4460e92e392c144aaa5682b2047ff71163641145cbf7252d15d60702ade6a580

Analysis

max time kernel
36s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/10/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Binded.exe
Size 1.2MB
Sample261009-v55d5act3s
SHA256 4460e92e392c144aaa5682b2047ff71163641145cbf7252d15d60702ade6a580
MD5 041c9f9ee6cb13a89999ad494fb122e1
SHA1 c014af2fa8451a9d03a6b0212050377e63d06912
SHA512 5136f185dc9a3e5b92e5eb60e15c380101bf70ec23d655b666fa2c7b0e9cfef3f0af4ee8576352c07c6a1d19dd7f1126b70b5805fdc76c44dafec51e57dfdff2
SSDEEP 24576:mRh2mBkxzzAtTV8fFimcZwFapkcYCUdzOJMtc5jbfNt4u+cBXT14:mRMAX9VdmSujxOJUEHHXT1
TLSH
T1104533B0AAEEE1CBEC9C02FC6435F279529F40E6C76D1136DA4289A5CFD875C8250173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2340	powershell.exe
5088	powershell.exe
1368	powershell.exe
1400	powershell.exe
1460	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.lnk	wininit.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.lnk	wininit.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\wininit.exe	wininit.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\wininit.exe	wininit.exe

Executes dropped EXE 4 IoCs

pid	Process
3888	injection.exe
4216	wininit.exe
2780	wininit.exe
2964	nrbtx0lr.r23.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Roaming\\wininit.exe"	wininit.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Masonwininit.exe	svchost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	wininit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wininit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wininit.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "504928405,17110992,7153487,17110988,7202265,507286179,41816131,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,940 15,943 10,944 50,940 6,1329 15,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2060	SCHTASKS.exe
6132	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2340	powershell.exe
2340	powershell.exe
5088	powershell.exe
5088	powershell.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2964	nrbtx0lr.r23.exe
2780	wininit.exe
2964	nrbtx0lr.r23.exe
2780	wininit.exe
2780	wininit.exe
2964	nrbtx0lr.r23.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe
2780	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3192	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	injection.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	4216	wininit.exe
Token: SeDebugPrivilege	2780	wininit.exe
Token: SeDebugPrivilege	2964	nrbtx0lr.r23.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeShutdownPrivilege	3192	Explorer.EXE
Token: SeCreatePagefilePrivilege	3192	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2716	svchost.exe
Token: SeIncreaseQuotaPrivilege	2716	svchost.exe
Token: SeSecurityPrivilege	2716	svchost.exe
Token: SeTakeOwnershipPrivilege	2716	svchost.exe
Token: SeLoadDriverPrivilege	2716	svchost.exe
Token: SeSystemtimePrivilege	2716	svchost.exe
Token: SeBackupPrivilege	2716	svchost.exe
Token: SeRestorePrivilege	2716	svchost.exe
Token: SeShutdownPrivilege	2716	svchost.exe
Token: SeSystemEnvironmentPrivilege	2716	svchost.exe
Token: SeUndockPrivilege	2716	svchost.exe
Token: SeManageVolumePrivilege	2716	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2716	svchost.exe
Token: SeIncreaseQuotaPrivilege	2716	svchost.exe
Token: SeSecurityPrivilege	2716	svchost.exe
Token: SeTakeOwnershipPrivilege	2716	svchost.exe
Token: SeLoadDriverPrivilege	2716	svchost.exe
Token: SeSystemtimePrivilege	2716	svchost.exe
Token: SeBackupPrivilege	2716	svchost.exe
Token: SeRestorePrivilege	2716	svchost.exe
Token: SeShutdownPrivilege	2716	svchost.exe
Token: SeSystemEnvironmentPrivilege	2716	svchost.exe
Token: SeUndockPrivilege	2716	svchost.exe
Token: SeManageVolumePrivilege	2716	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2716	svchost.exe
Token: SeIncreaseQuotaPrivilege	2716	svchost.exe
Token: SeSecurityPrivilege	2716	svchost.exe
Token: SeTakeOwnershipPrivilege	2716	svchost.exe
Token: SeLoadDriverPrivilege	2716	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3888	2100	Binded.exe	83
PID 3888 wrote to memory of 2340	3888	injection.exe	84
PID 3888 wrote to memory of 5088	3888	injection.exe	86
PID 2780 wrote to memory of 2964	2780	wininit.exe	91
PID 2964 wrote to memory of 632	2964	nrbtx0lr.r23.exe	5
PID 2964 wrote to memory of 696	2964	nrbtx0lr.r23.exe	7
PID 2964 wrote to memory of 900	2964	nrbtx0lr.r23.exe	11
PID 2964 wrote to memory of 404	2964	nrbtx0lr.r23.exe	13
PID 2964 wrote to memory of 436	2964	nrbtx0lr.r23.exe	14
PID 2964 wrote to memory of 724	2964	nrbtx0lr.r23.exe	15
PID 2964 wrote to memory of 536	2964	nrbtx0lr.r23.exe	16
PID 2964 wrote to memory of 1032	2964	nrbtx0lr.r23.exe	17
PID 2964 wrote to memory of 1156	2964	nrbtx0lr.r23.exe	18
PID 2964 wrote to memory of 1188	2964	nrbtx0lr.r23.exe	19
PID 2964 wrote to memory of 1240	2964	nrbtx0lr.r23.exe	21
PID 2964 wrote to memory of 1248	2964	nrbtx0lr.r23.exe	22
PID 2964 wrote to memory of 1260	2964	nrbtx0lr.r23.exe	23
PID 2964 wrote to memory of 1356	2964	nrbtx0lr.r23.exe	24
PID 2964 wrote to memory of 1452	2964	nrbtx0lr.r23.exe	25
PID 2964 wrote to memory of 1532	2964	nrbtx0lr.r23.exe	26
PID 2964 wrote to memory of 1640	2964	nrbtx0lr.r23.exe	27
PID 2964 wrote to memory of 1660	2964	nrbtx0lr.r23.exe	28
PID 2964 wrote to memory of 1684	2964	nrbtx0lr.r23.exe	29
PID 2964 wrote to memory of 1836	2964	nrbtx0lr.r23.exe	30
PID 2964 wrote to memory of 1888	2964	nrbtx0lr.r23.exe	31
PID 2964 wrote to memory of 1932	2964	nrbtx0lr.r23.exe	32
PID 2964 wrote to memory of 1956	2964	nrbtx0lr.r23.exe	33
PID 2964 wrote to memory of 1996	2964	nrbtx0lr.r23.exe	34
PID 2964 wrote to memory of 2004	2964	nrbtx0lr.r23.exe	35
PID 2964 wrote to memory of 2020	2964	nrbtx0lr.r23.exe	36
PID 2964 wrote to memory of 2052	2964	nrbtx0lr.r23.exe	37
PID 2964 wrote to memory of 2076	2964	nrbtx0lr.r23.exe	38
PID 2964 wrote to memory of 2156	2964	nrbtx0lr.r23.exe	39
PID 2964 wrote to memory of 2332	2964	nrbtx0lr.r23.exe	41
PID 2964 wrote to memory of 2544	2964	nrbtx0lr.r23.exe	42
PID 2964 wrote to memory of 2552	2964	nrbtx0lr.r23.exe	43
PID 2964 wrote to memory of 2568	2964	nrbtx0lr.r23.exe	44
PID 2964 wrote to memory of 2604	2964	nrbtx0lr.r23.exe	45
PID 2964 wrote to memory of 2696	2964	nrbtx0lr.r23.exe	47
PID 2964 wrote to memory of 2716	2964	nrbtx0lr.r23.exe	48
PID 2964 wrote to memory of 2728	2964	nrbtx0lr.r23.exe	49
PID 2964 wrote to memory of 2864	2964	nrbtx0lr.r23.exe	50
PID 2964 wrote to memory of 2352	2964	nrbtx0lr.r23.exe	51
PID 2964 wrote to memory of 324	2964	nrbtx0lr.r23.exe	52
PID 2964 wrote to memory of 720	2964	nrbtx0lr.r23.exe	53
PID 2964 wrote to memory of 3192	2964	nrbtx0lr.r23.exe	54
PID 2964 wrote to memory of 3324	2964	nrbtx0lr.r23.exe	55
PID 2964 wrote to memory of 3356	2964	nrbtx0lr.r23.exe	56
PID 2964 wrote to memory of 3700	2964	nrbtx0lr.r23.exe	59
PID 2964 wrote to memory of 3756	2964	nrbtx0lr.r23.exe	60
PID 2964 wrote to memory of 3800	2964	nrbtx0lr.r23.exe	61
PID 2964 wrote to memory of 3892	2964	nrbtx0lr.r23.exe	62
PID 2964 wrote to memory of 4188	2964	nrbtx0lr.r23.exe	63
PID 2964 wrote to memory of 4244	2964	nrbtx0lr.r23.exe	64
PID 2964 wrote to memory of 4664	2964	nrbtx0lr.r23.exe	68
PID 2964 wrote to memory of 4756	2964	nrbtx0lr.r23.exe	69
PID 2964 wrote to memory of 2672	2964	nrbtx0lr.r23.exe	71
PID 2964 wrote to memory of 756	2964	nrbtx0lr.r23.exe	72
PID 2964 wrote to memory of 1204	2964	nrbtx0lr.r23.exe	73
PID 2964 wrote to memory of 460	2964	nrbtx0lr.r23.exe	74
PID 2964 wrote to memory of 1672	2964	nrbtx0lr.r23.exe	75
PID 2964 wrote to memory of 2624	2964	nrbtx0lr.r23.exe	76
PID 2964 wrote to memory of 3076	2964	nrbtx0lr.r23.exe	77
PID 2964 wrote to memory of 3520	2964	nrbtx0lr.r23.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:436

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-214ef415-b5ee-4819-ab65-71ea3aacb7aa -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-db16dda5-672d-4a63-b478-fb3afa49d868 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0551e5cf-08a6-4aef-afe4-cfecf5abaf41 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-dc99dd29-a3a9-4b33-b297-efc57a7c38d6 -LifetimeId:bcded9e8-2582-4a3d-a8ae-ae81b8dbef9e -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1260
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:720
- C:\Users\Admin\AppData\Roaming\wininit.exe
  C:\Users\Admin\AppData\Roaming\wininit.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\nrbtx0lr.r23.exe
    "C:\Users\Admin\AppData\Local\Temp\nrbtx0lr.r23.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2964
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonwininit.exe" /tr "'C:\Users\Admin\AppData\Roaming\wininit.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6132
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonwininit.exe" /tr "'C:\Users\Admin\AppData\Roaming\wininit.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1452
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2076

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:324

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3192
- C:\Users\Admin\AppData\Local\Temp\Binded.exe
  "C:\Users\Admin\AppData\Local\Temp\Binded.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Roaming\injection.exe
    "C:\Users\Admin\AppData\Roaming\injection.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\wininit.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3356

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3700

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3756

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3892

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2672

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:460

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2624

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3520

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1056

C:\Users\Admin\AppData\Roaming\wininit.exe
C:\Users\Admin\AppData\Roaming\wininit.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2640

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log
Size 1KB
SHA256 8a3cef8da8a932fbc62a00143270d9c9f1a4b34394be59ed50086c2d542e6fe4
MD5 4a59944098abc35779db90020fecd5ac
SHA1 07a1ca173ecfab776dc4bba87061a6f330f522c1
SHA512 81a24bc2ca350bb502ce91470f5ebcb40ecd84cd533af963edbf0e91b70296dbaa06e4b25a0c295826a8bf8b7dec30bf07aeda4fb9cbf8f8ab29d83714c65601
TLSH
T14421CD312372A1C889263F421C1D268423EF832AB650EE0C7A98635DDD2705B5B212F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2449df4a0cbb2fc9b2abbb2b82d4d520f7889839b5e6392a81915a195c686ff4
MD5 c1e5c21d5bfd3c10ae9b6aeea1c0d87f
SHA1 55b8b9a0f55b2ba981e72dab10ec755ce79703b5
SHA512 8d35ead1672ef5634e517487dbdeddfb38ab4230ab2734fe8ce3bcdaf677b45896b557af5f25026f0be6943eaf2d3128f046ec1e55c8714856d66aba5138828b
TLSH
T15A218933B79CC134C8D911BA108DAD01B2B6C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4789c28f49d38770f44ac17ec6fd0a9311267d419a13f4b97ed6d70e38dac740
MD5 655a5a9c4481818d7932aade3aa29712
SHA1 75f8071bda0e0480feac5f60f66fc9b901dc5bff
SHA512 25f75f57c749fd72ec5837b1d1395d4e5fac6e45ebb857f43d0f92f1aeb4c3ede92db17b30373cddb2a6349a0b23e6d19f4b5d9f49474cecd0a7e6c377a296a3
TLSH
T1E6218933B7ACC134C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8657864d4a0a7d06f313e2a162fe90c423bb38e4227a75cb06677a85187cae2e
MD5 7e9783f9e8fd5a60b27260d9f0d7c818
SHA1 01e50a5a4f5aed3b98f7f74862574a1ada7a3df6
SHA512 223ef5535ed78fefd750c0a323cb2778735e8a9adde783f34fd92240af459ed5bc14d5a3ea3d2e6a0842b19c0d661a80548cbdd8c3d4683737dc0a56ef222b9a
TLSH
T197218933B79CC134C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b79f569e6c453b33139dcd90442a80e59ac882a1e272a8e4a322d295bfac3ab0
MD5 e60feda9a7e775a7d83cc6ec30a00f68
SHA1 b258b886f3cba5a97922f2695ebeaedafe3638ef
SHA512 51dae2882602a7ef7b3e43cc8745cc6fd974beae26a17730c928d4e82dc19dbb66287d9431cc6bd1990a7278c546cd3f9a51eeb6debd73eacf2803ee303c70e2
TLSH
T153218633B7ACC234C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_utxbdebx.sk4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utxbdebx.sk4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nrbtx0lr.r23.exe

Path C:\Users\Admin\AppData\Local\Temp\nrbtx0lr.r23.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wininit.lnk
Size 810B
SHA256 6b0c206f36d034c321f4a705a3ae0228bfe0da387789713d5ac7b098f8327185
MD5 d856c72194a13021763b4e579357687f
SHA1 9e5c8f9bbdfbe94a939e8a2790073a5ec5fa2e55
SHA512 51dcc1a219c77252f00b7bca65482244d965e156edb9bafcf42d39f54abc1efeda2ea80bdf3fe51d3fdea4e6c35c783ab2ddb63ca2bccde431c35763a4f5d88e
TLSH
T14401DC044E832B31D7D1C73843E66322E6226C22FBE31F460002818838A8A507CA8F3F
MD5 SHA1 SHA512 TLSH

Submit Download

injection.exe

Path C:\Users\Admin\AppData\Roaming\injection.exe
Size 1.2MB
SHA256 633fe09ce5bdf243ed37147e442ce89cd324dd7a93b84deb545a3014bc9790a2
MD5 b4b3a3624307bb6f488cfba8b3ad5abd
SHA1 ca26aea5cc15c4501b3a12315fc1050de1d51cb7
SHA512 93d08f7ab03fa4bc5d83095b8acb2b118714b1a25bf91a2743fb53d29c35c0b87127acfb9e30d5ff601e2f7a9d9f4f0cd5ea0572f67a544318fb89ad3716e7a2
SSDEEP 24576:Vk3DBy0WK2rG4ZyU4E4EuUnR3jouOKsgnRn5VPd32BXAAc4G:meKiG4ZR4E4TUnClKsgnB51d32BXAAc4
TLSH
T10245F1951688E427FFEB17F8F0EA25001FFC51256525D34DB4CC60AEBA1334DAA2276B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Masonwininit.exe

Path C:\Windows\System32\Tasks\Masonwininit.exe
Size 3KB
SHA256 41b5771ffbd74a38f24111bfd16363d6cfcd30385aecd521452496b13bba6f0f
MD5 fd1a6b7e6eacf32517cc7d66173af5d7
SHA1 16824751685e8ed1bdd1a50d624bc978c562927e
SHA512 96044b3afcc74b80a0394f3e4c4e38063da12ae93a4252bc9da23f23453c56d552d818a63da10193e815cf5db28f0cfe90c2f2ed72182eddf3585690eee9951f
TLSH
T11561685367EE1109F2F76B6CAEB750228E67BD515939C46D00AC240DCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/404-89-0x000001CF0AF40000-0x000001CF0AF6B000-memory.dmp

Download

memory/404-90-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/436-93-0x000002A21A170000-0x000002A21A19B000-memory.dmp

Download

memory/436-94-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/536-102-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/536-101-0x000001789A9B0000-0x000001789A9DB000-memory.dmp

Download

memory/632-76-0x000001F881B60000-0x000001F881B85000-memory.dmp

Download

memory/632-77-0x000001F881B90000-0x000001F881BBB000-memory.dmp

Download

memory/632-78-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/696-82-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/696-81-0x00000196D7E00000-0x00000196D7E2B000-memory.dmp

Download

memory/724-97-0x00000205086C0000-0x00000205086EB000-memory.dmp

Download

memory/724-98-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/900-86-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/900-85-0x0000026B7A8C0000-0x0000026B7A8EB000-memory.dmp

Download

memory/1032-105-0x0000023FCA930000-0x0000023FCA95B000-memory.dmp

Download

memory/1032-106-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1156-110-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1156-109-0x00000290C4C30000-0x00000290C4C5B000-memory.dmp

Download

memory/1188-114-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1188-113-0x000001C202890000-0x000001C2028BB000-memory.dmp

Download

memory/1240-117-0x0000023930C60000-0x0000023930C8B000-memory.dmp

Download

memory/1240-118-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1248-121-0x000001833C970000-0x000001833C99B000-memory.dmp

Download

memory/1248-122-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1260-125-0x000002A2BEED0000-0x000002A2BEEFB000-memory.dmp

Download

memory/1260-126-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1356-129-0x00000218E5C30000-0x00000218E5C5B000-memory.dmp

Download

memory/1356-130-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1368-381-0x000001D9E70C0000-0x000001D9E7173000-memory.dmp

Download

memory/1452-133-0x00000246B95D0000-0x00000246B95FB000-memory.dmp

Download

memory/1452-134-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1532-137-0x00000275474D0000-0x00000275474FB000-memory.dmp

Download

memory/1532-138-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1640-141-0x00000201D6E90000-0x00000201D6EBB000-memory.dmp

Download

memory/1640-142-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1660-145-0x000002B48E140000-0x000002B48E16B000-memory.dmp

Download

memory/1660-146-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1684-149-0x00000235A81A0000-0x00000235A81CB000-memory.dmp

Download

memory/1684-150-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1836-153-0x000002294D6E0000-0x000002294D70B000-memory.dmp

Download

memory/1836-154-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1888-157-0x000001AE91980000-0x000001AE919AB000-memory.dmp

Download

memory/1888-158-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1932-162-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1932-161-0x000002A92BDA0000-0x000002A92BDCB000-memory.dmp

Download

memory/1956-165-0x0000023417B80000-0x0000023417BAB000-memory.dmp

Download

memory/1956-166-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/1996-169-0x00000179492B0000-0x00000179492DB000-memory.dmp

Download

memory/1996-170-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/2004-174-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/2004-173-0x000001FACCCC0000-0x000001FACCCEB000-memory.dmp

Download

memory/2020-177-0x000001A503C00000-0x000001A503C2B000-memory.dmp

Download

memory/2020-178-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/2052-181-0x0000027E62950000-0x0000027E6297B000-memory.dmp

Download

memory/2052-182-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/2076-185-0x0000020036750000-0x000002003677B000-memory.dmp

Download

memory/2076-186-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/2100-0-0x0000000000FF0000-0x000000000112C000-memory.dmp

Download

memory/2100-1-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Download

memory/2156-189-0x00000000012A0000-0x00000000012CB000-memory.dmp

Download

memory/2156-190-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/2332-193-0x000001BCC3990000-0x000001BCC39BB000-memory.dmp

Download

memory/2332-194-0x00007FFB1D910000-0x00007FFB1D920000-memory.dmp

Download

memory/2340-34-0x00000209732B0000-0x00000209732CA000-memory.dmp

Download

memory/2340-33-0x0000020971810000-0x000002097181A000-memory.dmp

Download

memory/2340-21-0x00000209711D0000-0x00000209711F2000-memory.dmp

Download

memory/2340-29-0x00000209717E0000-0x00000209717FC000-memory.dmp

Download

memory/2340-30-0x0000020972F80000-0x0000020973033000-memory.dmp

Download

memory/2340-37-0x00000209732D0000-0x00000209732DA000-memory.dmp

Download

memory/2340-36-0x0000020971830000-0x0000020971836000-memory.dmp

Download

memory/2340-35-0x0000020971820000-0x0000020971828000-memory.dmp

Download

memory/2340-31-0x0000020971800000-0x000002097180A000-memory.dmp

Download

memory/2340-32-0x0000020973290000-0x00000209732AC000-memory.dmp

Download

memory/2544-197-0x0000023DC7D40000-0x0000023DC7D6B000-memory.dmp

Download

memory/2780-353-0x000000001D750000-0x000000001D828000-memory.dmp

Download

memory/2780-64-0x000000001D250000-0x000000001D35A000-memory.dmp

Download

memory/2780-65-0x000000001D380000-0x000000001D3AC000-memory.dmp

Download

memory/2964-74-0x00007FFB5D880000-0x00007FFB5DA89000-memory.dmp

Download

memory/2964-75-0x00007FFB5C260000-0x00007FFB5C31D000-memory.dmp

Download

memory/3888-60-0x000000001BB20000-0x000000001BB30000-memory.dmp

Download

memory/3888-14-0x0000000000050000-0x000000000018A000-memory.dmp

Download