDFC0B000-memory.dmp

Download

memory/2480-189-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2580-191-0x000001DDD8A10000-0x000001DDD8A3B000-memory.dmp

Download

memory/2580-192-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2624-194-0x00000296D5330000-0x00000296D535B000-memory.dmp

Download

memory/2624-195-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2808-197-0x0000029851CC0000-0x0000029851CEB000-memory.dmp

Download

memory/2808-198-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2820-200-0x00000156EC050000-0x00000156EC07B000-memory.dmp

Download

memory/2820-201-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2932-204-0x00007FFB76600000-0x00007FFB76610000-memory.dmp

Download

memory/2932-203-0x000001DAED370000-0x000001DAED39B000-memory.dmp

Download

memory/3244-418-0x0000000000990000-0x000000000099A000-memory.dmp

Download

memory/3420-1-0x00000000745F2000-0x00000000745F4000-memory.dmp

Download

memory/3420-4-0x00000000745F0000-0x0000000074C11000-memory.dmp

Download

memory/3420-3-0x00000000745F0000-0x0000000074C11000-memory.dmp

Download

memory/3420-2-0x00000000745F2000-0x00000000745F4000-memory.dmp

Download

memory/3420-0-0x0000000001040000-0x0000000001050000-memory.dmp

Download

memory/4800-61-0x0000000000480000-0x0000000000496000-memory.dmp

Download

memory/5288-76-0x00007FFBB64C0000-0x00007FFBB6723000-memory.dmp

Download

memory/5288-77-0x00007FFBB61A0000-0x00007FFBB6267000-memory.dmp

Download

memory/5976-87-0x0000000005A80000-0x0000000005B12000-memory.dmp

Download

memory/5976-78-0x0000000000D00000-0x0000000000D16000-memory.dmp

Download