njrat | 6cf92f74dfc276d53aed0bd0a43c25158821d42a79ebfa45b75d6e2dfdc0d126

Analysis

max time kernel
900s
max time network
472s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/11/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload.exe
Size 55KB
Sample261109-2eqllsss7l
SHA256 6cf92f74dfc276d53aed0bd0a43c25158821d42a79ebfa45b75d6e2dfdc0d126
MD5 22379a11a57c880f03d14fff0c556ae4
SHA1 3ac3494a1b832088c5e18ad3311d1433c0804d0d
SHA512 21394b18ebd57caf16a0f3bb46ac16b3abca376d188bac7b0061c0cb19a19085d272dc72634a95a48148c527d4aad35cff7feac8fde8c4cb52d7fd899045119a
SSDEEP 1536:Uwws4DnAN7jytFADRwsNMDEXExI3pm3m:3T4DnA2PADRwsNMDEXExI3pm
TLSH
T15F432844BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668EB13327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution njrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	ec61aa3131104026b99138f3ace564c0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	MasonMBR-SLEEP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Payload.exe

Executes dropped EXE 5 IoCs

pid	Process
3392	ec61aa3131104026b99138f3ace564c0.exe
6136	MasonMBR-SLEEP.exe
5036	MasonRootkit.exe
5988	MasonGDI.exe
3212	MasonGDI.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk	DllHost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2200	cmd.exe
4804	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Payload.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4804	cmd.exe
4020	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3772	timeout.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4020	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe
5036	MasonRootkit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: SeDebugPrivilege	5036	MasonRootkit.exe
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: SeShutdownPrivilege	3432	Explorer.EXE
Token: SeCreatePagefilePrivilege	3432	Explorer.EXE
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe
Token: 33	468	Payload.exe
Token: SeIncBasePriorityPrivilege	468	Payload.exe

Suspicious use of UnmapMainImage 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
2888	TextInputHost.exe
3432	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 3392	468	Payload.exe	92
PID 3392 wrote to memory of 6136	3392	ec61aa3131104026b99138f3ace564c0.exe	93
PID 3392 wrote to memory of 5036	3392	ec61aa3131104026b99138f3ace564c0.exe	94
PID 3392 wrote to memory of 5988	3392	ec61aa3131104026b99138f3ace564c0.exe	95
PID 3392 wrote to memory of 5764	3392	ec61aa3131104026b99138f3ace564c0.exe	96
PID 5036 wrote to memory of 624	5036	MasonRootkit.exe	5
PID 5036 wrote to memory of 680	5036	MasonRootkit.exe	7
PID 5036 wrote to memory of 892	5036	MasonRootkit.exe	11
PID 5036 wrote to memory of 340	5036	MasonRootkit.exe	13
PID 5036 wrote to memory of 408	5036	MasonRootkit.exe	14
PID 5036 wrote to memory of 744	5036	MasonRootkit.exe	15
PID 5036 wrote to memory of 668	5036	MasonRootkit.exe	16
PID 5036 wrote to memory of 1060	5036	MasonRootkit.exe	17
PID 5036 wrote to memory of 1084	5036	MasonRootkit.exe	18
PID 5036 wrote to memory of 1120	5036	MasonRootkit.exe	19
PID 5036 wrote to memory of 1356	5036	MasonRootkit.exe	21
PID 5036 wrote to memory of 1432	5036	MasonRootkit.exe	23
PID 5036 wrote to memory of 1448	5036	MasonRootkit.exe	24
PID 5036 wrote to memory of 1460	5036	MasonRootkit.exe	25
PID 5036 wrote to memory of 1516	5036	MasonRootkit.exe	26
PID 5036 wrote to memory of 1548	5036	MasonRootkit.exe	27
PID 5036 wrote to memory of 1668	5036	MasonRootkit.exe	28
PID 3392 wrote to memory of 2200	3392	ec61aa3131104026b99138f3ace564c0.exe	99
PID 5036 wrote to memory of 1700	5036	MasonRootkit.exe	29
PID 5036 wrote to memory of 1744	5036	MasonRootkit.exe	30
PID 5036 wrote to memory of 1788	5036	MasonRootkit.exe	31
PID 5036 wrote to memory of 1804	5036	MasonRootkit.exe	32
PID 5036 wrote to memory of 1996	5036	MasonRootkit.exe	33
PID 5036 wrote to memory of 2012	5036	MasonRootkit.exe	34
PID 5036 wrote to memory of 1508	5036	MasonRootkit.exe	35
PID 5036 wrote to memory of 1824	5036	MasonRootkit.exe	36
PID 5036 wrote to memory of 1800	5036	MasonRootkit.exe	37
PID 5036 wrote to memory of 2064	5036	MasonRootkit.exe	38
PID 5036 wrote to memory of 2084	5036	MasonRootkit.exe	39
PID 5036 wrote to memory of 2232	5036	MasonRootkit.exe	40
PID 5036 wrote to memory of 2340	5036	MasonRootkit.exe	42
PID 5036 wrote to memory of 2528	5036	MasonRootkit.exe	43
PID 2200 wrote to memory of 3772	2200	cmd.exe	101
PID 5036 wrote to memory of 2560	5036	MasonRootkit.exe	44
PID 5036 wrote to memory of 2576	5036	MasonRootkit.exe	45
PID 5036 wrote to memory of 2624	5036	MasonRootkit.exe	46
PID 5036 wrote to memory of 2660	5036	MasonRootkit.exe	47
PID 5036 wrote to memory of 2740	5036	MasonRootkit.exe	48
PID 5036 wrote to memory of 2748	5036	MasonRootkit.exe	49
PID 5036 wrote to memory of 2924	5036	MasonRootkit.exe	50
PID 5036 wrote to memory of 3092	5036	MasonRootkit.exe	52
PID 5036 wrote to memory of 3116	5036	MasonRootkit.exe	53
PID 5036 wrote to memory of 3164	5036	MasonRootkit.exe	54
PID 5036 wrote to memory of 3220	5036	MasonRootkit.exe	55
PID 5036 wrote to memory of 3352	5036	MasonRootkit.exe	56
PID 5036 wrote to memory of 3432	5036	MasonRootkit.exe	57
PID 5036 wrote to memory of 3568	5036	MasonRootkit.exe	58
PID 5036 wrote to memory of 3844	5036	MasonRootkit.exe	60
PID 5036 wrote to memory of 572	5036	MasonRootkit.exe	62
PID 5036 wrote to memory of 4192	5036	MasonRootkit.exe	63
PID 5036 wrote to memory of 1236	5036	MasonRootkit.exe	65
PID 5036 wrote to memory of 6012	5036	MasonRootkit.exe	66
PID 5036 wrote to memory of 4992	5036	MasonRootkit.exe	67
PID 5036 wrote to memory of 2964	5036	MasonRootkit.exe	69
PID 5036 wrote to memory of 864	5036	MasonRootkit.exe	70
PID 5036 wrote to memory of 2252	5036	MasonRootkit.exe	71
PID 5036 wrote to memory of 1052	5036	MasonRootkit.exe	72
PID 5036 wrote to memory of 2684	5036	MasonRootkit.exe	73
PID 5036 wrote to memory of 3832	5036	MasonRootkit.exe	75

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1120

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bbaa23af-2526-4f93-a4f5-00ede810ef01 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d235c647-4134-4097-a29e-9d2d66446ea5 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7a3f2787-3c35-47e1-94eb-e9dbc486d477 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-47b06e34-1c81-4e03-b05c-fcae4ce09711 -LifetimeId:4e5d8a7c-a7d8-4d7b-94aa-963b1e8f9479 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1548
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1700
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1996
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x2f4 0x300
  2⤵
  PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2084

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3432
- C:\Users\Admin\AppData\Local\Temp\Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - Checks computer location settings
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Users\Admin\AppData\Local\Temp\ec61aa3131104026b99138f3ace564c0.exe
    "C:\Users\Admin\AppData\Local\Temp\ec61aa3131104026b99138f3ace564c0.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5988
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8E23.tmp.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5160
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:3772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn CleanSweepCheck /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5544
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:4804
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5356
  - - C:\Windows\SysWOW64\PING.EXE
      ping 0 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3568

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1236

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:6012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:864

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1052

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2684

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops file in System32 directory
PID:3832

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Suspicious use of UnmapMainImage
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:5596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2984

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec61aa3131104026b99138f3ace564c0.exe

Path C:\Users\Admin\AppData\Local\Temp\ec61aa3131104026b99138f3ace564c0.exe
Size 535KB
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp61CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp61CA.tmp
Size 873KB
SHA256 6a1e08d3a6759f42ea2480450bdf1f369bf50236ba1dc94cfddbf02b5dd7ecaa
MD5 7bfe4475c45768860615d6cdc19dc622
SHA1 d937f02f743833748dbc391211602c28f0eaca8f
SHA512 64bb4d4ebc82a7509ded16677592dacb862bfbdbb9c06a871f7d051aa7a5c67c5a5358ddd3f44ca7922fd3f406a784c768737dddafc49075f496452b96597681
SSDEEP 1536:qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnns:D
TLSH
T175150FF06479EE53F39685397920FD2846D03499AAF3493A707DF9C8A373B60285C61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp8E23.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8E23.tmp.bat
Size 184B
SHA256 fd0e496dce1461dfa7f67374ad0a6fce35a4ec98fcb7304b44ca4e20a69934d8
MD5 6e6c2abf196d0ad0fd8af2d128d3b8c7
SHA1 afa7076873d4485dfc44bbadf71f3518309d9e15
SHA512 0b024ce38c00892a636e1736f61262d1e17cdd977f0ed854a2a1ca6c7db4f0bcd5487c18ac4111a129991a8face3862d6d5e88698b275dcedbe60ee8e4f35895
TLSH
T1F9C0800595CAF7151506A82706F7D58FC1A3DC6E7F456B90E3648448A944C7CF4B5709
MD5 SHA1 SHA512 TLSH

Submit Download

Scheduled Start

Path C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start
Size 5KB
SHA256 bd189ebbe555a6876d02720b870d47b73f5cf545ec98c5b4d91ac4d95d80ccf1
MD5 b7c7292731075a751ee794df1db77b3b
SHA1 ad451c693e0030f9b2be0a2f068003eb8f8bd046
SHA512 51c859d22c6c42a8c6f47b25faf96482e95ce8bd0739da951cc12373f0aa0dcb6885edf2441b71fa963d1387107e2cadbe2065e419356ac2ff1b3ad1842e79ca
SSDEEP 96:LIzs96ki+wwTqIlwTvIywJHhf7GdiaipVA9llu9Y5hF2P9c+:7LY27xa9rh7+
TLSH
T17DB1384367EE1119F1F76A6CAAB754218E67BD565D39C46D00AC200DCBF3E22C8613B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 e2e592a5e52bfb5854c6768f7d32f37487af2a67f6039d0020129a1ebbe26f1f
MD5 729ad1f1ac412c13a851982e26da1033
SHA1 ed8c61af9bf8b8c88ba4c01c501ee6ebc6726595
SHA512 6766b0bc05e6e2c5d1bb0dc8c887803f5a9890e6942bc86cdbb0bb58da4f1bf7f9ede1d65e443180fd8d63c1ee1fa1ca25850d1407ef1794d867e68f46679f97
TLSH
T1E0E02B126AAC5281E9330B3C59329951C137F63ABC01C34C1B3AC55C1D2DF108937B1A
MD5 SHA1 SHA512 TLSH

Submit Download

FB0D848F74F70BB2EAA93746D24D9749

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
Size 330B
SHA256 fae28015f6d3d69ce2c2bf98dbe4efb2642606ac499eaf4646bbcb9f46e34036
MD5 dc9e816b284553360c331942c09e2cab
SHA1 a94b067224265a8af221df71e868b3346f29efb0
SHA512 3b65222bc4c377aca2c26519b7d50aa82e36636da4a4b5336e16d104ab7c23f7fd4e55761cf6c6bc036a96e94c4f6fa5ed9c5157a095b12a06bd14e060c20782
TLSH
T1C2E0C209BAE90302E6F36A3C6A62A4874A377517AC01C64D8BB9014C0C24F11A876329
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D
Size 426B
SHA256 501f703d3b6c51206659537a092e0e996efea43276a91c198791e8112f68b8b3
MD5 3b25b425dd080f48644cbad4d7b9ed38
SHA1 1163a81ea1a57cdb0fb3ca015f1b7d9f96cebe99
SHA512 3b4e0770727d5ff15057529317f8e44518b9c31f8d42231a3672f085599bb17109b1588295c5555ac679a9adf17a36aa1713ee09fa56a5fae3c5fc48f5c086d6
TLSH
T16FE0688029FE806CE332BE3C5BE8A97E5A3AF21708085738173052181609D800C36733
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 6d37f595544d5f0c63e67f8b14f32b04857b6fabaed37c26219044410b89d2f9
MD5 0a57d99ebc393662a35ff2490de6963c
SHA1 2bcca6f76b0b00b773f7bb3d855801fe75ba8a76
SHA512 18bad85080c1946befd4ee3f5cc3189866b25f36dc2a3c85cfcd05a6d9fcb96938755f7dbef6923ec316b45e867354608d6e5531db0dcfdb9a6fa118afe00421
TLSH
T10BE0C01425F7026CF4F5C1384FD9702494AAF0210412E2B359C15706A702640DC12E33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/340-87-0x000002A5793D0000-0x000002A5793FB000-memory.dmp

Download

memory/340-88-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/408-91-0x000001A33C3D0000-0x000001A33C3FB000-memory.dmp

Download

memory/408-92-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/468-4-0x0000000074730000-0x0000000074CE1000-memory.dmp

Download

memory/468-363-0x0000000074730000-0x0000000074CE1000-memory.dmp

Download

memory/468-0-0x00000000010A0000-0x00000000010B0000-memory.dmp

Download

memory/468-3-0x0000000074732000-0x0000000074734000-memory.dmp

Download

memory/468-1-0x0000000074732000-0x0000000074734000-memory.dmp

Download

memory/468-5-0x0000000074730000-0x0000000074CE1000-memory.dmp

Download

memory/468-2-0x00000000010A0000-0x00000000010B0000-memory.dmp

Download

memory/624-74-0x0000023E42740000-0x0000023E42765000-memory.dmp

Download

memory/624-76-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/624-75-0x0000023E42770000-0x0000023E4279B000-memory.dmp

Download

memory/668-108-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/668-107-0x000002B3B1F60000-0x000002B3B1F8B000-memory.dmp

Download

memory/680-80-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/680-79-0x00000245F3CA0000-0x00000245F3CCB000-memory.dmp

Download

memory/744-96-0x000002A9C44A0000-0x000002A9C44CB000-memory.dmp

Download

memory/744-97-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/892-85-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/892-84-0x00000232A7F60000-0x00000232A7F8B000-memory.dmp

Download

memory/1060-110-0x000001603BBC0000-0x000001603BBEB000-memory.dmp

Download

memory/1060-111-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1084-113-0x0000015B5EC30000-0x0000015B5EC5B000-memory.dmp

Download

memory/1084-114-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1120-103-0x000001D3AC630000-0x000001D3AC65B000-memory.dmp

Download

memory/1120-104-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1356-116-0x000001EE2AF90000-0x000001EE2AFBB000-memory.dmp

Download

memory/1356-117-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1432-125-0x0000021E2F760000-0x0000021E2F78B000-memory.dmp

Download

memory/1432-126-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1448-129-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1448-128-0x0000023BDB770000-0x0000023BDB79B000-memory.dmp

Download

memory/1460-132-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1460-131-0x000002C4EEFB0000-0x000002C4EEFDB000-memory.dmp

Download

memory/1508-176-0x0000023676C60000-0x0000023676C8B000-memory.dmp

Download

memory/1508-177-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1516-136-0x000001432E130000-0x000001432E15B000-memory.dmp

Download

memory/1516-137-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1548-140-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1548-139-0x00000299CFCD0000-0x00000299CFCFB000-memory.dmp

Download

memory/1668-143-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1668-142-0x0000017B14140000-0x0000017B1416B000-memory.dmp

Download

memory/1700-148-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1700-147-0x000001F2E17B0000-0x000001F2E17DB000-memory.dmp

Download

memory/1744-152-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1744-151-0x000002453C6E0000-0x000002453C70B000-memory.dmp

Download

memory/1788-164-0x0000019FD7490000-0x0000019FD74BB000-memory.dmp

Download

memory/1788-165-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1800-183-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1800-182-0x000001DFDE9D0000-0x000001DFDE9FB000-memory.dmp

Download

memory/1804-167-0x000002EB53EE0000-0x000002EB53F0B000-memory.dmp

Download

memory/1804-168-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1824-180-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1824-179-0x0000026F1ACA0000-0x0000026F1ACCB000-memory.dmp

Download

memory/1996-171-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/1996-170-0x000001DD3B150000-0x000001DD3B17B000-memory.dmp

Download

memory/2012-173-0x000001729D430000-0x000001729D45B000-memory.dmp

Download

memory/2012-174-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/2064-186-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/2064-185-0x0000024195DD0000-0x0000024195DFB000-memory.dmp

Download

memory/2084-188-0x00000264A82B0000-0x00000264A82DB000-memory.dmp

Download

memory/2084-189-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/2232-191-0x0000000000F10000-0x0000000000F3B000-memory.dmp

Download

memory/2232-192-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/2340-202-0x000001EEE3F80000-0x000001EEE3FAB000-memory.dmp

Download

memory/2340-203-0x00007FF7F6BB0000-0x00007FF7F6BC0000-memory.dmp

Download

memory/2528-205-0x000001D285790000-0x000001D2857BB000-memory.dmp

Download

memory/3392-22-0x00000000014D0000-0x0000000001512000-memory.dmp

Download

memory/3392-21-0x00000000014B0000-0x00000000014C0000-memory.dmp

Download

memory/3392-20-0x0000000000C90000-0x0000000000D1C000-memory.dmp

Download

memory/5036-66-0x00007FF836B30000-0x00007FF836D28000-memory.dmp

Download

memory/5036-68-0x00007FF835090000-0x00007FF83514D000-memory.dmp

Download

memory/5988-71-0x0000000004ED0000-0x0000000004F62000-memory.dmp

Download

memory/5988-70-0x0000000000260000-0x0000000000276000-memory.dmp

Download

memory/6136-65-0x0000000000720000-0x0000000000736000-memory.dmp

Download