2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d

Resubmissions

02/10/2026, 13:56

261002-q8rvzs1zft

02/10/2026, 13:45

261002-q2v9tsbd628

Analysis

max time kernel
146s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Squidward-main/Squidward.exe
Size 535KB
Sample261002-q2v9tsbd62
SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
MD5 82bf26203c5d76dfa3a591f1cb60d7b5
SHA1 93bf418f64ec701fd0d3232a00a167d04ba9a6d2
SHA512 6a896c274958467e18579affe68a2e0acb68ea633715920d244974765dbf577ce7558cb3dc467a69a656cb82c2f588565f71c4413b5dedc1005fba35303ed2f3
SSDEEP 6144:yrjS60VNKrDqa3pPvX0RQ/FwiSs8k//M4zVRslxX4ci0MAM0bCrvVFs47Xeeeeen:4jST2/l3Z8O7Ss8k//XzVRUX4fnr9
TLSH
T136C4CF61A103D6E2E38D4BB46152D478152E1FE6679A160DEFC13F8B7DF12A128239CF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3664	MasonMBR-SLEEP.exe
1136	MasonRootkit.exe
4988	MasonGDI.exe
988	MasonGDI.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MasonMBR	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1000	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonGDI.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5540	timeout.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\7e6973e1_0	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\7e6973e1_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\Squidward-main\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4bfbfdf_0\ = "{2}.\\\\?\\hdaudio#func_01&ven_8086&dev_0022&subsys_80860022&rev_1001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\\elineouttopo/00010001\|\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\MasonGDI.exe%b{00000000-0000-0000-0000-000000000000}"	svchost.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C98D5C3B-5DBC-4580-8327-91D8507AE867}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1790948783"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 30 Sep 2026 10:35:21 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe
1136	MasonRootkit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4920	explorer.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	MasonRootkit.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: 33	1756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1756	AUDIODG.EXE
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe
Token: SeShutdownPrivilege	4920	explorer.exe
Token: SeCreatePagefilePrivilege	4920	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	Conhost.exe
4624	Conhost.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
4920	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3664	2504	Squidward.exe	89
PID 2504 wrote to memory of 1136	2504	Squidward.exe	90
PID 1136 wrote to memory of 740	1136	MasonRootkit.exe	5
PID 1136 wrote to memory of 960	1136	MasonRootkit.exe	9
PID 1136 wrote to memory of 968	1136	MasonRootkit.exe	10
PID 1136 wrote to memory of 980	1136	MasonRootkit.exe	11
PID 1136 wrote to memory of 1028	1136	MasonRootkit.exe	13
PID 1136 wrote to memory of 1164	1136	MasonRootkit.exe	14
PID 1136 wrote to memory of 1236	1136	MasonRootkit.exe	15
PID 1136 wrote to memory of 1268	1136	MasonRootkit.exe	16
PID 1136 wrote to memory of 1324	1136	MasonRootkit.exe	17
PID 1136 wrote to memory of 1376	1136	MasonRootkit.exe	18
PID 1136 wrote to memory of 1472	1136	MasonRootkit.exe	20
PID 1136 wrote to memory of 1488	1136	MasonRootkit.exe	21
PID 1136 wrote to memory of 1596	1136	MasonRootkit.exe	22
PID 1136 wrote to memory of 1612	1136	MasonRootkit.exe	23
PID 1136 wrote to memory of 1672	1136	MasonRootkit.exe	24
PID 1136 wrote to memory of 1708	1136	MasonRootkit.exe	25
PID 1136 wrote to memory of 1728	1136	MasonRootkit.exe	26
PID 1136 wrote to memory of 1864	1136	MasonRootkit.exe	27
PID 1136 wrote to memory of 2040	1136	MasonRootkit.exe	29
PID 1136 wrote to memory of 1344	1136	MasonRootkit.exe	30
PID 1136 wrote to memory of 1624	1136	MasonRootkit.exe	31
PID 1136 wrote to memory of 2184	1136	MasonRootkit.exe	32
PID 1136 wrote to memory of 2212	1136	MasonRootkit.exe	33
PID 1136 wrote to memory of 2268	1136	MasonRootkit.exe	34
PID 1136 wrote to memory of 2388	1136	MasonRootkit.exe	35
PID 1136 wrote to memory of 2428	1136	MasonRootkit.exe	36
PID 1136 wrote to memory of 2536	1136	MasonRootkit.exe	37
PID 1136 wrote to memory of 2608	1136	MasonRootkit.exe	38
PID 1136 wrote to memory of 2628	1136	MasonRootkit.exe	39
PID 1136 wrote to memory of 2756	1136	MasonRootkit.exe	40
PID 1136 wrote to memory of 2768	1136	MasonRootkit.exe	41
PID 1136 wrote to memory of 2784	1136	MasonRootkit.exe	42
PID 1136 wrote to memory of 2964	1136	MasonRootkit.exe	43
PID 1136 wrote to memory of 716	1136	MasonRootkit.exe	44
PID 1136 wrote to memory of 2576	1136	MasonRootkit.exe	45
PID 1136 wrote to memory of 3120	1136	MasonRootkit.exe	47
PID 1136 wrote to memory of 3160	1136	MasonRootkit.exe	48
PID 1136 wrote to memory of 3464	1136	MasonRootkit.exe	50
PID 1136 wrote to memory of 3568	1136	MasonRootkit.exe	51
PID 1136 wrote to memory of 3608	1136	MasonRootkit.exe	52
PID 1136 wrote to memory of 3632	1136	MasonRootkit.exe	53
PID 1136 wrote to memory of 3640	1136	MasonRootkit.exe	54
PID 1136 wrote to memory of 3656	1136	MasonRootkit.exe	55
PID 1136 wrote to memory of 3668	1136	MasonRootkit.exe	56
PID 1136 wrote to memory of 3224	1136	MasonRootkit.exe	57
PID 1136 wrote to memory of 1252	1136	MasonRootkit.exe	58
PID 1136 wrote to memory of 4388	1136	MasonRootkit.exe	59
PID 1136 wrote to memory of 4444	1136	MasonRootkit.exe	60
PID 1136 wrote to memory of 4488	1136	MasonRootkit.exe	61
PID 1136 wrote to memory of 4720	1136	MasonRootkit.exe	62
PID 1136 wrote to memory of 4772	1136	MasonRootkit.exe	63
PID 1136 wrote to memory of 1288	1136	MasonRootkit.exe	64
PID 1136 wrote to memory of 5140	1136	MasonRootkit.exe	65
PID 1136 wrote to memory of 5300	1136	MasonRootkit.exe	67
PID 1136 wrote to memory of 5456	1136	MasonRootkit.exe	68
PID 1136 wrote to memory of 3452	1136	MasonRootkit.exe	72
PID 1136 wrote to memory of 6020	1136	MasonRootkit.exe	73
PID 1136 wrote to memory of 1720	1136	MasonRootkit.exe	74
PID 1136 wrote to memory of 4788	1136	MasonRootkit.exe	77
PID 1136 wrote to memory of 3688	1136	MasonRootkit.exe	78
PID 1136 wrote to memory of 5852	1136	MasonRootkit.exe	79
PID 1136 wrote to memory of 3980	1136	MasonRootkit.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:960
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1164

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:968

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-71f6aef5-8e8f-418d-9249-73159d11d61e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fd748aef-bc16-4192-bbc5-3619099c7ec2 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3baad3df-6319-4682-a935-02d5d42a292d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cb7a96a1-fa7e-46a5-b6bf-40b7ef52f1e9 -LifetimeId:ce04c691-50e5-4d91-b94e-02819a0d2eaa -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2040
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3980
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Squidward-main\Squidward.exe
      "C:\Users\Admin\AppData\Local\Temp\Squidward-main\Squidward.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonMBR-SLEEP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonMBR-SLEEP.exe"
        5⤵
        Executes dropped EXE
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:988
    - - C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonRootkit.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonRootkit.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonGDI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonGDI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4988
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\Squidward-main\\MasonMBR.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2260
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4912
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE3EE.tmp.bat""
        5⤵
        Executes a command shell one-liner
        
        PID:1000
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3516
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:5540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:2428
- C:\Windows\system32\AUDIODG.EXE
  C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2608
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000218;00000000000001FC;
  2⤵
  PID:5456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2964

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3160

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1252

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4720

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4772

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:1288

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:6020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4788

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3688

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2376

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MasonGDI.exe

Path C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonGDI.exe
Size 61KB
SHA256 57eff2792a929b479b3e3bb9a25bbe750034dcba4213e2abb8865ff2268b53f6
MD5 2f9823efd49a6f8fc32ba52d75e620a4
SHA1 39f79bc2bba2f33f2e82da2dee4c8cf3be052b7e
SHA512 2f68ddb1d7d070f7d8675791f8ccc3b9d73236834f1bc787afdf1074d4d17601f77e53a98024a12e29119c5c38333cd7f6200a186e2ba96fc4186c86ca2cb6ad
SSDEEP 1536:PTynnng4PEIGZ5eqIXzgmYi/ZuPiDNG9j3+aOPw1WX6CjV9nu:9OFGfeZgmJ8POoOu1WX6CjS
TLSH
T13653F186E3B8C421D0F71333AD67E99413F5EAD69D56CA1F0A80935B6ED23464F21E1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonMBR-SLEEP.exe

Path C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonMBR-SLEEP.exe
Size 65KB
SHA256 de93250a0f249700407cd893e1b4d6b167c5e909b4b8f09cbefbbae473f4ad93
MD5 f006d2343d121bd2043925e87063fde7
SHA1 402799473ca52edb826a37e0042456032db121f3
SHA512 707c803508308fa0d002aa31187476cf1b000118f9b0d89982ab60a674de09f028ae860c3dbdad9fa902ee4e9d0771f8fa79e356bb2ae8bf4f2c57d61f3e68e0
SSDEEP 1536:ToHs+RMT9qQPhcm7V0vppY62kxt+nl5Hr1lo/u:MHssMT9qQPSmyvB2cKl5L3P
TLSH
T1FC63F1129FE8026AC35F47B25DE573910F2ADE44DE06775F809182A18F49AC88773B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRootkit.exe

Path C:\Users\Admin\AppData\Local\Temp\Squidward-main\MasonRootkit.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpA7E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA7E5.tmp
Size 873KB
SHA256 6a1e08d3a6759f42ea2480450bdf1f369bf50236ba1dc94cfddbf02b5dd7ecaa
MD5 7bfe4475c45768860615d6cdc19dc622
SHA1 d937f02f743833748dbc391211602c28f0eaca8f
SHA512 64bb4d4ebc82a7509ded16677592dacb862bfbdbb9c06a871f7d051aa7a5c67c5a5358ddd3f44ca7922fd3f406a784c768737dddafc49075f496452b96597681
SSDEEP 1536:qnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnns:D
TLSH
T175150FF06479EE53F39685397920FD2846D03499AAF3493A707DF9C8A373B60285C61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpE3EE.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpE3EE.tmp.bat
Size 176B
SHA256 12afe884b77e0d2c4b14bee992a95d6dc71f5713b3b55eb56843ef7256ff3f2a
MD5 5092ab48e026195378fcbbc568a40833
SHA1 3b16c1b2ba0455ac7627c4d466a81070f733778a
SHA512 149f5e6ead0715fc0e6f43c0251de431e74c16b28ab0f8613ed734cad9b6a6c25f40277318138c5fff29b35de515d1c92a562c59f53ef7b608cbc22d877cbfa5
TLSH
T152C0801114C7F77F154564171175D14DC0625C0B3E467B50D35C800465804BDF4B9709
MD5 SHA1 SHA512 TLSH

Submit Download

MasonMBR

Path C:\Windows\System32\Tasks\MasonMBR
Size 3KB
SHA256 3e44ee54a338ff1fb0420be3609489273f420689f9e244c4a2da7281ce3e2d8f
MD5 dbb58326c67168359f32dd95e8ae4dfd
SHA1 77f5ee94ac88afeb7cd4ee56ed47a1c7b40cccd6
SHA512 f1f2a4a37743f3f15fa8034fccae342cacea6e03eac1174d7814feda5825c98cfff59b12553c3ce3a8cb428470edae767c4de9f0f22dae5eb1f663c4c55572bb
TLSH
T1FD61685767EE1109F2F76B2CAEB754228E67BD515938C46D00AC240DCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 ae883bb9328ae3dd0aa0106f64645552dbecce2fa610d6f6e41ad690c996b712
MD5 cc9773ab9f9278a4274468db410df230
SHA1 d6464a0c2e7a30d7cf19dbaa97098b4021d137ff
SHA512 e4333ca2808edc439eb185b1455a2d46116acdc649abe66efbfe34539be3c84bb9d650f35b99580ce070b718dbcd062096efc6d6f1907037fd4f73113fa9c287
TLSH
T1DFE08C123AE80304E63B0A3C6933A449593A776BEF01DA9D0735049E1C38FA1D93B61D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-185-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/716-184-0x00000000019E0000-0x0000000001A0B000-memory.dmp

Download

memory/740-38-0x0000024E6AF30000-0x0000024E6AF5B000-memory.dmp

Download

memory/740-37-0x0000024E6AF00000-0x0000024E6AF25000-memory.dmp

Download

memory/740-39-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/740-302-0x0000024E6AF30000-0x0000024E6AF5B000-memory.dmp

Download

memory/960-49-0x000001BC8F790000-0x000001BC8F7BB000-memory.dmp

Download

memory/960-129-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/968-50-0x000001CFDDB20000-0x000001CFDDB4B000-memory.dmp

Download

memory/968-51-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/980-54-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/980-53-0x0000012BD1DF0000-0x0000012BD1E1B000-memory.dmp

Download

memory/1028-56-0x000001E2758B0000-0x000001E2758DB000-memory.dmp

Download

memory/1028-57-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1136-35-0x00007FF9D5860000-0x00007FF9D5AC3000-memory.dmp

Download

memory/1136-36-0x00007FF9D42A0000-0x00007FF9D4367000-memory.dmp

Download

memory/1164-46-0x0000023DFF140000-0x0000023DFF16B000-memory.dmp

Download

memory/1164-47-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1236-131-0x0000023660DC0000-0x0000023660DEB000-memory.dmp

Download

memory/1236-132-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1324-134-0x000002AB93F60000-0x000002AB93F8B000-memory.dmp

Download

memory/1324-135-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1344-161-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1344-160-0x0000028311EE0000-0x0000028311F0B000-memory.dmp

Download

memory/1376-137-0x000001416A9C0000-0x000001416A9EB000-memory.dmp

Download

memory/1376-138-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1472-140-0x00000262147E0000-0x000002621480B000-memory.dmp

Download

memory/1488-65-0x000001BB5D290000-0x000001BB5D2BB000-memory.dmp

Download

memory/1488-66-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1596-141-0x000001B569F30000-0x000001B569F5B000-memory.dmp

Download

memory/1596-142-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1612-144-0x000002CE31320000-0x000002CE3134B000-memory.dmp

Download

memory/1612-145-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1624-164-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1624-163-0x000001D0E0440000-0x000001D0E046B000-memory.dmp

Download

memory/1672-148-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1672-147-0x000001E4004A0000-0x000001E4004CB000-memory.dmp

Download

memory/1708-151-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1708-150-0x0000025055DF0000-0x0000025055E1B000-memory.dmp

Download

memory/1728-153-0x000001822D390000-0x000001822D3BB000-memory.dmp

Download

memory/1728-154-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1864-157-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/1864-156-0x0000022365000000-0x000002236502B000-memory.dmp

Download

memory/2040-159-0x0000020321F20000-0x0000020321F4B000-memory.dmp

Download

memory/2212-167-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/2212-166-0x000002AA40720000-0x000002AA4074B000-memory.dmp

Download

memory/2268-169-0x000001E9ADEA0000-0x000001E9ADECB000-memory.dmp

Download

memory/2268-170-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/2428-172-0x000002B365ED0000-0x000002B365EFB000-memory.dmp

Download

memory/2428-173-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/2504-3-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/2504-365-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/2504-2-0x0000000002BF0000-0x0000000002C32000-memory.dmp

Download

memory/2504-22-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/2504-1-0x0000000000B30000-0x0000000000BBC000-memory.dmp

Download

memory/2504-4-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/2504-0-0x00007FF9B2B8F000-0x00007FF9B2B90000-memory.dmp

Download

memory/2504-7-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/2504-8-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/2576-188-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/2576-187-0x0000023FA27C0000-0x0000023FA27EB000-memory.dmp

Download

memory/2608-176-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/2608-175-0x000001B496B10000-0x000001B496B3B000-memory.dmp

Download

memory/2784-178-0x000001801F9E0000-0x000001801FA0B000-memory.dmp

Download

memory/2784-179-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/2964-181-0x0000018FECEB0000-0x0000018FECEDB000-memory.dmp

Download

memory/2964-182-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/3120-190-0x0000014FC9CD0000-0x0000014FC9CFB000-memory.dmp

Download

memory/3120-191-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/3464-193-0x0000020469CC0000-0x0000020469CEB000-memory.dmp

Download

memory/3664-25-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3664-24-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3664-372-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3664-393-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3664-23-0x0000000000BA0000-0x0000000000BB6000-memory.dmp

Download

memory/4920-122-0x0000000003450000-0x000000000347B000-memory.dmp

Download

memory/4920-123-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download

memory/4988-317-0x0000000005970000-0x0000000005A02000-memory.dmp

Download

memory/4988-310-0x0000000000BD0000-0x0000000000BE6000-memory.dmp

Download

memory/5456-111-0x000001A0CF740000-0x000001A0CF76B000-memory.dmp

Download

memory/5456-112-0x00007FF9959A0000-0x00007FF9959B0000-memory.dmp

Download