njrat | 90bd5cb253c86d13977ecdb91e1c6ebafad573ae523e60fbb2ce5cc50df83dce

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
njRAT 0.7d Horror Edition (6.1).exe
Size 254KB
Sample261105-bhq4faey91
SHA256 90bd5cb253c86d13977ecdb91e1c6ebafad573ae523e60fbb2ce5cc50df83dce
MD5 96829a675b5bdfdb7e183b27be1ea6ff
SHA1 630bb3fc133ca3b7ee505cd7f82a0192bb36fa07
SHA512 65101fa09dcfa3e9deb28eff5c45ab2cc310e6b47b894a53e1642b66ef1f24ff348406ee0b1ae5531351e68a8b0da9ab6d817fdd11363797bc08fc0d526e7e21
SSDEEP 6144:o44Js3vMb/5bTgVziHzZnSKrCbYMEWb28/q:o44KEb/5/gVziHlBrCbYB8y
TLSH
T1B2442966FAA100E6D0BE82348D635B0667B2F4375721DBEF0A95589D7F237E04C29F90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim defense_evasion discovery execution njrat persistence trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

31.57.97.3:3399

Mutex

524c504f7c9a617597c3e67cdc45d268

Attributes

reg_key
524c504f7c9a617597c3e67cdc45d268
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
1532	lhj42uve.dm5.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	njRAT 0.7d Horror Edition (6.1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2436	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	njRAT 0.7d Horror Edition (6.1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	njRAT 0.7d Horror Edition (6.1).exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2436	cmd.exe
1104	PING.EXE

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018001AFFD36E07"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793840981"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 02 Nov 2026 13:55:32 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={9A3EAF8A-2B22-4D51-9C49-3601EFEBF800}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1104	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe
1532	lhj42uve.dm5.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5792	explorer.exe
1716	njRAT 0.7d Horror Edition (6.1).exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	njRAT 0.7d Horror Edition (6.1).exe
Token: SeDebugPrivilege	1532	lhj42uve.dm5.exe
Token: SeShutdownPrivilege	5792	explorer.exe
Token: SeCreatePagefilePrivilege	5792	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	3624	svchost.exe
Token: SeIncreaseQuotaPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeTakeOwnershipPrivilege	3624	svchost.exe
Token: SeLoadDriverPrivilege	3624	svchost.exe
Token: SeSystemtimePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeShutdownPrivilege	3624	svchost.exe
Token: SeSystemEnvironmentPrivilege	3624	svchost.exe
Token: SeUndockPrivilege	3624	svchost.exe
Token: SeManageVolumePrivilege	3624	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3624	svchost.exe
Token: SeIncreaseQuotaPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeTakeOwnershipPrivilege	3624	svchost.exe
Token: SeLoadDriverPrivilege	3624	svchost.exe
Token: SeSystemtimePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeShutdownPrivilege	3624	svchost.exe
Token: SeSystemEnvironmentPrivilege	3624	svchost.exe
Token: SeUndockPrivilege	3624	svchost.exe
Token: SeManageVolumePrivilege	3624	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3624	svchost.exe
Token: SeIncreaseQuotaPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeTakeOwnershipPrivilege	3624	svchost.exe
Token: SeLoadDriverPrivilege	3624	svchost.exe
Token: SeSystemtimePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeShutdownPrivilege	3624	svchost.exe
Token: SeSystemEnvironmentPrivilege	3624	svchost.exe
Token: SeUndockPrivilege	3624	svchost.exe
Token: SeManageVolumePrivilege	3624	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3624	svchost.exe
Token: SeIncreaseQuotaPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeTakeOwnershipPrivilege	3624	svchost.exe
Token: SeLoadDriverPrivilege	3624	svchost.exe
Token: SeSystemtimePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeShutdownPrivilege	3624	svchost.exe
Token: SeSystemEnvironmentPrivilege	3624	svchost.exe
Token: SeUndockPrivilege	3624	svchost.exe
Token: SeManageVolumePrivilege	3624	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3624	svchost.exe
Token: SeIncreaseQuotaPrivilege	3624	svchost.exe
Token: SeSecurityPrivilege	3624	svchost.exe
Token: SeTakeOwnershipPrivilege	3624	svchost.exe
Token: SeLoadDriverPrivilege	3624	svchost.exe
Token: SeSystemtimePrivilege	3624	svchost.exe
Token: SeBackupPrivilege	3624	svchost.exe
Token: SeRestorePrivilege	3624	svchost.exe
Token: SeShutdownPrivilege	3624	svchost.exe
Token: SeSystemEnvironmentPrivilege	3624	svchost.exe
Token: SeUndockPrivilege	3624	svchost.exe
Token: SeManageVolumePrivilege	3624	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1532	1716	njRAT 0.7d Horror Edition (6.1).exe	89
PID 1532 wrote to memory of 752	1532	lhj42uve.dm5.exe	5
PID 1532 wrote to memory of 972	1532	lhj42uve.dm5.exe	9
PID 1532 wrote to memory of 980	1532	lhj42uve.dm5.exe	10
PID 1532 wrote to memory of 548	1532	lhj42uve.dm5.exe	11
PID 1532 wrote to memory of 1028	1532	lhj42uve.dm5.exe	13
PID 1532 wrote to memory of 1108	1532	lhj42uve.dm5.exe	14
PID 1532 wrote to memory of 1192	1532	lhj42uve.dm5.exe	15
PID 1532 wrote to memory of 1236	1532	lhj42uve.dm5.exe	16
PID 1532 wrote to memory of 1284	1532	lhj42uve.dm5.exe	17
PID 1532 wrote to memory of 1364	1532	lhj42uve.dm5.exe	18
PID 1532 wrote to memory of 1436	1532	lhj42uve.dm5.exe	19
PID 1532 wrote to memory of 1464	1532	lhj42uve.dm5.exe	21
PID 1532 wrote to memory of 1580	1532	lhj42uve.dm5.exe	23
PID 1532 wrote to memory of 1620	1532	lhj42uve.dm5.exe	24
PID 1532 wrote to memory of 1672	1532	lhj42uve.dm5.exe	25
PID 1532 wrote to memory of 1760	1532	lhj42uve.dm5.exe	26
PID 1532 wrote to memory of 1824	1532	lhj42uve.dm5.exe	27
PID 1532 wrote to memory of 856	1532	lhj42uve.dm5.exe	28
PID 1532 wrote to memory of 1812	1532	lhj42uve.dm5.exe	29
PID 1532 wrote to memory of 2052	1532	lhj42uve.dm5.exe	30
PID 1532 wrote to memory of 2060	1532	lhj42uve.dm5.exe	31
PID 1532 wrote to memory of 2084	1532	lhj42uve.dm5.exe	32
PID 1532 wrote to memory of 2180	1532	lhj42uve.dm5.exe	33
PID 1532 wrote to memory of 2280	1532	lhj42uve.dm5.exe	34
PID 1532 wrote to memory of 2360	1532	lhj42uve.dm5.exe	35
PID 1532 wrote to memory of 2408	1532	lhj42uve.dm5.exe	36
PID 1532 wrote to memory of 2452	1532	lhj42uve.dm5.exe	37
PID 1532 wrote to memory of 2580	1532	lhj42uve.dm5.exe	38
PID 1532 wrote to memory of 2628	1532	lhj42uve.dm5.exe	39
PID 1532 wrote to memory of 2704	1532	lhj42uve.dm5.exe	40
PID 1532 wrote to memory of 2712	1532	lhj42uve.dm5.exe	41
PID 1532 wrote to memory of 2920	1532	lhj42uve.dm5.exe	42
PID 1532 wrote to memory of 2980	1532	lhj42uve.dm5.exe	43
PID 1532 wrote to memory of 724	1532	lhj42uve.dm5.exe	44
PID 1532 wrote to memory of 2444	1532	lhj42uve.dm5.exe	45
PID 1532 wrote to memory of 3172	1532	lhj42uve.dm5.exe	47
PID 1532 wrote to memory of 3184	1532	lhj42uve.dm5.exe	48
PID 1532 wrote to memory of 3464	1532	lhj42uve.dm5.exe	50
PID 1532 wrote to memory of 3532	1532	lhj42uve.dm5.exe	51
PID 1532 wrote to memory of 3568	1532	lhj42uve.dm5.exe	52
PID 1532 wrote to memory of 3612	1532	lhj42uve.dm5.exe	53
PID 1532 wrote to memory of 3624	1532	lhj42uve.dm5.exe	54
PID 1532 wrote to memory of 3636	1532	lhj42uve.dm5.exe	55
PID 1532 wrote to memory of 3684	1532	lhj42uve.dm5.exe	56
PID 1532 wrote to memory of 3388	1532	lhj42uve.dm5.exe	57
PID 1532 wrote to memory of 1256	1532	lhj42uve.dm5.exe	58
PID 1532 wrote to memory of 4348	1532	lhj42uve.dm5.exe	59
PID 1532 wrote to memory of 4404	1532	lhj42uve.dm5.exe	60
PID 1532 wrote to memory of 4480	1532	lhj42uve.dm5.exe	61
PID 1532 wrote to memory of 4560	1532	lhj42uve.dm5.exe	62
PID 1532 wrote to memory of 3296	1532	lhj42uve.dm5.exe	63
PID 1532 wrote to memory of 4976	1532	lhj42uve.dm5.exe	64
PID 1532 wrote to memory of 5152	1532	lhj42uve.dm5.exe	65
PID 1532 wrote to memory of 5212	1532	lhj42uve.dm5.exe	66
PID 1532 wrote to memory of 5252	1532	lhj42uve.dm5.exe	67
PID 1532 wrote to memory of 5620	1532	lhj42uve.dm5.exe	70
PID 1532 wrote to memory of 3456	1532	lhj42uve.dm5.exe	72
PID 1532 wrote to memory of 1004	1532	lhj42uve.dm5.exe	74
PID 1532 wrote to memory of 5668	1532	lhj42uve.dm5.exe	75
PID 1532 wrote to memory of 2780	1532	lhj42uve.dm5.exe	78
PID 1532 wrote to memory of 3524	1532	lhj42uve.dm5.exe	79
PID 1532 wrote to memory of 5612	1532	lhj42uve.dm5.exe	80
PID 1532 wrote to memory of 5792	1532	lhj42uve.dm5.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:752
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:980
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1192

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:972

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c558cd7e-50c0-42b4-b3b5-bc2ca3bcb729 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5d7ae5dd-cb2c-4f26-a68e-54032b4bf6fa -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-9da53fb8-1029-4a92-8e3e-f1cd1c487123 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c19e99fc-3daf-47d5-923b-72e501e7d0be -LifetimeId:dfdbf8f6-0eca-4d15-a739-1dd434c583d4 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1284

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1812
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5612
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition (6.1).exe
      "C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition (6.1).exe"
      4⤵
      Enumerates video capture drivers
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\lhj42uve.dm5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\lhj42uve.dm5.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1532
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn CleanSweepCheck /f
        5⤵
        
        PID:616
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5840
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition (6.1).exe"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2436
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1540
      - C:\Windows\system32\PING.EXE
        
        ping 0 -n 2
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2452
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:4976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2980

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3184

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1256

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4560

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3296

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5152

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5212

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2780

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5604

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lhj42uve.dm5.exe

Path C:\Users\Admin\AppData\Local\Temp\lhj42uve.dm5.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 d40d14e322dc7b17be9d576d29c0a1d02ff841f5442a3cf51d8b2c0ba8728d46
MD5 d393717154b346eef97826511fde5141
SHA1 5d1ae872d4d92db22d7da3792b8376a27e60d189
SHA512 0f41d5315b7f61322cba37c552b478f4f6d6f6e12d17b764fea0e7464af490657047a9599ff5496d3b8e18164ba966f51a9f99356eb66b80300bb133a5145727
TLSH
T16FE08C723BE90105E6730A3CB972A0820A37BA67A920CA8A0739198D5D79F208836619
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 5af18e1992deb758d60fca55ce0e2811eff9f5769ebd05722b0bad1279bd09c6
MD5 53c3ded4c410ec6244d0fc2e73baf84d
SHA1 ecc70a6cd163dc90f9a4527e9670d1130731c934
SHA512 6be0a015f666794946402fb888907f49bec70375bd9432f0d22fe490ff327ea8761ccc7659eaaf636dd321dcd8a6c3e66ac467c48f72bf99377119bf0c5a6c72
TLSH
T144E0283411FF405DF4E4D47587E56C3145AEF0610419F2F81AE027187203640FC02D34
MD5 SHA1 SHA512 TLSH

Submit Download

memory/548-47-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/548-46-0x000001DF3D760000-0x000001DF3D78B000-memory.dmp

Download

memory/548-289-0x000001DF3D760000-0x000001DF3D78B000-memory.dmp

Download

memory/752-16-0x0000017F5BFC0000-0x0000017F5BFE5000-memory.dmp

Download

memory/752-284-0x0000017F5D1E0000-0x0000017F5D20B000-memory.dmp

Download

memory/752-18-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/752-17-0x0000017F5D1E0000-0x0000017F5D20B000-memory.dmp

Download

memory/856-137-0x000001F831A40000-0x000001F831A6B000-memory.dmp

Download

memory/972-26-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/972-25-0x0000024C2C740000-0x0000024C2C76B000-memory.dmp

Download

memory/972-285-0x0000024C2C740000-0x0000024C2C76B000-memory.dmp

Download

memory/980-286-0x000001CF804E0000-0x000001CF8050B000-memory.dmp

Download

memory/980-23-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/980-22-0x000001CF804E0000-0x000001CF8050B000-memory.dmp

Download

memory/1028-49-0x000001B56D410000-0x000001B56D43B000-memory.dmp

Download

memory/1028-290-0x000001B56D410000-0x000001B56D43B000-memory.dmp

Download

memory/1028-50-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1108-291-0x0000021363D50000-0x0000021363D7B000-memory.dmp

Download

memory/1108-53-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1108-52-0x0000021363D50000-0x0000021363D7B000-memory.dmp

Download

memory/1192-33-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1192-287-0x0000019C3E670000-0x0000019C3E69B000-memory.dmp

Download

memory/1192-32-0x0000019C3E670000-0x0000019C3E69B000-memory.dmp

Download

memory/1236-56-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1236-55-0x000002BD4A690000-0x000002BD4A6BB000-memory.dmp

Download

memory/1236-292-0x000002BD4A690000-0x000002BD4A6BB000-memory.dmp

Download

memory/1284-58-0x0000026462A50000-0x0000026462A7B000-memory.dmp

Download

memory/1284-293-0x0000026462A50000-0x0000026462A7B000-memory.dmp

Download

memory/1284-59-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1364-62-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1364-294-0x000001C421730000-0x000001C42175B000-memory.dmp

Download

memory/1364-61-0x000001C421730000-0x000001C42175B000-memory.dmp

Download

memory/1436-65-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1436-64-0x0000025423F40000-0x0000025423F6B000-memory.dmp

Download

memory/1436-295-0x0000025423F40000-0x0000025423F6B000-memory.dmp

Download

memory/1464-40-0x0000027954540000-0x000002795456B000-memory.dmp

Download

memory/1464-41-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1464-288-0x0000027954540000-0x000002795456B000-memory.dmp

Download

memory/1532-13-0x00007FF9BC3A0000-0x00007FF9BC603000-memory.dmp

Download

memory/1532-14-0x00007FF9BAEF0000-0x00007FF9BAFB7000-memory.dmp

Download

memory/1580-296-0x000002941BB00000-0x000002941BB2B000-memory.dmp

Download

memory/1580-68-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1580-67-0x000002941BB00000-0x000002941BB2B000-memory.dmp

Download

memory/1620-70-0x000001ACB1E60000-0x000001ACB1E8B000-memory.dmp

Download

memory/1620-71-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1620-297-0x000001ACB1E60000-0x000001ACB1E8B000-memory.dmp

Download

memory/1672-73-0x00000188E6BE0000-0x00000188E6C0B000-memory.dmp

Download

memory/1672-298-0x00000188E6BE0000-0x00000188E6C0B000-memory.dmp

Download

memory/1672-74-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1716-11-0x0000017837D90000-0x0000017837DA4000-memory.dmp

Download

memory/1716-300-0x0000017837D30000-0x0000017837D40000-memory.dmp

Download

memory/1716-347-0x00007FF9999B0000-0x00007FF99A354000-memory.dmp

Download

memory/1716-2-0x000001781F3A0000-0x000001781F3CC000-memory.dmp

Download

memory/1716-283-0x00007FF9999B0000-0x00007FF99A354000-memory.dmp

Download

memory/1716-4-0x00007FF9999B0000-0x00007FF99A354000-memory.dmp

Download

memory/1716-15-0x00007FF9999B0000-0x00007FF99A354000-memory.dmp

Download

memory/1716-309-0x00007FF9999B0000-0x00007FF99A354000-memory.dmp

Download

memory/1716-310-0x00007FF9999B0000-0x00007FF99A354000-memory.dmp

Download

memory/1716-311-0x0000017837D30000-0x0000017837D40000-memory.dmp

Download

memory/1716-1-0x00007FF999B3F000-0x00007FF999B40000-memory.dmp

Download

memory/1716-0-0x000001781D5D0000-0x000001781D616000-memory.dmp

Download

memory/1760-77-0x000002262C040000-0x000002262C06B000-memory.dmp

Download

memory/1760-78-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1760-299-0x000002262C040000-0x000002262C06B000-memory.dmp

Download

memory/1812-140-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/1812-139-0x0000021FA38F0000-0x0000021FA391B000-memory.dmp

Download

memory/2052-143-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2052-142-0x000002B73F880000-0x000002B73F8AB000-memory.dmp

Download

memory/2060-146-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2060-145-0x0000026FFEBF0000-0x0000026FFEC1B000-memory.dmp

Download

memory/2084-149-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2084-148-0x000001F889F00000-0x000001F889F2B000-memory.dmp

Download

memory/2180-151-0x0000023BD69A0000-0x0000023BD69CB000-memory.dmp

Download

memory/2180-152-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2280-154-0x000001F5C4EC0000-0x000001F5C4EEB000-memory.dmp

Download

memory/2280-155-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2360-157-0x0000021CEE780000-0x0000021CEE7AB000-memory.dmp

Download

memory/2360-158-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2408-161-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2408-160-0x000002373B7A0000-0x000002373B7CB000-memory.dmp

Download

memory/2452-163-0x00000237D1000000-0x00000237D102B000-memory.dmp

Download

memory/2452-164-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2580-166-0x0000027924880000-0x00000279248AB000-memory.dmp

Download

memory/2580-167-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2628-169-0x00000241A8E60000-0x00000241A8E8B000-memory.dmp

Download

memory/2628-170-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2704-173-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/2704-172-0x0000027F68FA0000-0x0000027F68FCB000-memory.dmp

Download

memory/4976-116-0x000001EE03010000-0x000001EE0303B000-memory.dmp

Download

memory/4976-117-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download

memory/5792-130-0x0000000000760000-0x000000000078B000-memory.dmp

Download

memory/5792-131-0x00007FF97C4E0000-0x00007FF97C4F0000-memory.dmp

Download