xbinder | 9814699b9ec4ab6b912a8eee53e8698b588817493d5d0fd7cbb33e062b1a4b4b

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/06/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinderOutput.exe
Size 713KB
Sample260626-e8k7nagy7t
SHA256 9814699b9ec4ab6b912a8eee53e8698b588817493d5d0fd7cbb33e062b1a4b4b
MD5 c582e025db8125c14abe73bc435c03e3
SHA1 b48284a100a99c66badc2c8921631283bbe4f9c1
SHA512 1a300b9e5e062c9c7bd1f4e19fd0356b885a9d87b24f4c39d16a0c4876476c2211dc60e9b8ed59cb0da215964cc5c780c911d43695a141cd0b0277650082aa98
SSDEEP 12288:Wi/cqxn+TX+GqQMEunwuE6uxDhewLMXCb5zBEebQnA6Mm6BwWrr/P0AmAF6wP02l:WzBT+GMEunwDJRVzqA64pr8mdV
TLSH
T188F4239E0476D136C6DC873A1D72A32217DF7B60F663F4FE4284D3AA99DE5024E92D02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution xbinder loader persistence

Malware Config

Extracted

Family

xbinder

Mutex

qRmDOr1YeHxWSbC9p

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
CREATIVE EAX.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
MasonClient.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Executes dropped EXE 64 IoCs

pid	Process
4396	CREATIVE EAX.exe
5264	MasonClient.exe
4460	MasonClient.exe
1744	CREATIVE EAX.exe
2780	MasonClient.exe
468	CREATIVE EAX.exe
5200	MasonClient.exe
1212	CREATIVE EAX.exe
3116	MasonClient.exe
5096	CREATIVE EAX.exe
5948	MasonClient.exe
3432	CREATIVE EAX.exe
4268	MasonClient.exe
3236	CREATIVE EAX.exe
3144	MasonClient.exe
6080	CREATIVE EAX.exe
3612	MasonClient.exe
1904	CREATIVE EAX.exe
5404	MasonClient.exe
2244	CREATIVE EAX.exe
1492	MasonClient.exe
2200	CREATIVE EAX.exe
2180	MasonClient.exe
1548	CREATIVE EAX.exe
1872	MasonClient.exe
2084	CREATIVE EAX.exe
4196	MasonClient.exe
4780	CREATIVE EAX.exe
388	MasonClient.exe
2988	CREATIVE EAX.exe
3608	MasonClient.exe
4716	CREATIVE EAX.exe
5504	MasonClient.exe
344	CREATIVE EAX.exe
6036	MasonClient.exe
4976	CREATIVE EAX.exe
2924	MasonClient.exe
5536	CREATIVE EAX.exe
5432	MasonClient.exe
1488	CREATIVE EAX.exe
5996	MasonClient.exe
4752	CREATIVE EAX.exe
3312	MasonClient.exe
6104	CREATIVE EAX.exe
5072	MasonClient.exe
6024	CREATIVE EAX.exe
5044	MasonClient.exe
4864	CREATIVE EAX.exe
1144	MasonClient.exe
4568	CREATIVE EAX.exe
5384	MasonClient.exe
5940	CREATIVE EAX.exe
3008	MasonClient.exe
4948	CREATIVE EAX.exe
3164	MasonClient.exe
5928	CREATIVE EAX.exe
5448	MasonClient.exe
932	MasonClient.exe
1100	CREATIVE EAX.exe
2268	MasonClient.exe
3284	CREATIVE EAX.exe
1500	MasonClient.exe
5368	CREATIVE EAX.exe
4972	MasonClient.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	tmp70A2.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp70A2.tmp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5428	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5264	MasonClient.exe
Token: SeDebugPrivilege	4460	MasonClient.exe
Token: SeDebugPrivilege	2780	MasonClient.exe
Token: SeDebugPrivilege	5200	MasonClient.exe
Token: SeDebugPrivilege	3116	MasonClient.exe
Token: SeDebugPrivilege	5948	MasonClient.exe
Token: SeDebugPrivilege	4268	MasonClient.exe
Token: SeDebugPrivilege	3144	MasonClient.exe
Token: SeDebugPrivilege	3612	MasonClient.exe
Token: SeDebugPrivilege	5404	MasonClient.exe
Token: SeDebugPrivilege	1492	MasonClient.exe
Token: SeDebugPrivilege	2180	MasonClient.exe
Token: SeDebugPrivilege	1872	MasonClient.exe
Token: SeDebugPrivilege	4196	MasonClient.exe
Token: SeDebugPrivilege	388	MasonClient.exe
Token: SeDebugPrivilege	3608	MasonClient.exe
Token: SeDebugPrivilege	5504	MasonClient.exe
Token: SeDebugPrivilege	6036	MasonClient.exe
Token: SeDebugPrivilege	2924	MasonClient.exe
Token: SeDebugPrivilege	5432	MasonClient.exe
Token: SeDebugPrivilege	5996	MasonClient.exe
Token: SeDebugPrivilege	3312	MasonClient.exe
Token: SeDebugPrivilege	5072	MasonClient.exe
Token: SeDebugPrivilege	1144	MasonClient.exe
Token: SeDebugPrivilege	5384	MasonClient.exe
Token: SeDebugPrivilege	3008	MasonClient.exe
Token: SeDebugPrivilege	3164	MasonClient.exe
Token: SeDebugPrivilege	5448	MasonClient.exe
Token: SeDebugPrivilege	932	MasonClient.exe
Token: SeDebugPrivilege	2268	MasonClient.exe
Token: SeDebugPrivilege	1500	MasonClient.exe
Token: SeDebugPrivilege	4972	MasonClient.exe
Token: SeDebugPrivilege	5196	MasonClient.exe
Token: SeDebugPrivilege	5476	MasonClient.exe
Token: SeDebugPrivilege	5604	MasonClient.exe
Token: SeDebugPrivilege	2328	MasonClient.exe
Token: SeDebugPrivilege	5896	MasonClient.exe
Token: SeDebugPrivilege	5292	MasonClient.exe
Token: SeDebugPrivilege	5600	MasonClient.exe
Token: SeDebugPrivilege	4744	MasonClient.exe
Token: SeDebugPrivilege	3572	MasonClient.exe
Token: SeDebugPrivilege	2284	MasonClient.exe
Token: SeDebugPrivilege	3596	MasonClient.exe
Token: SeDebugPrivilege	888	MasonClient.exe
Token: 33	4052	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4052	AUDIODG.EXE
Token: SeDebugPrivilege	2148	MasonClient.exe
Token: SeDebugPrivilege	580	MasonClient.exe
Token: SeDebugPrivilege	4408	MasonClient.exe
Token: SeDebugPrivilege	1532	MasonClient.exe
Token: SeDebugPrivilege	2268	MasonClient.exe
Token: SeDebugPrivilege	3908	MasonClient.exe
Token: SeDebugPrivilege	2984	MasonClient.exe
Token: SeDebugPrivilege	5156	MasonClient.exe
Token: SeDebugPrivilege	1108	MasonClient.exe
Token: SeDebugPrivilege	3592	MasonClient.exe
Token: SeDebugPrivilege	5524	MasonClient.exe
Token: SeDebugPrivilege	2480	MasonClient.exe
Token: SeDebugPrivilege	5988	MasonClient.exe
Token: SeDebugPrivilege	4560	MasonClient.exe
Token: SeDebugPrivilege	5952	MasonClient.exe
Token: SeDebugPrivilege	2160	MasonClient.exe
Token: SeDebugPrivilege	1240	MasonClient.exe
Token: SeDebugPrivilege	1988	MasonClient.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 4396	6056	XBinderOutput.exe	80
PID 6056 wrote to memory of 5264	6056	XBinderOutput.exe	81
PID 5264 wrote to memory of 5428	5264	MasonClient.exe	82
PID 4396 wrote to memory of 1744	4396	CREATIVE EAX.exe	86
PID 4396 wrote to memory of 2780	4396	CREATIVE EAX.exe	87
PID 1744 wrote to memory of 468	1744	CREATIVE EAX.exe	89
PID 1744 wrote to memory of 5200	1744	CREATIVE EAX.exe	90
PID 468 wrote to memory of 1212	468	CREATIVE EAX.exe	91
PID 468 wrote to memory of 3116	468	CREATIVE EAX.exe	92
PID 1212 wrote to memory of 5096	1212	CREATIVE EAX.exe	93
PID 1212 wrote to memory of 5948	1212	CREATIVE EAX.exe	94
PID 5096 wrote to memory of 3432	5096	CREATIVE EAX.exe	95
PID 5096 wrote to memory of 4268	5096	CREATIVE EAX.exe	96
PID 3432 wrote to memory of 3236	3432	CREATIVE EAX.exe	97
PID 3432 wrote to memory of 3144	3432	CREATIVE EAX.exe	98
PID 3236 wrote to memory of 6080	3236	CREATIVE EAX.exe	99
PID 3236 wrote to memory of 3612	3236	CREATIVE EAX.exe	100
PID 6080 wrote to memory of 1904	6080	CREATIVE EAX.exe	101
PID 6080 wrote to memory of 5404	6080	CREATIVE EAX.exe	102
PID 1904 wrote to memory of 2244	1904	CREATIVE EAX.exe	103
PID 1904 wrote to memory of 1492	1904	CREATIVE EAX.exe	104
PID 2244 wrote to memory of 2200	2244	CREATIVE EAX.exe	105
PID 2244 wrote to memory of 2180	2244	CREATIVE EAX.exe	106
PID 2200 wrote to memory of 1548	2200	CREATIVE EAX.exe	107
PID 2200 wrote to memory of 1872	2200	CREATIVE EAX.exe	108
PID 1548 wrote to memory of 2084	1548	CREATIVE EAX.exe	109
PID 1548 wrote to memory of 4196	1548	CREATIVE EAX.exe	110
PID 2084 wrote to memory of 4780	2084	CREATIVE EAX.exe	111
PID 2084 wrote to memory of 388	2084	CREATIVE EAX.exe	112
PID 4780 wrote to memory of 2988	4780	CREATIVE EAX.exe	113
PID 4780 wrote to memory of 3608	4780	CREATIVE EAX.exe	114
PID 2988 wrote to memory of 4716	2988	CREATIVE EAX.exe	115
PID 2988 wrote to memory of 5504	2988	CREATIVE EAX.exe	116
PID 4716 wrote to memory of 344	4716	CREATIVE EAX.exe	117
PID 4716 wrote to memory of 6036	4716	CREATIVE EAX.exe	118
PID 344 wrote to memory of 4976	344	CREATIVE EAX.exe	119
PID 344 wrote to memory of 2924	344	CREATIVE EAX.exe	120
PID 4976 wrote to memory of 5536	4976	CREATIVE EAX.exe	121
PID 4976 wrote to memory of 5432	4976	CREATIVE EAX.exe	122
PID 5536 wrote to memory of 1488	5536	CREATIVE EAX.exe	123
PID 5536 wrote to memory of 5996	5536	CREATIVE EAX.exe	124
PID 1488 wrote to memory of 4752	1488	CREATIVE EAX.exe	125
PID 1488 wrote to memory of 3312	1488	CREATIVE EAX.exe	126
PID 4752 wrote to memory of 6104	4752	CREATIVE EAX.exe	127
PID 4752 wrote to memory of 5072	4752	CREATIVE EAX.exe	128
PID 6104 wrote to memory of 6024	6104	CREATIVE EAX.exe	129
PID 6104 wrote to memory of 5044	6104	CREATIVE EAX.exe	130
PID 6024 wrote to memory of 4864	6024	CREATIVE EAX.exe	131
PID 6024 wrote to memory of 1144	6024	CREATIVE EAX.exe	132
PID 4864 wrote to memory of 4568	4864	CREATIVE EAX.exe	133
PID 4864 wrote to memory of 5384	4864	CREATIVE EAX.exe	134
PID 4568 wrote to memory of 5940	4568	CREATIVE EAX.exe	135
PID 4568 wrote to memory of 3008	4568	CREATIVE EAX.exe	136
PID 5940 wrote to memory of 4948	5940	CREATIVE EAX.exe	137
PID 5940 wrote to memory of 3164	5940	CREATIVE EAX.exe	138
PID 4948 wrote to memory of 5928	4948	CREATIVE EAX.exe	139
PID 4948 wrote to memory of 5448	4948	CREATIVE EAX.exe	140
PID 5928 wrote to memory of 1100	5928	CREATIVE EAX.exe	142
PID 5928 wrote to memory of 2268	5928	CREATIVE EAX.exe	143
PID 1100 wrote to memory of 3284	1100	CREATIVE EAX.exe	144
PID 1100 wrote to memory of 1500	1100	CREATIVE EAX.exe	145
PID 3284 wrote to memory of 5368	3284	CREATIVE EAX.exe	146
PID 3284 wrote to memory of 4972	3284	CREATIVE EAX.exe	147
PID 5368 wrote to memory of 1644	5368	CREATIVE EAX.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
  "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
    "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
      "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:468
    - - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        33⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        34⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        35⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        36⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        37⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        38⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        39⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        40⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        41⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        42⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        43⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        44⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        45⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        46⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        47⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        48⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        49⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        50⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        51⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        52⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        53⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        54⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        55⤵
        
        PID:348
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        56⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        57⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        58⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        59⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        60⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        61⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        62⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        63⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        64⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        65⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        66⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        67⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        68⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe"
        69⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        69⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        68⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        67⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        66⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        65⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        64⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        63⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        62⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        61⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        60⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        59⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        58⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        57⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        56⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        55⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        54⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        53⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        52⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        51⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        50⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        49⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        48⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        47⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        46⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        45⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        44⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        43⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        42⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        41⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        40⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        39⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        38⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        37⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        36⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        35⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        34⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        33⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        24⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5200
- - C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5264
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5428
- - C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:3096

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Admin\AppData\Roaming\MasonClient.exe
C:\Users\Admin\AppData\Roaming\MasonClient.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonClient.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonClient.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

CREATIVE EAX.exe

Path C:\Users\Admin\AppData\Local\Temp\CREATIVE EAX.exe
Size 632KB
SHA256 338bef4348c77f34db476ea973a1deaa627e7f9c53a40a60094ffa10d54e9ca7
MD5 3ff315c4f90baa778075aa75bfcd2e84
SHA1 aa494e6e9bae394d94e912b7101cd2659854e10d
SHA512 286e1bee7bee95622f40c7dc02c46640bbb93671b165ee732fa6067c379252d40bcc7d80869faa07d20f5fec52dd24a7c104d91cf00cd9c19503d93b32568146
SSDEEP 12288:BrP/i/u+x1+LXAIyQMEgnkuE6gxLheYrMNmp5H5EeBQdA6M66Bsorr/J0emMFZ0K:BjjFrA6MEgnkRHR/HMA6CFrc6
TLSH
T171D4238F0172A536C6CC4B7E1DB3E32113DB7754F7A2E4FD5284C2AAA5DE5028F92A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonClient.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
Size 50KB
SHA256 cebb353d9c3262a2cd0ba804227218eb2167daa8076477fa25764fd1525456e6
MD5 09ce419f30526ca52f752589c808be8f
SHA1 3d7f5ed624b7a8807b63c5f7bfb6a44a5f31697f
SHA512 f49c47a155cae73e00054d4980961fe80491a6d0edf979835c42561166f0e24f783b4709ace9335c5c3870959194a63e8f0ea5fcea89c2a910eae43d858358d3
SSDEEP 768:8KtEtw8AMOvl4Rw61CXiMWMbleKbHuN8hBOTsu:8y6ulM1iZdble8DOAu
TLSH
T13B33E74CFBE50129D5BE6AB16D73A20987B079935517C50FBCD402CB2B6BB884690EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp70A2.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp70A2.tmp.exe
Size 161KB
SHA256 fc18ac689568aea34f287e1ff20bfee7cfec3f3f626aab3d2c23a180969ae0a6
MD5 2672a80cf701037e262f1bb55c5202b5
SHA1 fe35a751182023ea77e876a327d5e47f1e02885b
SHA512 e1356770d6e23795170d855ae8cecfa29521a0dee86993e45c875f6cde2f0682d79a56d5ba6ad5b88817e886e21485e5755960a80bafd59d2bdd175ce845237a
SSDEEP 3072:QiG22Q1qS2U6A5nHpIT999Vyai8AXUtmDGZLCLCZnuY02eI0/90jkrTxrWqY:QojqSd6A5n6n9TCX+CugC50tz/90jkrV
TLSH
T185F3024956B96453D7F5C2732CFF7E004364A66F9B169BDF388CD86A6F16384221330A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpA8AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA8AB.tmp
Size 109KB
SHA256 fe74cb06318fd7451fed5ad5ce5605bb746bb5ef55da3fe96f52ba20e159db49
MD5 7ccccd0ddf864a061e175cf9e5114a46
SHA1 c0b798cd725d5f270f347790e2ad13dab60108e3
SHA512 8ad1bb6375e7f35e0dc41353d2e79499285cc401c412ea16fdbb123c3a53aef315186f594364a4f4156a58fa780c973bbc7e0202e6a1ed8380742b6c45058132
SSDEEP 192:jDWSMSBDWSMSBDWSMSBDWSMSBDWSMSBDWSMSBDWSMn:jDTDTDTDTDTDTDS
TLSH
T1A9B3C0678051249C540E892283FA1DB66CAB2FB07A7CF549AE37BCB553B32D36053E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3096-99-0x0000000000040000-0x000000000006E000-memory.dmp

Download

memory/3096-103-0x0000000005A00000-0x0000000005A92000-memory.dmp

Download

memory/4396-25-0x0000000000A00000-0x0000000000AA2000-memory.dmp

Download

memory/5264-26-0x0000000000C30000-0x0000000000C42000-memory.dmp

Download

memory/6056-0-0x0000000000D20000-0x0000000000DD8000-memory.dmp

Download

memory/6056-1-0x00000000014E0000-0x00000000014F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads