donutloader | a024469323384385df48349bb7da1ae3aa98db967543ccbb531c27b4580601a8

Analysis

max time kernel
11s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/02/2026, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 1.6MB
Sample260210-q3qqqsfy2c
SHA256 a024469323384385df48349bb7da1ae3aa98db967543ccbb531c27b4580601a8
MD5 3e00e682ce7fc9d845bbae841f1d2098
SHA1 a18defba6145e455166aeef8cb1f4080a3b81082
SHA512 a379f00e9740f40067fccb939d318ba40b18cbe12b3bc0944535c2f2b4c724461376d35b9e6ea99df1f11934ac72dc8c2310af5c093e7903e004931fea17bb7c
SSDEEP 24576:0FC/XtZSQ3mDvtL7gwuloLQuHDacVvk9Sgl8Rz:0FaTFylhjactTgl8F
TLSH
T12675492439FB501AB273EFA64BE479EADA6FB6333B076469105103864723E41DDC163E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution donutloader xworm loader persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

Turkialenzi-42249.portmap.host:42249

Mutex

HhNVZeuQ8poLfVMW

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/612-56-0x000000001B3E0000-0x000000001B3EE000-memory.dmp	family_xworm

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/612-51-0x0000000002820000-0x0000000002830000-memory.dmp	family_donutloader

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 516 created 616	516	MasonRootkit.exe	5

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	MasonKit.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	MasonLoader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	MasonLoader.exe

Executes dropped EXE 5 IoCs

pid	Process
4924	MasonKit.exe
612	MasonLoader.exe
516	MasonRootkit.exe
760	Loader.exe
4364	MasonLoader.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\MasonLoader	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 516 set thread context of 4296	516	MasonRootkit.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5996	timeout.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5896	schtasks.exe
3828	schtasks.exe
5344	schtasks.exe
1440	schtasks.exe
5316	schtasks.exe
6132	schtasks.exe
4620	schtasks.exe
4172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
516	MasonRootkit.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe
4296	dllhost.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5600	Loader.exe
Token: SeDebugPrivilege	516	MasonRootkit.exe
Token: SeDebugPrivilege	516	MasonRootkit.exe
Token: SeDebugPrivilege	4296	dllhost.exe
Token: SeDebugPrivilege	612	MasonLoader.exe
Token: SeDebugPrivilege	760	Loader.exe
Token: SeDebugPrivilege	4364	MasonLoader.exe
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeShutdownPrivilege	3312	Explorer.EXE
Token: SeCreatePagefilePrivilege	3312	Explorer.EXE
Token: SeAuditPrivilege	2844	svchost.exe
Token: SeShutdownPrivilege	4756	svchost.exe
Token: SeCreatePagefilePrivilege	4756	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5600 wrote to memory of 4620	5600	Loader.exe	86
PID 5600 wrote to memory of 4924	5600	Loader.exe	89
PID 5600 wrote to memory of 612	5600	Loader.exe	90
PID 612 wrote to memory of 4172	612	MasonLoader.exe	91
PID 4924 wrote to memory of 516	4924	MasonKit.exe	93
PID 4924 wrote to memory of 5756	4924	MasonKit.exe	94
PID 5756 wrote to memory of 5996	5756	cmd.exe	96
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 516 wrote to memory of 4296	516	MasonRootkit.exe	98
PID 760 wrote to memory of 5896	760	Loader.exe	100
PID 4296 wrote to memory of 616	4296	dllhost.exe	5
PID 4296 wrote to memory of 668	4296	dllhost.exe	7
PID 4296 wrote to memory of 872	4296	dllhost.exe	11
PID 4296 wrote to memory of 1004	4296	dllhost.exe	13
PID 4296 wrote to memory of 440	4296	dllhost.exe	14
PID 4296 wrote to memory of 868	4296	dllhost.exe	15
PID 4364 wrote to memory of 3828	4364	MasonLoader.exe	104
PID 4296 wrote to memory of 1088	4296	dllhost.exe	17
PID 4296 wrote to memory of 1176	4296	dllhost.exe	18
PID 4296 wrote to memory of 1184	4296	dllhost.exe	19
PID 4296 wrote to memory of 1208	4296	dllhost.exe	20
PID 4296 wrote to memory of 1236	4296	dllhost.exe	21
PID 4296 wrote to memory of 1292	4296	dllhost.exe	22
PID 4296 wrote to memory of 1324	4296	dllhost.exe	23
PID 4296 wrote to memory of 1332	4296	dllhost.exe	24
PID 4296 wrote to memory of 1468	4296	dllhost.exe	25
PID 4296 wrote to memory of 1476	4296	dllhost.exe	26
PID 4296 wrote to memory of 1512	4296	dllhost.exe	27
PID 4296 wrote to memory of 1688	4296	dllhost.exe	28
PID 4296 wrote to memory of 1700	4296	dllhost.exe	29
PID 4296 wrote to memory of 1808	4296	dllhost.exe	30
PID 4296 wrote to memory of 1864	4296	dllhost.exe	31
PID 4296 wrote to memory of 1900	4296	dllhost.exe	32
PID 4296 wrote to memory of 1916	4296	dllhost.exe	33
PID 4296 wrote to memory of 2012	4296	dllhost.exe	34
PID 4296 wrote to memory of 1724	4296	dllhost.exe	35
PID 4296 wrote to memory of 1708	4296	dllhost.exe	36
PID 4296 wrote to memory of 2092	4296	dllhost.exe	37
PID 4296 wrote to memory of 2100	4296	dllhost.exe	38
PID 4296 wrote to memory of 2164	4296	dllhost.exe	39
PID 4296 wrote to memory of 2220	4296	dllhost.exe	40
PID 4296 wrote to memory of 2344	4296	dllhost.exe	42
PID 4296 wrote to memory of 2440	4296	dllhost.exe	43
PID 4296 wrote to memory of 2644	4296	dllhost.exe	44
PID 4296 wrote to memory of 2652	4296	dllhost.exe	45
PID 4296 wrote to memory of 2800	4296	dllhost.exe	46
PID 4296 wrote to memory of 2844	4296	dllhost.exe	47
PID 4296 wrote to memory of 2856	4296	dllhost.exe	48
PID 4296 wrote to memory of 2864	4296	dllhost.exe	49
PID 4296 wrote to memory of 2880	4296	dllhost.exe	50
PID 4296 wrote to memory of 2948	4296	dllhost.exe	51
PID 4296 wrote to memory of 2828	4296	dllhost.exe	53
PID 4296 wrote to memory of 3120	4296	dllhost.exe	54
PID 4296 wrote to memory of 3284	4296	dllhost.exe	55
PID 4296 wrote to memory of 3312	4296	dllhost.exe	56
PID 4296 wrote to memory of 3476	4296	dllhost.exe	57
PID 4296 wrote to memory of 3656	4296	dllhost.exe	58

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:440
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c6a0fc76-9b49-44fc-b565-584b05bd41b0}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4296

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6352a43f-0edc-4a39-9bd2-c299f0c1b3a3 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-21684148-de14-4f09-8bd1-2097da45253b -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e3e52cd8-fc83-456c-a12f-b7a4eb807e34 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0e7b1260-321d-492d-accb-2d2838f3e5b9 -LifetimeId:d19dd8f4-9773-483a-ac8b-91c08dd0149c -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1176
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Roaming\Loader.exe
  C:\Users\Admin\AppData\Roaming\Loader.exe
  2⤵
  PID:5296
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1440
- C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  2⤵
  PID:2080
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5344
- C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  C:\Users\Admin\AppData\Roaming\MasonLoader.exe
  2⤵
  PID:3308
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5316
- C:\Users\Admin\AppData\Roaming\Loader.exe
  C:\Users\Admin\AppData\Roaming\Loader.exe
  2⤵
  PID:1056
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1512
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2164

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3284

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3312
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
    "C:\Users\Admin\AppData\Local\Temp\MasonKit.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
      "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDB2D.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5756
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:984
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:5996
- - C:\Users\Admin\AppData\Roaming\MasonLoader.exe
    "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3476

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3656

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4796

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:5528

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3384

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4944

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6068

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1976

C:\Users\Admin\AppData\Roaming\Loader.exe
C:\Users\Admin\AppData\Roaming\Loader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "Loader" /tr "C:\Users\Admin\AppData\Roaming\Loader.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5896

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2924

C:\Users\Admin\AppData\Roaming\MasonLoader.exe
C:\Users\Admin\AppData\Roaming\MasonLoader.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonLoader" /tr "C:\Users\Admin\AppData\Roaming\MasonLoader.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3828

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:5312

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 7fa57c21c9d3c33c8f33f2b4773252ba w2RPZg2vZ0WZ9/VZBXg27w.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2580
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Windows\system32\UsoClient.exe
C:\Windows\system32\usoclient.exe
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 baa5527ac0732f2a3b024907c774a74084fbb86feffbcf87e8e2a7bbf4b9fc75
MD5 c033fb0c4ef3589a1ffb7b186d21b540
SHA1 19611891f5f2ff90aab93a1ffe13bd0b19489451
SHA512 26cbac33e1b05f95071003d9d1f9c370f348be68ecda8e829e3151368efaa0ec1fbd389b53eab4847afc42f71adbf9fc5fbce0eb117f279278464f92b9acfdf7
TLSH
T1E8E020355DFD126CF1A6E478CBC56052D579F1011D7483BD10C0470AA643A405C72D32
MD5 SHA1 SHA512 TLSH

Submit Download

Loader.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader.exe.log
Size 226B
SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
MD5 28d7fcc2b910da5e67ebb99451a5f598
SHA1 a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA512 2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6
TLSH
T1C5D023603795D1C549577F54181D2A4881FF0255B1109D14749572DEDD345671F311E7
MD5 SHA1 SHA512 TLSH

Submit Download

MasonKit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
Size 595KB
SHA256 7596f8d9c6fca490a5d657b994c0399ce5197e41102c66fe296408f5b37bf3f1
MD5 75c6f68abba95ddfd287f61b827e2711
SHA1 5dbd72d6e361b6af2e89b2aa49d3b64bd81d71a1
SHA512 103c3d754f26c059876a7c835b7bb69401d38a7b42cde7878a25cf5f127a77657b00d9d03d3eecbc08237c79d497785b69fd31560127dd37758dbe32d77b2e11
SSDEEP 12288:fWVkPQzRl9YrTK0zqIDlEUHlJd8+zvw5pMN7H1xpxnlRGakrE9d0D:eVOQj+dWID+yG+zIzy7VxflRGa+Ci
TLSH
T1E7D423BC22F8F19DD54DC9393BF7025A4221F52F5810A36227A459CD2EF382D8D8DE65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 592KB
SHA256 8de8fd340cd8057899781e8796f36543092cdfa9028958102bd5fec9f2070447
MD5 ae78843b23f7a1c65f6b9a5a031f1950
SHA1 a12aad340d3eafb919d6cf38fad402f29b570ed0
SHA512 648e6f7eeadf9d1ab2ba36311259a20f5b55c16a04a271fe7e7f3ee166e626aea6c6d97e9e5b4f8c9d1d997ab1444bcd1ff5dfa61bd9f1b988c58e30d40dc3b5
SSDEEP 12288:jK6oSHxX1Yrpx/bdEU5lRM+QAYw5p2r7H1xMolRUQErVD7ATfuXLF4:jzoyWr/b2+DM+QA5zM7VxjlRUQeVDUr8
TLSH
T175D423691391F0AFE1D9953F3667030689305628AE83EBFA13ED48A67FF74D7094C684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpDB2D.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpDB2D.tmp.bat
Size 160B
SHA256 24e3cc48170037f0672b3a28b99a70d188a5269d8f26d736d47472a7f5669161
MD5 5c4e7cc6ea662ae9b3b3c1e8d47a1c2d
SHA1 dfc20d912e7e56fdf0a04090281afc8563d8e31f
SHA512 4ec2a9ef84996c16959926fb5b4e84bd68e3df4435f3d5b64f601e370aa65d547d4208b16bfe96d9537212c6a65dc8361450da53482d0adcdefa8f1940083da4
TLSH
T17EC08C4114CAFB1A2A8A241711B6C08EC1625C0A2E406F509398800C6A805ACE4B4349
MD5 SHA1 SHA512 TLSH

Submit Download

MasonLoader.exe

Path C:\Users\Admin\AppData\Roaming\MasonLoader.exe
Size 1.6MB
SHA256 a024469323384385df48349bb7da1ae3aa98db967543ccbb531c27b4580601a8
MD5 3e00e682ce7fc9d845bbae841f1d2098
SHA1 a18defba6145e455166aeef8cb1f4080a3b81082
SHA512 a379f00e9740f40067fccb939d318ba40b18cbe12b3bc0944535c2f2b4c724461376d35b9e6ea99df1f11934ac72dc8c2310af5c093e7903e004931fea17bb7c
SSDEEP 24576:0FC/XtZSQ3mDvtL7gwuloLQuHDacVvk9Sgl8Rz:0FaTFylhjactTgl8F
TLSH
T12675492439FB501AB273EFA64BE479EADA6FB6333B076469105103864723E41DDC163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
MD5 8abf2d6067c6f3191a015f84aa9b6efe
SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
TLSH
T1A451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
MD5 f313c5b4f95605026428425586317353
SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
TLSH
T1D451465367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
TLSH
T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
TLSH
T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
MD5 1e8e2076314d54dd72e7ee09ff8a52ab
SHA1 5fd0a67671430f66237f483eef39ff599b892272
SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
TLSH
T1CD51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
TLSH
T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-81-0x0000015F21670000-0x0000015F2182B000-memory.dmp

Download

memory/440-86-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/440-83-0x0000015F21670000-0x0000015F2182B000-memory.dmp

Download

memory/440-84-0x0000015F21670000-0x0000015F2182B000-memory.dmp

Download

memory/440-82-0x0000015F21670000-0x0000015F2182B000-memory.dmp

Download

memory/440-85-0x0000015F21670000-0x0000015F2182B000-memory.dmp

Download

memory/516-39-0x00007FF89B090000-0x00007FF89B285000-memory.dmp

Download

memory/516-38-0x000002AA831B0000-0x000002AA8324A000-memory.dmp

Download

memory/516-43-0x00007FF89ACD0000-0x00007FF89AD8E000-memory.dmp

Download

memory/612-51-0x0000000002820000-0x0000000002830000-memory.dmp

Download

memory/612-56-0x000000001B3E0000-0x000000001B3EE000-memory.dmp

Download

memory/616-64-0x000002079E460000-0x000002079E61B000-memory.dmp

Download

memory/616-61-0x000002079E460000-0x000002079E61B000-memory.dmp

Download

memory/616-63-0x000002079E460000-0x000002079E61B000-memory.dmp

Download

memory/616-66-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/616-65-0x000002079E460000-0x000002079E61B000-memory.dmp

Download

memory/616-62-0x000002079E460000-0x000002079E61B000-memory.dmp

Download

memory/616-60-0x000002079C820000-0x000002079C95E000-memory.dmp

Download

memory/668-74-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/668-71-0x000001FAA9400000-0x000001FAA95BB000-memory.dmp

Download

memory/668-72-0x000001FAA9400000-0x000001FAA95BB000-memory.dmp

Download

memory/668-70-0x000001FAA9400000-0x000001FAA95BB000-memory.dmp

Download

memory/668-69-0x000001FAA9400000-0x000001FAA95BB000-memory.dmp

Download

memory/668-73-0x000001FAA9400000-0x000001FAA95BB000-memory.dmp

Download

memory/868-107-0x0000019AC3740000-0x0000019AC38FB000-memory.dmp

Download

memory/868-109-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/868-108-0x0000019AC3740000-0x0000019AC38FB000-memory.dmp

Download

memory/868-104-0x0000019AC3740000-0x0000019AC38FB000-memory.dmp

Download

memory/868-105-0x0000019AC3740000-0x0000019AC38FB000-memory.dmp

Download

memory/868-106-0x0000019AC3740000-0x0000019AC38FB000-memory.dmp

Download

memory/872-89-0x0000024BD8670000-0x0000024BD882B000-memory.dmp

Download

memory/872-90-0x0000024BD8670000-0x0000024BD882B000-memory.dmp

Download

memory/872-91-0x0000024BD8670000-0x0000024BD882B000-memory.dmp

Download

memory/872-93-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/872-92-0x0000024BD8670000-0x0000024BD882B000-memory.dmp

Download

memory/872-88-0x0000024BD8670000-0x0000024BD882B000-memory.dmp

Download

memory/1004-97-0x000002A842C40000-0x000002A842DFB000-memory.dmp

Download

memory/1004-99-0x000002A842C40000-0x000002A842DFB000-memory.dmp

Download

memory/1004-98-0x000002A842C40000-0x000002A842DFB000-memory.dmp

Download

memory/1004-96-0x000002A842C40000-0x000002A842DFB000-memory.dmp

Download

memory/1004-95-0x000002A842C40000-0x000002A842DFB000-memory.dmp

Download

memory/1004-100-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/1056-995-0x00000000009D0000-0x0000000000B74000-memory.dmp

Download

memory/1088-120-0x0000014ADE540000-0x0000014ADE6FB000-memory.dmp

Download

memory/1088-118-0x0000014ADE540000-0x0000014ADE6FB000-memory.dmp

Download

memory/1088-117-0x0000014ADE540000-0x0000014ADE6FB000-memory.dmp

Download

memory/1088-121-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/1088-116-0x0000014ADE540000-0x0000014ADE6FB000-memory.dmp

Download

memory/1088-119-0x0000014ADE540000-0x0000014ADE6FB000-memory.dmp

Download

memory/1176-124-0x000001C88D880000-0x000001C88DA3B000-memory.dmp

Download

memory/1176-128-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/1176-126-0x000001C88D880000-0x000001C88DA3B000-memory.dmp

Download

memory/1176-123-0x000001C88D880000-0x000001C88DA3B000-memory.dmp

Download

memory/1176-125-0x000001C88D880000-0x000001C88DA3B000-memory.dmp

Download

memory/1176-127-0x000001C88D880000-0x000001C88DA3B000-memory.dmp

Download

memory/1184-135-0x00007FF85B110000-0x00007FF85B120000-memory.dmp

Download

memory/1184-131-0x000001F712400000-0x000001F7125BB000-memory.dmp

Download

memory/1184-134-0x000001F712400000-0x000001F7125BB000-memory.dmp

Download

memory/1184-133-0x000001F712400000-0x000001F7125BB000-memory.dmp

Download

memory/1184-130-0x000001F712400000-0x000001F7125BB000-memory.dmp

Download

memory/1184-132-0x000001F712400000-0x000001F7125BB000-memory.dmp

Download

memory/4296-48-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4296-57-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4296-49-0x00007FF89B090000-0x00007FF89B285000-memory.dmp

Download

memory/4296-50-0x00007FF89ACD0000-0x00007FF89AD8E000-memory.dmp

Download

memory/4296-46-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4924-44-0x0000000001550000-0x000000000155C000-memory.dmp

Download

memory/4924-23-0x0000000000B20000-0x0000000000BBC000-memory.dmp

Download

memory/5296-871-0x0000000000B30000-0x0000000000CD4000-memory.dmp

Download

memory/5600-0-0x0000000000600000-0x00000000007A4000-memory.dmp

Download