Analysis
- user interaction
yes - max time kernel
900s - max time network
893s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 23:17
General
- Target https://gofile.io/d/8apO30NG
- Sample261024-29sdpaex5k
Malware Config
Extracted
-
neptunerat
-
5.tcp.cpolar.cn:11548
-
filename
USB.exe
-
group
MasonGroup
-
key
ofpfIrgRHfAb7CTj
-
rat_name
MasonRAT
Extracted
-
xworm
-
5.0
-
fbv7eVrEAU497f1Y
-
install_file
USB.exe
-
localhost
127.0.0.1
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects NeptuneRAT stealer 5 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 15 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates video capture drivers 2 TTPs 4 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 4 IoCs
- Enumerates system info in registry 2 TTPs 14 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 14 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f0ffc4a0-66dc-4a3b-b696-9b8828656271}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-dd8d648e-72b8-44cc-b837-750ab70e3296 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-40b97291-a895-4826-8fdf-dca75aaa6420 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ba86f6db-a41f-4125-aaff-7be7a7b9fbbc -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b62cef42-74a0-442a-bc92-ad757fa1a2ba -LifetimeId:8593acb3-b486-4204-898b-2be7a412d783 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x474 0x2f42⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/8apO30NG2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff896b0c728,0x7ff896b0c734,0x7ff896b0c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,11850415819405378306,14368727312671292840,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1708 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,8627987068962813003,11892251374317981833,262144 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2184 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,12121418053508910338,6037321129225830557,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2560 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,9148556947168318791,13114271880716895275,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3176 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,17426734481777091829,7493786784983595679,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3232 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,11978654777766442018,11954579622442805931,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4232 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,9885787511666806543,7964565598798762611,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5340 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,7951930088222824790,16845083346298517194,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5812 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,12599075795131058856,9799200921501634343,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5820 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,14758400811845046880,9134914973492099521,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,8313830204745200042,15490575965424064042,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5944,i,2001626701037406104,16625604526338671358,262144 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6108 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6056,i,6208924717002506893,10455422397788813348,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6060,i,6643134367806869075,3349355094776397197,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4336 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5940,i,1866227966045685764,14366787108185667093,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6016 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6056,i,1220191157042602622,1398290770097459060,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6432,i,16393744328246793500,11120443177102987394,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6256 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4352,i,6414707347360950082,16539165847622892233,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6576 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,11547185695520621134,4505656038958633697,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6596 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6888,i,10926954806213068098,10432060183402011014,2097152 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6724 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6968,i,6384185705718106495,11692409890553492021,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6788 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6660,i,12970791773015200430,9077228084878860096,524288 --field-trial-handle=2168,i,17626026541337555586,1374916721366631274,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:83⤵
-
-
-
C:\Users\Admin\Downloads\Chlinet.exe"C:\Users\Admin\Downloads\Chlinet.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpEE72.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEE72.tmp.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "tmpEE72.tmp"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF966.tmp.bat""4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Downloads\Chlinet.exe"C:\Users\Admin\Downloads\Chlinet.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE6AD.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE6AD.tmp.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEF48.tmp.bat""5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html5⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff876b4c188,0x7ff876b4c194,0x7ff876b4c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7200720047592987799,18441645896074145953,524288 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,1955161633776402326,8253737623476162079,262144 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,17353499329046000196,16747118120882959625,524288 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3487767951944042742,7777295559713686471,2097152 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,7003073106098396674,16484341170566021591,2097152 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,7270649761044355940,10166541347058320330,524288 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,16016084016459474263,4906034300192690794,524288 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,7673225334975600328,8231520125158208404,524288 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,7673225334975600328,8231520125158208404,524288 --field-trial-handle=2320,i,3388702496332668384,8365504808880965541,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window6⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x280,0x7ff876b4c188,0x7ff876b4c194,0x7ff876b4c1a07⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,9697340050726807174,13926535430990394761,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,5981140751019822092,7510136186793708499,262144 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,7213840019068177855,14425491033812876604,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,18196278349545388147,16279505966460850183,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,18196278349545388147,16279505966460850183,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,11039878619129220154,18259060243170055665,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,5043572001032888263,7383784956936147042,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,12760548935092659697,9165933124454943423,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2736,i,6455835954731871084,11724645412798407389,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,10543466689655700251,7471821392302920560,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,2850362264591388069,17057614696173158465,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,14416294460422049734,5903711524274740387,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4804,i,13772431555543579548,9195207082599535222,262144 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,3405146695294725883,13183698066401879178,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,782332844457664317,2560770484770316386,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,1668086547895714177,274605708613163998,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,724365432518055576,10527611220025703013,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,9571477039660534852,10316500459743701972,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4072,i,5826868199058794788,15016378419912706553,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,7871995772846431496,6651901563746625677,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,10547454032673267860,9248344916263817341,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,15547090195014018838,13342600493748742540,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3024,i,5156987716335403366,5909449639209491304,524288 --field-trial-handle=2296,i,2368604154439598433,12147137836699637881,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:87⤵
-
-
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "Chlinet"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF800.tmp.bat""4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\XWorm V5.6.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\XWorm V5.6\Xworm V5.6.exe"C:\Users\Admin\Desktop\XWorm V5.6\Xworm V5.6.exe"2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\va3mnk0x\va3mnk0x.cmdline"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6A5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B02693489A14D17BE33A962C02CBB5F.TMP"4⤵
-
-
-
-
C:\Users\Admin\Desktop\XClient.exe"C:\Users\Admin\Desktop\XClient.exe"2⤵
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCE3F.tmp.bat""3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
-
C:\Users\Admin\AppData\Roaming\tmpEE72.tmp.exeC:\Users\Admin\AppData\Roaming\tmpEE72.tmp.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Program Files directory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks processor information in registry
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Process Hollowing
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Modify Registry
3Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
$I0QY04Q.ENC
LICENSE
verified_contents.json
widevinecdm.dll
widevinecdm.dll.sig
mini-wallet.html
miniwallet.bundle.js
notification.bundle.js
notification.html
notification_fast.bundle.js
notification_fast.html
tokenized-card.bundle.js
tokenized-card.html
wallet-buynow.bundle.js
wallet-buynow.html
app-setup.js
load-ec-deps.bundle.js
load-ec-i18n.bundle.js
wallet-drawer.bundle.js
wallet-drawer.bundle.js.LICENSE.txt
wallet-drawer.html
app-setup.js
bnpl.bundle.js
bnpl.bundle.js.LICENSE.txt
bnpl.html
bnpl_driver.js
buynow_driver.js
crypto.bundle.js
driver-signature.txt
edge_driver.js
hub-signature.txt
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
strings.json
README.md
super_coupon.json
wallet-checkout-eligible-sites-pre-stable.json
wallet-checkout-eligible-sites.json
checkoutdata.json
merchant-site-info.json
wallet-eligibile-aad-users.json
wallet-notification-config.json
wallet-pre-stable.json
wallet-stable.json
wallet-tokenization-config.json
load-hub-i18n.bundle.js
manifest.webapp.json
runtime.bundle.js
shopping_iframe_driver.js
vendor.bundle.js
vendor.bundle.js.LICENSE.txt
wallet-crypto.html
wallet-icon.svg
wallet-webui-101.079f5d74a18127cd9d6a.chunk.js
wallet-webui-227.bb2c3c84778e2589775f.chunk.js
wallet-webui-560.da6c8914bf5007e1044c.chunk.js
wallet-webui-708.de49febeeb0e9c77883f.chunk.js
wallet-webui-792.b1180305c186d50631a2.chunk.js
wallet-webui-925.baa79171a74ad52b0a67.chunk.js
wallet-webui-992.268aa821c3090dce03cb.chunk.js
wallet.bundle.js
wallet.html
wallet_checkout_autofill_driver.js
wallet_donation_driver.js
webui-setup.js
crs.pb
ct_config.pb
kp_pinslist.pb
deny_domains.list
deny_etld1_domains.list
deny_full_domains.list
well_known_domains.dll
data.txt
LICENSE
verified_contents.json
keys.json
manifest.json
typosquatting_list.pb
crl-set
83aeb2b2-ea0e-4c0c-ba8c-c41ab38c2541
d4401c65-16b1-436e-ae36-686ce16bc020
d8bc79ed-7b00-4175-8174-322a384a3a9b
49198cc3-cb53-4dcb-b5d3-1deb7114a0bd
7fa7df68-fd68-4cb3-bbae-b46629c3c610
e8a689a0-0b22-414f-9b05-ec38c305c524
5087cff5-02d3-45cf-aeeb-a5ea284d97f8
84054a2b-5194-451c-b260-e565d4e617d0
57fffe7b-0d39-4149-8806-5fc097ff7b64
75d471f0-8e88-4b8b-a228-903ed53a7de8.tmp
77234797-c694-4ad8-a272-85ad98f132f7.tmp
930a1b3b-836b-4709-b7a1-8bdb63954437.tmp
0cc6b130-b170-4f7b-9e72-07a10879cd4e.tmp
2e859bfe-fc27-4e7f-bf89-15515f869503.tmp
41562232-eeef-4364-998e-9b0a49e14ac7.tmp
7634f110-bd18-478d-ab57-5c9356a24d5f.tmp
84fcbc95-7e59-42ed-9c48-46a112101d18.tmp
9931e3dc-220b-48c3-a764-d503daf8b472.tmp
f_000011
f_000021
f_00003e
f_000040
f_000044
f_000046
temp-index
temp-index
MANIFEST-000001
26ec3553-25ba-4841-8fc2-795ea8f48914.tmp
4c3604e9-0204-48cb-8a14-d56ab884cdd0.tmp
9b9dcbb6-cf73-4ea2-906c-5178e84c93e8.tmp
b0eb8c94-f32d-403a-a918-2b8886b4522e.tmp
bc430834-28c6-4d6f-914f-7800579f4e10.tmp
d5f398fd-da1a-4c29-8743-cbbd1563828d.tmp
dd3fead4-bcdf-4200-9a35-e87544f70dda.tmp
Preferences
temp-index
the-real-index
3522c36f05df2bcd_0
temp-index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
CURRENT
0
c85d8007-90fe-4817-b526-28a68efc5916.tmp
d04e6db6-4adf-4653-9d3c-be5bba38e35a.tmp
d2bc5df2-27cb-4aea-982f-1936776dfdbc.tmp
f76f95fc-f861-4890-b7c7-32cc6449aa53.tmp
da3b84a0-501e-470e-bcfe-cd82fd7344a4.tmp
eeea2051-5b14-441b-ab57-52e4d4e78e66.tmp
f4f9765c-13ff-4735-9cf5-a6cda41b0493.tmp
Chlinet.exe.log
0209b72a-f1f1-4dda-bfec-6d234d271e89.tmp
02e84409-dc9f-42c2-8d41-a2a0c67bad74.tmp
1167bcb7-853f-4fd6-97cc-8bdfac438ba0.tmp
468710b4-7175-4cb5-953e-d3a3c425cad6.tmp
59563bf0-fbe7-46bc-8135-a377c25306ae.tmp
87bb7553-e7d3-4b3e-a6b7-fbff484fe4da.tmp
manifest.json
settings.dat
settings.dat
settings.dat
220f6002-01cd-49bb-86d8-2b4442f289d5.tmp
285e29cd-873a-45f8-8bbd-7fd235b7e4c2.tmp
3810420b-288d-4919-a90c-1594c10ae508.tmp
4b088590-3ff3-4027-9b8d-0e0237f787df.tmp
4ef3b291-8fa2-446e-bf59-cd6abbbdeff7.tmp
8550dcd4-0ebb-465a-9b94-d9a550ed7f0e.tmp
LOG.old
LOG.old
data_1
2b9332a5-7061-4805-8179-8c7e7d340c31.tmp
LOG
dasherSettingSchema.json
History
LOG
2b912fe4-fbc0-4468-9859-db304d95c0db.tmp
660e69b7-9d04-43c3-ad44-26f4deaa9088.tmp
95ebe0fe-544a-4922-9528-f92db6c3d60f.tmp
LOG
LOG
LOG
sync_diagnostic.log
bafc0eea-802b-4802-8501-baffeea1762d.tmp
default_cloud_config.json
000003.log
LOG
000003.log
LOG
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
strings.json
manifest.json
data_1
Last Version
Local State
manifest.json
data_1
manifest.json
Variations
manifest.json
manifest.json
manifest.json
0b512239-d301-4569-b20a-8c1b683782a9.tmp
28693cf0-1e0d-4b50-a6db-31e535c4366e.tmp
42eb7e81-77c6-46a0-ac80-623b4b07137f.tmp
484190f2-74a0-459e-8867-ff1c63112a51.tmp
64db5ba0-9ef5-4924-82d9-626f01d8cd1a.tmp
a61739da-a88c-48df-bde7-8e55640aa109.tmp
bd856e1a-ac9a-4b5c-8ec3-4fbc24cf660e.tmp
c9daf8ed-662f-4747-b15a-4167c99f2d68.tmp
f6db6db7-49dc-418b-8def-8220ba1b780f.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
d0bc4cdb-5d43-414a-80ee-50fca3dc8399.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
thumbcache_idx.db
thumbcache_idx.db
icon (14).ico
ENC.img
MasonRootkit.exe
messages.json
tmpE6AD.tmp.exe
tmpEE72.tmp.exe
tmpEF48.tmp.bat
f01b4d95cf55d32a.automaticDestinations-ms
CachedImage_1920_1080_POS4.jpg
TranscodedWallpaper
How To Decrypt My Files.html
ApproveUnregister.tiff.ENC
Unconfirmed 772361.crdownload
ae4adc6d-054b-4612-8ddc-c2f5218027cf.tmp
NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.ENC
Schedule Maintenance Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
Schedule Work
Scheduled Start
77EC63BDA74BD0D0E0426DC8F8008506
FB0D848F74F70BB2EAA93746D24D9749
memory/408-292-0x0000018ADF250000-0x0000018ADF40B000-memory.dmp
memory/408-296-0x0000018ADF250000-0x0000018ADF40B000-memory.dmp
memory/408-297-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/408-295-0x0000018ADF250000-0x0000018ADF40B000-memory.dmp
memory/408-294-0x0000018ADF250000-0x0000018ADF40B000-memory.dmp
memory/408-293-0x0000018ADF250000-0x0000018ADF40B000-memory.dmp
memory/584-279-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/584-277-0x0000025ADA210000-0x0000025ADA3CB000-memory.dmp
memory/584-274-0x0000025ADA210000-0x0000025ADA3CB000-memory.dmp
memory/584-273-0x0000025AD8650000-0x0000025AD878E000-memory.dmp
memory/584-275-0x0000025ADA210000-0x0000025ADA3CB000-memory.dmp
memory/584-276-0x0000025ADA210000-0x0000025ADA3CB000-memory.dmp
memory/584-278-0x0000025ADA210000-0x0000025ADA3CB000-memory.dmp
memory/664-287-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/664-285-0x0000020B48A00000-0x0000020B48BBB000-memory.dmp
memory/664-284-0x0000020B48A00000-0x0000020B48BBB000-memory.dmp
memory/664-286-0x0000020B48A00000-0x0000020B48BBB000-memory.dmp
memory/664-283-0x0000020B48A00000-0x0000020B48BBB000-memory.dmp
memory/664-282-0x0000020B48A00000-0x0000020B48BBB000-memory.dmp
memory/872-314-0x00000217AD860000-0x00000217ADA1B000-memory.dmp
memory/872-318-0x00000217AD860000-0x00000217ADA1B000-memory.dmp
memory/872-320-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/872-317-0x00000217AD860000-0x00000217ADA1B000-memory.dmp
memory/872-316-0x00000217AD860000-0x00000217ADA1B000-memory.dmp
memory/872-315-0x00000217AD860000-0x00000217ADA1B000-memory.dmp
memory/1008-326-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/1008-325-0x00000212B0210000-0x00000212B03CB000-memory.dmp
memory/1008-324-0x00000212B0210000-0x00000212B03CB000-memory.dmp
memory/1008-323-0x00000212B0210000-0x00000212B03CB000-memory.dmp
memory/1008-322-0x00000212B0210000-0x00000212B03CB000-memory.dmp
memory/1008-319-0x00000212B0210000-0x00000212B03CB000-memory.dmp
memory/1032-331-0x000002C1D9940000-0x000002C1D9AFB000-memory.dmp
memory/1032-329-0x000002C1D9940000-0x000002C1D9AFB000-memory.dmp
memory/1032-333-0x000002C1D9940000-0x000002C1D9AFB000-memory.dmp
memory/1032-335-0x000002C1D9940000-0x000002C1D9AFB000-memory.dmp
memory/1032-339-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/1032-337-0x000002C1D9940000-0x000002C1D9AFB000-memory.dmp
memory/1116-330-0x0000029347880000-0x0000029347A3B000-memory.dmp
memory/1116-338-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/1116-328-0x0000029347880000-0x0000029347A3B000-memory.dmp
memory/1116-332-0x0000029347880000-0x0000029347A3B000-memory.dmp
memory/1116-334-0x0000029347880000-0x0000029347A3B000-memory.dmp
memory/1116-336-0x0000029347880000-0x0000029347A3B000-memory.dmp
memory/1132-344-0x000001708FC80000-0x000001708FE3B000-memory.dmp
memory/1132-345-0x000001708FC80000-0x000001708FE3B000-memory.dmp
memory/1132-347-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/1132-341-0x000001708FC80000-0x000001708FE3B000-memory.dmp
memory/1132-342-0x000001708FC80000-0x000001708FE3B000-memory.dmp
memory/1132-346-0x000001708FC80000-0x000001708FE3B000-memory.dmp
memory/1248-349-0x0000017F7F340000-0x0000017F7F4FB000-memory.dmp
memory/1248-352-0x0000017F7F340000-0x0000017F7F4FB000-memory.dmp
memory/1248-351-0x0000017F7F340000-0x0000017F7F4FB000-memory.dmp
memory/1248-350-0x0000017F7F340000-0x0000017F7F4FB000-memory.dmp
memory/1248-356-0x00007FF865EF0000-0x00007FF865F00000-memory.dmp
memory/1248-355-0x0000017F7F340000-0x0000017F7F4FB000-memory.dmp
memory/1264-353-0x0000022FC7880000-0x0000022FC7A3B000-memory.dmp
memory/1264-354-0x0000022FC7880000-0x0000022FC7A3B000-memory.dmp
memory/1848-3287-0x0000021BBDA00000-0x0000021BBDA2C000-memory.dmp
memory/1848-3286-0x0000021BBDA90000-0x0000021BBDB12000-memory.dmp
memory/1848-2991-0x0000021B9F480000-0x0000021BA0368000-memory.dmp
memory/1848-3288-0x0000021BC4010000-0x0000021BC42F2000-memory.dmp
memory/1848-3289-0x0000021BBDF00000-0x0000021BBDFB2000-memory.dmp
memory/1848-3192-0x0000021BBDC60000-0x0000021BBDDC8000-memory.dmp
memory/1848-3014-0x0000021BBC2C0000-0x0000021BBC4B4000-memory.dmp
memory/2364-142-0x00000000004D0000-0x00000000004E2000-memory.dmp
memory/2364-177-0x000000001C7F0000-0x000000001C976000-memory.dmp
memory/2364-173-0x0000000002840000-0x0000000002850000-memory.dmp
memory/2364-143-0x0000000002840000-0x0000000002850000-memory.dmp
memory/3492-3255-0x0000000000300000-0x000000000030E000-memory.dmp
memory/3492-3290-0x0000000000930000-0x000000000093C000-memory.dmp
memory/3992-246-0x0000000000580000-0x000000000061C000-memory.dmp
memory/4592-875-0x000000001C190000-0x000000001C19C000-memory.dmp
memory/4592-211-0x000000001CDE0000-0x000000001CE6E000-memory.dmp
memory/4592-3428-0x0000000001530000-0x000000000153A000-memory.dmp
memory/4592-233-0x000000001BA30000-0x000000001BA3A000-memory.dmp
memory/4592-234-0x000000001C6A0000-0x000000001C6B2000-memory.dmp
memory/5268-269-0x00007FF8A3EC0000-0x00007FF8A3F7E000-memory.dmp
memory/5268-267-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/5268-265-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/5268-268-0x00007FF8A5E70000-0x00007FF8A6065000-memory.dmp
memory/5268-270-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/5536-263-0x00007FF8A3EC0000-0x00007FF8A3F7E000-memory.dmp
memory/5536-260-0x0000016F26A80000-0x0000016F26B1A000-memory.dmp
memory/5536-262-0x00007FF8A5E70000-0x00007FF8A6065000-memory.dmp
memory/6124-171-0x00000000000F0000-0x0000000000102000-memory.dmp