3a947bfb5e6ab8692cae84fe769af4ce06f839fa6ba24c7e09654773561b6eb3

Analysis

user interaction
yes
max time kernel
140s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IttihadClient.exe
Size 63KB
Sample260808-ejectasyhy
SHA256 3a947bfb5e6ab8692cae84fe769af4ce06f839fa6ba24c7e09654773561b6eb3
MD5 302bce4f0e2cadd5f2bff47d4f912506
SHA1 abed30812e2d1e440a3091e7529bdda21104a2d0
SHA512 c9fb9a53e4c9434b82461c4b97907227f98bca0980dce5857d9318c30fe6af631d481b154d225da0120c5d8872a1c5ede02ab8f41dbb87b0cbb659594aa2002e
SSDEEP 1536:9BCicWHCGzhNqNPdPXktC2726qFAKcbQX0bUOf9pgmrx:9BCiiEhNqVuCC+AKcbQUrfgmrx
TLSH
T13D53180CA7BDB516F2FFDB7B54E13F20537D91532723C9CA9AD4029E36227C18622299
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery execution persistence spyware

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
5360	tzkieh.exe
5612	baneya.exe
5572	MasonMBR-SLEEP.exe
1064	MasonRootkit.exe
2000	MasonGDI.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
5976	powershell.exe
4124	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\MasonMBR	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4132	cmd.exe
6096	cmd.exe
2596	cmd.exe
4228	cmd.exe
4764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IttihadClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2340	timeout.exe
3312	timeout.exe
2252	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3288	schtasks.exe
4804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5976	powershell.exe
5976	powershell.exe
4648	IttihadClient.exe
4124	powershell.exe
4124	powershell.exe
4648	IttihadClient.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe
1064	MasonRootkit.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	IttihadClient.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	1064	MasonRootkit.exe
Token: 33	5648	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5648	AUDIODG.EXE
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe
Token: SeShutdownPrivilege	5164	explorer.exe
Token: SeCreatePagefilePrivilege	5164	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3112	Conhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1092	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4132	4648	IttihadClient.exe	91
PID 4132 wrote to memory of 5976	4132	cmd.exe	93
PID 4648 wrote to memory of 6096	4648	IttihadClient.exe	94
PID 6096 wrote to memory of 4124	6096	cmd.exe	96
PID 5976 wrote to memory of 5360	5976	powershell.exe	97
PID 4124 wrote to memory of 5612	4124	powershell.exe	98
PID 5360 wrote to memory of 5572	5360	tzkieh.exe	99
PID 5360 wrote to memory of 1064	5360	tzkieh.exe	100
PID 5360 wrote to memory of 2000	5360	tzkieh.exe	101
PID 1064 wrote to memory of 740	1064	MasonRootkit.exe	5
PID 1064 wrote to memory of 956	1064	MasonRootkit.exe	9
PID 1064 wrote to memory of 960	1064	MasonRootkit.exe	10
PID 1064 wrote to memory of 400	1064	MasonRootkit.exe	11
PID 1064 wrote to memory of 544	1064	MasonRootkit.exe	13
PID 1064 wrote to memory of 1092	1064	MasonRootkit.exe	14
PID 1064 wrote to memory of 1140	1064	MasonRootkit.exe	15
PID 1064 wrote to memory of 1220	1064	MasonRootkit.exe	16
PID 1064 wrote to memory of 1284	1064	MasonRootkit.exe	17
PID 1064 wrote to memory of 1316	1064	MasonRootkit.exe	18
PID 1064 wrote to memory of 1532	1064	MasonRootkit.exe	22
PID 1064 wrote to memory of 1604	1064	MasonRootkit.exe	23
PID 1064 wrote to memory of 1612	1064	MasonRootkit.exe	24
PID 1064 wrote to memory of 1656	1064	MasonRootkit.exe	25
PID 1064 wrote to memory of 1664	1064	MasonRootkit.exe	26
PID 1064 wrote to memory of 1788	1064	MasonRootkit.exe	27
PID 1064 wrote to memory of 1824	1064	MasonRootkit.exe	28
PID 1064 wrote to memory of 2036	1064	MasonRootkit.exe	29
PID 1064 wrote to memory of 1128	1064	MasonRootkit.exe	30
PID 1064 wrote to memory of 2020	1064	MasonRootkit.exe	31
PID 1064 wrote to memory of 2192	1064	MasonRootkit.exe	32
PID 1064 wrote to memory of 2200	1064	MasonRootkit.exe	33
PID 1064 wrote to memory of 2240	1064	MasonRootkit.exe	34
PID 1064 wrote to memory of 2344	1064	MasonRootkit.exe	35
PID 1064 wrote to memory of 2388	1064	MasonRootkit.exe	36
PID 1064 wrote to memory of 2424	1064	MasonRootkit.exe	37
PID 1064 wrote to memory of 2436	1064	MasonRootkit.exe	38
PID 1064 wrote to memory of 2584	1064	MasonRootkit.exe	39
PID 1064 wrote to memory of 2624	1064	MasonRootkit.exe	40
PID 1064 wrote to memory of 2760	1064	MasonRootkit.exe	41
PID 1064 wrote to memory of 2932	1064	MasonRootkit.exe	42
PID 1064 wrote to memory of 2984	1064	MasonRootkit.exe	43
PID 1064 wrote to memory of 3016	1064	MasonRootkit.exe	44
PID 1064 wrote to memory of 2312	1064	MasonRootkit.exe	45
PID 1064 wrote to memory of 3104	1064	MasonRootkit.exe	46
PID 1064 wrote to memory of 3236	1064	MasonRootkit.exe	48
PID 1064 wrote to memory of 3444	1064	MasonRootkit.exe	50
PID 1064 wrote to memory of 3536	1064	MasonRootkit.exe	51
PID 1064 wrote to memory of 3544	1064	MasonRootkit.exe	52
PID 5360 wrote to memory of 4804	5360	tzkieh.exe	102
PID 1064 wrote to memory of 3620	1064	MasonRootkit.exe	53
PID 1064 wrote to memory of 3636	1064	MasonRootkit.exe	54
PID 1064 wrote to memory of 3656	1064	MasonRootkit.exe	55
PID 1064 wrote to memory of 3680	1064	MasonRootkit.exe	56
PID 1064 wrote to memory of 2992	1064	MasonRootkit.exe	57
PID 1064 wrote to memory of 3520	1064	MasonRootkit.exe	58
PID 1064 wrote to memory of 4312	1064	MasonRootkit.exe	59
PID 1064 wrote to memory of 4360	1064	MasonRootkit.exe	60
PID 1064 wrote to memory of 4416	1064	MasonRootkit.exe	61
PID 1064 wrote to memory of 4624	1064	MasonRootkit.exe	62
PID 1064 wrote to memory of 4668	1064	MasonRootkit.exe	63
PID 1064 wrote to memory of 4952	1064	MasonRootkit.exe	64
PID 1064 wrote to memory of 2332	1064	MasonRootkit.exe	65
PID 1064 wrote to memory of 2172	1064	MasonRootkit.exe	66
PID 1064 wrote to memory of 5140	1064	MasonRootkit.exe	67

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:960
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1140

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:956

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-65e46e2f-d97b-4aba-bd12-5039a862264d -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2e775c51-ef1b-4a26-96b3-2b3b604b3b55 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bd76b950-fa00-4fdb-b5e1-2d861f90499c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8d44e8e1-1bd9-4ba8-b347-cd0a83065d09 -LifetimeId:64d18f86-e1d2-49ce-8166-b39dd32905fc -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Suspicious use of UnmapMainImage
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1824
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5052
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\IttihadClient.exe
      "C:\Users\Admin\AppData\Local\Temp\IttihadClient.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tzkieh.exe"' & exit
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4132
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tzkieh.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\tzkieh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tzkieh.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"
        8⤵
        Executes dropped EXE
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4804
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1A40.tmp.bat""
        8⤵
        Executes a command shell one-liner
        
        PID:2596
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:4488
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        9⤵
        Delays execution with timeout.exe
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\baneya.exe"' & exit
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6096
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\baneya.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\baneya.exe
        
        "C:\Users\Admin\AppData\Local\Temp\baneya.exe"
        7⤵
        Executes dropped EXE
        
        PID:5612
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3288
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1C34.tmp.bat""
        8⤵
        Executes a command shell one-liner
        
        PID:4228
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5316
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        9⤵
        Delays execution with timeout.exe
        
        PID:3312
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7D01.tmp.bat""
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4764
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2748
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:2344
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2388
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:2312

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3236

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3520

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4312

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4624

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4668

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2332

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:2172

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1480

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5100

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5900

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 78871a132ff037e4e423689f85b24872228fb1d9441d3b6bd6ea2294443bffa2
MD5 7c9ee805d18e3f003bca927395e56881
SHA1 bc99defb3e2453edca8c4c42471c4fdafdc922f4
SHA512 0267e9eee186f378c5145a781540eee49576e442c351baeb7926d355ccb826c1a9052f1706f87303f02cd380e1dc353c6b6273603676a197ef14790bc79537f8
SSDEEP 384:E1TB1GM51imGW14be/o1X+EC3lJPn5IAXz48+pWv+tzKwQvYbhNoi9:QTOMb4Wi8oN+VbRIAXzX+lVPbhND9
TLSH
T13C62A899616FADC7D89112B4109602E7FBA4E08CEF765198FE27CE3B1C90FBA5B60510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonMBR.exe
Size 93KB
SHA256 b7af0a09eac02f06abd483920e860d68d83b1cf4007edff6551b3f60fe990415
MD5 dd216fcf116773c6a8c8e91b29751a1d
SHA1 637ed4cf29c66c7e72c25c032c1f0dd3448c51e1
SHA512 b41c5ac2884aa0fe5928c7cadc24517daf41854c61a27157a2d7b77f1a8dd984d9d66ab46fa882ba6731cf50b1746886a87410a18cf7fb51919ee462f6725c39
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2owMiDXw:Tv5MYRIMPqiTJx+ZqreRQ5/hXojiDXw
TLSH
T1D3936B43B5D28CB2E5B21D3108B1CAA15A2FB9210F658E6B6794136E5F380D09E35FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1A40.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1A40.tmp.bat
Size 158B
SHA256 80c02f47115326a2a5d92bb5e94b580f0ffe26bf08f0f9d4600b94d2b378e55c
MD5 9e3ac1c9d66d8b5d0d951680e192307d
SHA1 7c99dbb4f07cb28087dc13a633f76fadae9cc2db
SHA512 5aa8c128203107ca81630057e24a00af979296a273ac7afec582a91acad4324c041777c0e16a7bbcef01764518ab1dd17b3959caf07d7847c6fd9b0d9e8b5b78
TLSH
T10FC08C4024CEFA1A2A0A242B02B6C88DD2666C0A3E807B2093988008398045CE8B9706
MD5 SHA1 SHA512 TLSH

Submit Download

tmp1C34.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1C34.tmp.bat
Size 158B
SHA256 7d18c8f3b8fc49bce61c81f7e3aba824558f8b1ea7f0142de7372a8f8dbe2b0d
MD5 1377ca988b881bb9a1d5f9acbff4a108
SHA1 a52dca2658b4c54777750d96966b49a662f15489
SHA512 9a8f450b53fbebf8276811df1f077ca099ef596697105e0400fb2fac877cf3a6f42c5c3c0a7d77e7f714bb9c0d514465199d48b1c07c2e5b6be61fd0bb63810c
TLSH
T193C08C0024CAFA9A1A0A241B01BAC08DC073AC0A2E40AF1093588408298449CF4B9305
MD5 SHA1 SHA512 TLSH

Submit Download

tmp7D01.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7D01.tmp.bat
Size 165B
SHA256 1a1b3d7de0f39a0c4f0f77ccfdbf8fb75f410b699d9165befaed2a6f8c675eb1
MD5 2d044b636ae026ad4a561da21e9e72e6
SHA1 99e331fb5353fb2e12c12eebb19d0b75ceb04c51
SHA512 4858efa2a33c6feb1675bdf0f50e5af301ad0ee44433612e6de5e7287bfdbd2826feb57fe802abba8c1553b8c5d8a7c5e502b078a2544168bd13dba20ab84c3c
TLSH
T1C6C08C002ACAFA1A190A241761B6C0DEE1B65C1E2E426B6093588108699046CE9B9706
MD5 SHA1 SHA512 TLSH

Submit Download

tzkieh.exe

Path C:\Users\Admin\AppData\Local\Temp\tzkieh.exe
Size 535KB
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-131-0x0000026E61FE0000-0x0000026E6200B000-memory.dmp

Download

memory/400-132-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/544-134-0x000002D3A2F00000-0x000002D3A2F2B000-memory.dmp

Download

memory/544-135-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/740-78-0x00000222CED00000-0x00000222CED2B000-memory.dmp

Download

memory/740-76-0x00000222CECD0000-0x00000222CECF5000-memory.dmp

Download

memory/740-79-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/956-123-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/956-121-0x0000019092570000-0x000001909259B000-memory.dmp

Download

memory/960-127-0x000001D918B20000-0x000001D918B4B000-memory.dmp

Download

memory/960-128-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1064-69-0x00007FFC601C0000-0x00007FFC60423000-memory.dmp

Download

memory/1064-70-0x00007FFC5ED60000-0x00007FFC5EE27000-memory.dmp

Download

memory/1092-138-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1092-137-0x000001E121570000-0x000001E12159B000-memory.dmp

Download

memory/1128-170-0x000002470F620000-0x000002470F64B000-memory.dmp

Download

memory/1128-171-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1140-88-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1140-87-0x000001C33D790000-0x000001C33D7BB000-memory.dmp

Download

memory/1220-141-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1220-140-0x000002292DD60000-0x000002292DD8B000-memory.dmp

Download

memory/1284-143-0x00000294E2410000-0x00000294E243B000-memory.dmp

Download

memory/1284-144-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1316-147-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1316-146-0x000001868ADD0000-0x000001868ADFB000-memory.dmp

Download

memory/1532-150-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1532-149-0x0000025EED6F0000-0x0000025EED71B000-memory.dmp

Download

memory/1604-153-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1604-152-0x0000021DF6830000-0x0000021DF685B000-memory.dmp

Download

memory/1612-100-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1612-99-0x0000028D856E0000-0x0000028D8570B000-memory.dmp

Download

memory/1656-155-0x000001BD269F0000-0x000001BD26A1B000-memory.dmp

Download

memory/1656-156-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1664-158-0x000001E234910000-0x000001E23493B000-memory.dmp

Download

memory/1664-159-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1788-161-0x000001D084AD0000-0x000001D084AFB000-memory.dmp

Download

memory/1788-162-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1824-165-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/1824-164-0x0000019D67220000-0x0000019D6724B000-memory.dmp

Download

memory/2000-77-0x0000000000AB0000-0x0000000000AC6000-memory.dmp

Download

memory/2020-174-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2020-173-0x000001D5D5A70000-0x000001D5D5A9B000-memory.dmp

Download

memory/2036-168-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2036-167-0x000002D6CD1E0000-0x000002D6CD20B000-memory.dmp

Download

memory/2192-176-0x0000019D0F990000-0x0000019D0F9BB000-memory.dmp

Download

memory/2192-177-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2200-180-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2200-179-0x000002234F390000-0x000002234F3BB000-memory.dmp

Download

memory/2240-182-0x000002D18FFA0000-0x000002D18FFCB000-memory.dmp

Download

memory/2240-183-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2344-185-0x000001B6A4B20000-0x000001B6A4B4B000-memory.dmp

Download

memory/2344-186-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2388-188-0x000002008AFC0000-0x000002008AFEB000-memory.dmp

Download

memory/2388-189-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2424-191-0x0000016FC33F0000-0x0000016FC341B000-memory.dmp

Download

memory/2424-192-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2436-194-0x000001B0F5E00000-0x000001B0F5E2B000-memory.dmp

Download

memory/2436-195-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2584-197-0x000001895FF30000-0x000001895FF5B000-memory.dmp

Download

memory/2584-198-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2624-200-0x000001429AB70000-0x000001429AB9B000-memory.dmp

Download

memory/2624-201-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2760-203-0x0000027823FC0000-0x0000027823FEB000-memory.dmp

Download

memory/2760-204-0x00007FFC20300000-0x00007FFC20310000-memory.dmp

Download

memory/2932-206-0x000002CA3EF30000-0x000002CA3EF5B000-memory.dmp

Download

memory/4648-11-0x0000000005D50000-0x0000000005D5E000-memory.dmp

Download

memory/4648-7-0x0000000005A50000-0x0000000005AEC000-memory.dmp

Download

memory/4648-450-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4648-13-0x0000000006EC0000-0x0000000006F52000-memory.dmp

Download

memory/4648-1-0x0000000000920000-0x0000000000936000-memory.dmp

Download

memory/4648-441-0x00000000072B0000-0x00000000072BE000-memory.dmp

Download

memory/4648-2-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4648-3-0x0000000074E32000-0x0000000074E33000-memory.dmp

Download

memory/4648-4-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/4648-14-0x0000000006FB0000-0x0000000006FBC000-memory.dmp

Download

memory/4648-8-0x00000000062E0000-0x000000000689A000-memory.dmp

Download

memory/4648-9-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Download

memory/4648-10-0x0000000006B60000-0x0000000006BD6000-memory.dmp

Download

memory/4648-0-0x0000000074E32000-0x0000000074E33000-memory.dmp

Download

memory/4648-12-0x0000000006B00000-0x0000000006B1E000-memory.dmp

Download

memory/5360-39-0x0000000000C30000-0x0000000000C72000-memory.dmp

Download

memory/5360-37-0x0000000000310000-0x000000000039C000-memory.dmp

Download

memory/5572-64-0x0000000000830000-0x0000000000846000-memory.dmp

Download

memory/5976-16-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/5976-17-0x00000000023B0000-0x00000000023E6000-memory.dmp

Download

memory/5976-18-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/5976-19-0x0000000005220000-0x000000000586A000-memory.dmp

Download

memory/5976-20-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download

memory/5976-21-0x0000000004F60000-0x0000000004F82000-memory.dmp

Download

memory/5976-22-0x0000000005000000-0x0000000005066000-memory.dmp

Download

memory/5976-25-0x0000000005870000-0x0000000005BCB000-memory.dmp

Download

memory/5976-26-0x0000000005C10000-0x0000000005C2E000-memory.dmp

Download

memory/5976-27-0x0000000005C50000-0x0000000005C9C000-memory.dmp

Download

memory/5976-33-0x00000000061E0000-0x0000000006202000-memory.dmp

Download

memory/5976-32-0x0000000006160000-0x000000000617A000-memory.dmp

Download

memory/5976-31-0x0000000006CB0000-0x0000000006D46000-memory.dmp

Download

memory/5976-38-0x0000000074E20000-0x00000000755DC000-memory.dmp

Download