njrat | 647420e5a5f8aa487361a52868beac61d238de7f0e58aee4308d3e14d36b1cfd

Analysis

max time kernel
38s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
discord121.exe
Size 708KB
Sample261105-v98mcassbs
SHA256 647420e5a5f8aa487361a52868beac61d238de7f0e58aee4308d3e14d36b1cfd
MD5 27c0f3efeb7d9434ed777abc18e27fcb
SHA1 916978f91477a049430766ba5c3634aa23a71152
SHA512 189a5b9af7b6a48de5274787813da597fa7487fbd9964203dae4be87e623c162a94bb66178e4a6f9816f51c53edc45a1a6c20bb6e4dab77221d33ce5406494a1
SSDEEP 12288:UfMUqRTLw0jPn8Z8yfJCr9VtkkWEhVA/5/gVziHlBrCbYd8K:d3a8PnFyfJCdW0V+Xb9
TLSH
T1D3F4AF52E2D8476BD4B98B789CB217103B70F4279121D3CF268C15B96E733924E36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution njrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Suspicious use of NtCreateProcessExOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5820 created 5128	5820	WerFault.exe	104

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 776 created 5128	776	svchost.exe	104

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4116	powershell.exe
5128	powershell.exe
3172	powershell.exe
5040	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
5620	dzxfvrbj.1zw.exe
4624	40f2wtvh.yzh.exe
816	AggregatorHost.exe
5580	jpky23oz.5ht.exe
1920	AggregatorHost.exe
3056	dgvbrcqi.mdn.exe
2308	windows .exe
2492	rgxvbtfh.cta.exe
4356	AggregatorHost.exe
5952	yrvc35o2.ufr.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\53$79$73$74$65$6d$33$32 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	AggregatorHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\53$79$73$74$65$6d$33$32 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\explorer\\WmiPrvSE.exe"	AggregatorHost.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\MasonAggregatorHost.exe	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Masonwindows .exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineCoreUAC{78F388DB-0303-4HAE-A80B-51537E33362A}	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02jxmirgykmhjbcl\Provision Thursday, November 05, 2026 17:42:42 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAFEjWruPvrUmsznqaGT3L2AAAAAACAAAAAAAQZgAAAAEAACAAAACDsbElCdcpd4xV8cmAwLP86g4W3zEq31ojt3+jb0Qz5wAAAAAOgAAAAAIAACAAAACubwo+hQPROh693ID2kPD215IEP9LqZ2H+cSbyualUPiAAAACRwwDAd5Ysf4owT0D4u871uM/3H7Ygqt4aQtpvbtMxoUAAAAAGHs4f+9cBxmQ0SRK+ac90ShL7ZXv3/xUImztpiyEPP+nM9Gxm2mLT3AS/pFlNHBTnGz+yzFRrOQu2EyoRmfEZ"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02iarfgvdupqlycj\Provision Thursday, November 05, 2026 17:42:42 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAFEjWruPvrUmsznqaGT3L2AAAAAACAAAAAAAQZgAAAAEAACAAAAAio3Wsv5H4NVS1Yv4CoF3uaO7CpFpY5Vephflgu924IAAAAAAOgAAAAAIAACAAAAC+vymWz2yoACTGnoEsGyHxsceynw/7ot0OmhNWVb/h1yAAAADRoe0yw9ajGsKgbQ4hUOrs1r2ftyI5BrznQPZXOM3mD0AAAACULQI+qbP5YCMPIRp9o7pQJA+2s0g13O3oTVXEkTSpy6pstt+qY/AZIA33/R7SX/Qv+nEIyv6xaZt0nUGZZpUX"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02iarfgvdupqlycj	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={E2530C13-D31D-4268-9DDE-4CB2A1D79137}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02djtdqoepqbqifc	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 04 Nov 2026 08:31:11 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02nyjhozzkxuiikt\AppIdList	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02jxmirgykmhjbcl	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02djtdqoepqbqifc\Provision Thursday, November 05, 2026 17:42:43 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAFEjWruPvrUmsznqaGT3L2AAAAAACAAAAAAAQZgAAAAEAACAAAADuZ9GEMUdmEMLbyhE2ta4SxPa345luJ3Vd98JiyEcCiAAAAAAOgAAAAAIAACAAAACdmiBNIOHVrZSQiEBX1ePyv7tU14RNB1mh68NDA4Eo4CAAAADQyQPL7DA9SgreWaGqrYA44T+LKCKP40mQI8gB0/DxR0AAAACUWO+8M2maPnW1Uy7DgPBtWldFb87JDrrE3lliJAfkcYo5gHvXhVPB7Eg+87qfH5EryU/Smzx7LVOqi8AVRI+5"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02hckuxazvacbhuh	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1793900579"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02hckuxazvacbhuh\Provision Thursday, November 05, 2026 17:42:43 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAFEjWruPvrUmsznqaGT3L2AAAAAACAAAAAAAQZgAAAAEAACAAAAAVHeRd7RSvVJb7O8ie8bJQNSJgq0acl1XfJYabaaf78AAAAAAOgAAAAAIAACAAAADqawm+9yiYA4pY4TQKeBKZZ/cbxDkDdLqvr3W7UHxUHyAAAAAfQB0eYnB9YhzdIeFEGVJlQybd/kT/vgDwE8lORvDvoEAAAACVG2icqRq4sqlSbDRoyRzPnhz+h+fNVj/S7c5iaXI54pLX9EEfRAh4Qf1+WrC+sI4wyrGgF1q2uyuGuPqvlur/"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2848	SCHTASKS.exe
1788	SCHTASKS.exe
1388	SCHTASKS.exe
1448	SCHTASKS.exe
2956	SCHTASKS.exe
3028	SCHTASKS.exe
5256	SCHTASKS.exe
4944	SCHTASKS.exe
2368	SCHTASKS.exe
3384	SCHTASKS.exe
2460	SCHTASKS.exe
1348	SCHTASKS.exe
1344	SCHTASKS.exe
5860	SCHTASKS.exe
1712	SCHTASKS.exe
6028	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
4116	powershell.exe
4116	powershell.exe
5620	dzxfvrbj.1zw.exe
5620	dzxfvrbj.1zw.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4116	powershell.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4116	powershell.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4116	powershell.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4116	powershell.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
5100	wmiprvse.exe
5100	wmiprvse.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4116	powershell.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe
4624	40f2wtvh.yzh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3592	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	discord121.exe
Token: SeDebugPrivilege	5620	dzxfvrbj.1zw.exe
Token: SeDebugPrivilege	4624	40f2wtvh.yzh.exe
Token: SeDebugPrivilege	1236	discord121.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeIncreaseQuotaPrivilege	4116	powershell.exe
Token: SeSecurityPrivilege	4116	powershell.exe
Token: SeTakeOwnershipPrivilege	4116	powershell.exe
Token: SeLoadDriverPrivilege	4116	powershell.exe
Token: SeSystemProfilePrivilege	4116	powershell.exe
Token: SeSystemtimePrivilege	4116	powershell.exe
Token: SeProfSingleProcessPrivilege	4116	powershell.exe
Token: SeIncBasePriorityPrivilege	4116	powershell.exe
Token: SeCreatePagefilePrivilege	4116	powershell.exe
Token: SeBackupPrivilege	4116	powershell.exe
Token: SeRestorePrivilege	4116	powershell.exe
Token: SeShutdownPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeSystemEnvironmentPrivilege	4116	powershell.exe
Token: SeRemoteShutdownPrivilege	4116	powershell.exe
Token: SeUndockPrivilege	4116	powershell.exe
Token: SeManageVolumePrivilege	4116	powershell.exe
Token: 33	4116	powershell.exe
Token: 34	4116	powershell.exe
Token: 35	4116	powershell.exe
Token: 36	4116	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe
Token: SeSecurityPrivilege	3676	svchost.exe
Token: SeTakeOwnershipPrivilege	3676	svchost.exe
Token: SeLoadDriverPrivilege	3676	svchost.exe
Token: SeSystemtimePrivilege	3676	svchost.exe
Token: SeBackupPrivilege	3676	svchost.exe
Token: SeRestorePrivilege	3676	svchost.exe
Token: SeShutdownPrivilege	3676	svchost.exe
Token: SeSystemEnvironmentPrivilege	3676	svchost.exe
Token: SeUndockPrivilege	3676	svchost.exe
Token: SeManageVolumePrivilege	3676	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3676	svchost.exe
Token: SeIncreaseQuotaPrivilege	3676	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5908	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 5620	1028	discord121.exe	89
PID 1028 wrote to memory of 4944	1028	discord121.exe	90
PID 5620 wrote to memory of 752	5620	dzxfvrbj.1zw.exe	5
PID 5620 wrote to memory of 960	5620	dzxfvrbj.1zw.exe	9
PID 5620 wrote to memory of 968	5620	dzxfvrbj.1zw.exe	10
PID 5620 wrote to memory of 360	5620	dzxfvrbj.1zw.exe	11
PID 5620 wrote to memory of 1032	5620	dzxfvrbj.1zw.exe	13
PID 5620 wrote to memory of 1164	5620	dzxfvrbj.1zw.exe	14
PID 5620 wrote to memory of 1240	5620	dzxfvrbj.1zw.exe	15
PID 5620 wrote to memory of 1308	5620	dzxfvrbj.1zw.exe	16
PID 5620 wrote to memory of 1328	5620	dzxfvrbj.1zw.exe	17
PID 5620 wrote to memory of 1352	5620	dzxfvrbj.1zw.exe	18
PID 5620 wrote to memory of 1476	5620	dzxfvrbj.1zw.exe	20
PID 5620 wrote to memory of 1516	5620	dzxfvrbj.1zw.exe	21
PID 5620 wrote to memory of 1604	5620	dzxfvrbj.1zw.exe	22
PID 5620 wrote to memory of 1624	5620	dzxfvrbj.1zw.exe	23
PID 5620 wrote to memory of 1648	5620	dzxfvrbj.1zw.exe	24
PID 1028 wrote to memory of 1344	1028	discord121.exe	93
PID 5620 wrote to memory of 1664	5620	dzxfvrbj.1zw.exe	25
PID 5620 wrote to memory of 1692	5620	dzxfvrbj.1zw.exe	26
PID 5620 wrote to memory of 1936	5620	dzxfvrbj.1zw.exe	28
PID 5620 wrote to memory of 2036	5620	dzxfvrbj.1zw.exe	29
PID 5620 wrote to memory of 1996	5620	dzxfvrbj.1zw.exe	30
PID 5620 wrote to memory of 2072	5620	dzxfvrbj.1zw.exe	31
PID 5620 wrote to memory of 2088	5620	dzxfvrbj.1zw.exe	32
PID 5620 wrote to memory of 2228	5620	dzxfvrbj.1zw.exe	33
PID 5620 wrote to memory of 2296	5620	dzxfvrbj.1zw.exe	34
PID 5620 wrote to memory of 2344	5620	dzxfvrbj.1zw.exe	35
PID 5620 wrote to memory of 2452	5620	dzxfvrbj.1zw.exe	36
PID 5620 wrote to memory of 2548	5620	dzxfvrbj.1zw.exe	37
PID 5620 wrote to memory of 2564	5620	dzxfvrbj.1zw.exe	38
PID 5620 wrote to memory of 2688	5620	dzxfvrbj.1zw.exe	39
PID 5620 wrote to memory of 2732	5620	dzxfvrbj.1zw.exe	40
PID 5620 wrote to memory of 2760	5620	dzxfvrbj.1zw.exe	41
PID 5620 wrote to memory of 2788	5620	dzxfvrbj.1zw.exe	42
PID 5620 wrote to memory of 2936	5620	dzxfvrbj.1zw.exe	43
PID 5620 wrote to memory of 2180	5620	dzxfvrbj.1zw.exe	44
PID 5620 wrote to memory of 2676	5620	dzxfvrbj.1zw.exe	45
PID 5620 wrote to memory of 3136	5620	dzxfvrbj.1zw.exe	47
PID 5620 wrote to memory of 3156	5620	dzxfvrbj.1zw.exe	48
PID 5620 wrote to memory of 3468	5620	dzxfvrbj.1zw.exe	50
PID 5620 wrote to memory of 3544	5620	dzxfvrbj.1zw.exe	51
PID 5620 wrote to memory of 3552	5620	dzxfvrbj.1zw.exe	52
PID 5620 wrote to memory of 3640	5620	dzxfvrbj.1zw.exe	53
PID 5620 wrote to memory of 3652	5620	dzxfvrbj.1zw.exe	54
PID 5620 wrote to memory of 3676	5620	dzxfvrbj.1zw.exe	55
PID 5620 wrote to memory of 3696	5620	dzxfvrbj.1zw.exe	56
PID 5620 wrote to memory of 3308	5620	dzxfvrbj.1zw.exe	57
PID 5620 wrote to memory of 1224	5620	dzxfvrbj.1zw.exe	58
PID 5620 wrote to memory of 4360	5620	dzxfvrbj.1zw.exe	59
PID 5620 wrote to memory of 4408	5620	dzxfvrbj.1zw.exe	60
PID 5620 wrote to memory of 4472	5620	dzxfvrbj.1zw.exe	61
PID 5620 wrote to memory of 4704	5620	dzxfvrbj.1zw.exe	62
PID 5620 wrote to memory of 4744	5620	dzxfvrbj.1zw.exe	63
PID 5620 wrote to memory of 5024	5620	dzxfvrbj.1zw.exe	64
PID 5620 wrote to memory of 5140	5620	dzxfvrbj.1zw.exe	65
PID 5620 wrote to memory of 5204	5620	dzxfvrbj.1zw.exe	66
PID 5620 wrote to memory of 5244	5620	dzxfvrbj.1zw.exe	67
PID 5620 wrote to memory of 5604	5620	dzxfvrbj.1zw.exe	70
PID 5620 wrote to memory of 5440	5620	dzxfvrbj.1zw.exe	72
PID 5620 wrote to memory of 5432	5620	dzxfvrbj.1zw.exe	74
PID 5620 wrote to memory of 4184	5620	dzxfvrbj.1zw.exe	75
PID 5620 wrote to memory of 3352	5620	dzxfvrbj.1zw.exe	78
PID 5620 wrote to memory of 3064	5620	dzxfvrbj.1zw.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:752
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:960
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1164

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:968

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e3b698e6-8b34-4259-8cb5-f17b4c7307a0 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a5c1de0d-db80-44ee-89fd-fd4a5ab3837e -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-120c65ff-a136-45d9-9610-7302286c4e50 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-167ea6f8-c081-4b3c-b9ce-80e56703b9bf -LifetimeId:98c55750-4f5c-48bb-89da-d9a9b385d972 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1604
- C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
  "C:\Users\Admin\AppData\Roaming\AggregatorHost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\dgvbrcqi.mdn.exe
    "C:\Users\Admin\AppData\Local\Temp\dgvbrcqi.mdn.exe"
    3⤵
    - Executes dropped EXE
    PID:3056
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1448
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\windows .exe
    "C:\Users\Admin\AppData\Local\Temp\windows .exe"
    3⤵
    - Executes dropped EXE
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\rgxvbtfh.cta.exe
      "C:\Users\Admin\AppData\Local\Temp\rgxvbtfh.cta.exe"
      4⤵
      Executes dropped EXE
      PID:2492
  - - C:\Windows\system32\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "Masonwindows .exe" /tr "'C:\Users\Admin\AppData\Local\Temp\windows .exe'" /sc onlogon /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3028
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2336
  - - C:\Windows\system32\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "Masonwindows .exe" /tr "'C:\Users\Admin\AppData\Local\Temp\windows .exe'" /sc onlogon /rl HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5256
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3172
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AggregatorHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5040
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5304
- C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
  "C:\Users\Admin\AppData\Roaming\AggregatorHost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\yrvc35o2.ufr.exe
    "C:\Users\Admin\AppData\Local\Temp\yrvc35o2.ufr.exe"
    3⤵
    - Executes dropped EXE
    PID:5952
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2848
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2884
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1712
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2628
- C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
  "C:\Users\Admin\AppData\Roaming\AggregatorHost.exe"
  2⤵
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\vzcbxjl1.zlk.exe
    "C:\Users\Admin\AppData\Local\Temp\vzcbxjl1.zlk.exe"
    3⤵
    PID:5676
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1788
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1348
- C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
  "C:\Users\Admin\AppData\Roaming\AggregatorHost.exe"
  2⤵
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\jwsjrjis.hg4.exe
    "C:\Users\Admin\AppData\Local\Temp\jwsjrjis.hg4.exe"
    3⤵
    PID:2468
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1936
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5228
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\discord121.exe
      "C:\Users\Admin\AppData\Local\Temp\discord121.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\dzxfvrbj.1zw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dzxfvrbj.1zw.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5620
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masondiscord121.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\discord121.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4944
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masondiscord121.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\discord121.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1344
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AggregatorHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5128
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4076
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5128 -s 408
        6⤵
        
        PID:3444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2564
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:5024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2936

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3156

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1224

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4704

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5140

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5204

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5432

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3352

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4304

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4464

C:\Users\Admin\AppData\Local\Temp\discord121.exe
"C:\Users\Admin\AppData\Local\Temp\discord121.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1236
- C:\Users\Admin\AppData\Local\Temp\40f2wtvh.yzh.exe
  "C:\Users\Admin\AppData\Local\Temp\40f2wtvh.yzh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Masondiscord121.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\discord121.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:892
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Masondiscord121.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\discord121.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2636

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 548 -p 5128 -ip 5128
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:5820

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4984

C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
1⤵
- Executes dropped EXE
PID:816
- C:\Users\Admin\AppData\Local\Temp\jpky23oz.5ht.exe
  "C:\Users\Admin\AppData\Local\Temp\jpky23oz.5ht.exe"
  2⤵
  - Executes dropped EXE
  PID:5580
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4392
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "MasonAggregatorHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1376

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1000

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1832

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.adbd518b-2093-481b-a514-cd18876a8cd7.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.adbd518b-2093-481b-a514-cd18876a8cd7.tmp.csv
Size 40KB
SHA256 6054f1c4ca2a947b72c4c40ac71a21323b3544a615eb38a415bde3a9e671fb58
MD5 46fb07092c3bb0524f17ef57061b0ade
SHA1 4e15626693c6fe16ed3a59ca1c02b69d1222ab2a
SHA512 d9c141b9d9d2b4ec3ae56b1996e174cb64cd63b5f03c5c46c5722a2fd6c7d1091da91ab9a1f9b570b1655df5b0a0f90cd03f9cda2e147222278cf82f3a928a7e
SSDEEP 768:8GZFpfkGIgguGqChYSI2wQKgL5sd8rInFHTcn5+vx4CG0Vh:8GlknggCFSISSd8rAHrvx4YVh
TLSH
T14813363ECEE9023FC2B6DA1CC4E6460BF854A853361EED5DA4D3278A4557583BCD026E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.f92c991a-5b5f-4e0e-9352-9398b4b8f3d0.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f92c991a-5b5f-4e0e-9352-9398b4b8f3d0.tmp.txt
Size 13KB
SHA256 7d00ee1567bc65769d9ac52b11a91254685c99af7e6af22594a8cd2b0144c90f
MD5 36b8a5a46de54bb6112252b9bd33cc3b
SHA1 4be33667d6e50b6732be86c995b8f3154fc885bf
SHA512 32f6023569c1e19298485278c8fa0b7e26bbefa1dadb10ce441d4016e57cec8767fac7850c8a84e0a181632acd42359ee06a8b4c3bb798704f973d9b370b8ae6
SSDEEP 96:4ief5W0kpoKYfYIWNnHWYEZabtCizFMuvcwJ8G2fankQMEYLInE3:NefIzIcxAG4ankQMEYEnE3
TLSH
T11152525616E80359F2F75E84A5F020A59773F872AE39CA4D00DE130E87E3E41D865FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 177e06616404dba726903467964acc7747851dcc8220c628123fb5bb74b730e1
MD5 3f7b31439699dc01cc7d170e4d1c45ad
SHA1 8e9084aec5d2b3ae9e512c8d3cfe5b3438ff01a7
SHA512 6a6ae1ca1bff6105b72c97a3f147c39593fd15653ed0705ebee4533c432be1c7b31548fcc0d1e039bb465c2a42a18d28340f488c024cfef4582e96a5833cbeb0
TLSH
T110216833B3DD8624CC9A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lojhpmty.lvj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lojhpmty.lvj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dzxfvrbj.1zw.exe

Path C:\Users\Admin\AppData\Local\Temp\dzxfvrbj.1zw.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AggregatorHost.exe

Path C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
Size 708KB
SHA256 647420e5a5f8aa487361a52868beac61d238de7f0e58aee4308d3e14d36b1cfd
MD5 27c0f3efeb7d9434ed777abc18e27fcb
SHA1 916978f91477a049430766ba5c3634aa23a71152
SHA512 189a5b9af7b6a48de5274787813da597fa7487fbd9964203dae4be87e623c162a94bb66178e4a6f9816f51c53edc45a1a6c20bb6e4dab77221d33ce5406494a1
SSDEEP 12288:UfMUqRTLw0jPn8Z8yfJCr9VtkkWEhVA/5/gVziHlBrCbYd8K:d3a8PnFyfJCdW0V+Xb9
TLSH
T1D3F4AF52E2D8476BD4B98B789CB217103B70F4279121D3CF268C15B96E733924E36BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonAggregatorHost.exe

Path C:\Windows\System32\Tasks\MasonAggregatorHost.exe
Size 3KB
SHA256 f6e6e77c3d32bf8bc8e55345121d221bad1f269c2010795a85b5400b808d6f7d
MD5 321d2d179c15eaf257ba70b6e2c4036f
SHA1 9b8de4911269c571b477b0a50758982af4911b62
SHA512 c795ca0522243a17588b5c2a131f2d2aa79f1cbbda5129a44c169ce9228018cdd95994f18e504b87ee2d75549221602186f8fcb04dc50a706fbc1f85f40a8059
TLSH
T18561585367EE1109F2F76B6CAEB710228A67BD555939C46D00AC240DCBF3E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Masonwindows .exe

Path C:\Windows\System32\Tasks\Masonwindows .exe
Size 3KB
SHA256 1e7764b9484df2de9359f108468ac6f42452d7fa0a022662313eaa377b33f2ee
MD5 12b315fcb15a563e3485e27f6f3d1b97
SHA1 0f0bb207129b172b442ecb5675cc82de7d456fbc
SHA512 68ab1a7c7259e8af46fa6de9e2dc564c98b2dbd101f16fed25f8afbbf635dd9d2391dd04bc8b2727783c1e4da0d093821cd4820e00599bf375ab2cd14308330b
TLSH
T13B616B5367EE1109F2F76B1CAEB710618E67BD555939C46D00AC240DCBF3E2285607BB
MD5 SHA1 SHA512 TLSH

Submit Download

MicrosoftEdgeUpdateTaskMachineCoreUAC{78F388DB-0303-4HAE-A80B-51537E33362A}

Path C:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineCoreUAC{78F388DB-0303-4HAE-A80B-51537E33362A}
Size 3KB
SHA256 f4a5139b1fa4ddda769415cfaa6fbe58403eccc7c3889eb5c3a711da28295045
MD5 fcb8864acb6957142f82abb9a34a731f
SHA1 f9e30aaaaa3fd04364362dc06f16d8c332c334b7
SHA512 fcfb2cfeb5fca717201f1f0a3c9ebe02b1eaebdfcb565e4bba3506f384084a110514dc2708576ffff130543e7952c3917bdfc0deeba6e7be5dcb010afd6509ff
TLSH
T1C3717A5367EE1109F2F36B5CAEB754618E67BC455938C86D00AC240DCBF3E2289A07B7
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 69KB
SHA256 f144a324800a2b3d623e762c3ca11095d4f7cd02c4274199bb22fd2c3bad79bc
MD5 945f6a21d05c42eaacee4c67e37a8ec1
SHA1 e5f6b60c793d09e080774511e12caea6026167c5
SHA512 55fbc188176e9ffaaf391b58ab04b7184c1489f50f6a15dab642484d336eb5e1c8ceb7efc9ee05089bbd74c0ef5798a3dabf3dbe8672a20647ef5c1fbe85ee7f
SSDEEP 1536:r8LgGkPGaXlJAz2YzJQrGANEOoDfXastjCcIyCWCUc3oYm2K2dWDjTaonS5WDTFi:AVPSf
TLSH
T128635D0580DCC509D9B609B27267FEB2C57A659A731F4EEB30ED6304D9C2F042FBA469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-35-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/360-34-0x000001ADD73B0000-0x000001ADD73DB000-memory.dmp

Download

memory/360-65-0x000001ADD73B0000-0x000001ADD73DB000-memory.dmp

Download

memory/360-585-0x000001ADD73B0000-0x000001ADD73DB000-memory.dmp

Download

memory/752-18-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/752-17-0x000001FB3BF00000-0x000001FB3BF2B000-memory.dmp

Download

memory/752-581-0x000001FB3BF00000-0x000001FB3BF2B000-memory.dmp

Download

memory/752-16-0x000001FB3BED0000-0x000001FB3BEF5000-memory.dmp

Download

memory/752-61-0x000001FB3BF00000-0x000001FB3BF2B000-memory.dmp

Download

memory/816-611-0x0000015C870A0000-0x0000015C87156000-memory.dmp

Download

memory/960-23-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/960-62-0x000001F9F9E40000-0x000001F9F9E6B000-memory.dmp

Download

memory/960-582-0x000001F9F9E40000-0x000001F9F9E6B000-memory.dmp

Download

memory/960-22-0x000001F9F9E40000-0x000001F9F9E6B000-memory.dmp

Download

memory/968-26-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/968-63-0x000001904DA50000-0x000001904DA7B000-memory.dmp

Download

memory/968-25-0x000001904DA50000-0x000001904DA7B000-memory.dmp

Download

memory/968-583-0x000001904DA50000-0x000001904DA7B000-memory.dmp

Download

memory/1028-580-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/1028-5-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/1028-1-0x0000026C52350000-0x0000026C52406000-memory.dmp

Download

memory/1028-810-0x0000026C52960000-0x0000026C52970000-memory.dmp

Download

memory/1028-813-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/1028-15-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/1028-2-0x0000026C52860000-0x0000026C5288C000-memory.dmp

Download

memory/1028-319-0x0000026C6CD30000-0x0000026C6CDB6000-memory.dmp

Download

memory/1028-40-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/1028-0-0x00007FF863C6F000-0x00007FF863C70000-memory.dmp

Download

memory/1028-536-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/1028-4-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/1032-586-0x000001E6B9FD0000-0x000001E6B9FFB000-memory.dmp

Download

memory/1032-38-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1032-66-0x000001E6B9FD0000-0x000001E6B9FFB000-memory.dmp

Download

memory/1032-37-0x000001E6B9FD0000-0x000001E6B9FFB000-memory.dmp

Download

memory/1164-32-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1164-584-0x0000025A18E10000-0x0000025A18E3B000-memory.dmp

Download

memory/1164-64-0x0000025A18E10000-0x0000025A18E3B000-memory.dmp

Download

memory/1164-31-0x0000025A18E10000-0x0000025A18E3B000-memory.dmp

Download

memory/1240-50-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1240-588-0x0000028918AE0000-0x0000028918B0B000-memory.dmp

Download

memory/1240-68-0x0000028918AE0000-0x0000028918B0B000-memory.dmp

Download

memory/1240-49-0x0000028918AE0000-0x0000028918B0B000-memory.dmp

Download

memory/1308-69-0x0000024DA3C40000-0x0000024DA3C6B000-memory.dmp

Download

memory/1308-589-0x0000024DA3C40000-0x0000024DA3C6B000-memory.dmp

Download

memory/1308-53-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1308-52-0x0000024DA3C40000-0x0000024DA3C6B000-memory.dmp

Download

memory/1328-55-0x0000013FA8CE0000-0x0000013FA8D0B000-memory.dmp

Download

memory/1328-70-0x0000013FA8CE0000-0x0000013FA8D0B000-memory.dmp

Download

memory/1328-56-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1328-590-0x0000013FA8CE0000-0x0000013FA8D0B000-memory.dmp

Download

memory/1352-591-0x000002C087410000-0x000002C08743B000-memory.dmp

Download

memory/1352-71-0x000002C087410000-0x000002C08743B000-memory.dmp

Download

memory/1352-58-0x000002C087410000-0x000002C08743B000-memory.dmp

Download

memory/1352-59-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1352-1441-0x000002C087410000-0x000002C08743B000-memory.dmp

Download

memory/1476-46-0x000002B1808D0000-0x000002B1808FB000-memory.dmp

Download

memory/1476-47-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1476-587-0x000002B1808D0000-0x000002B1808FB000-memory.dmp

Download

memory/1476-67-0x000002B1808D0000-0x000002B1808FB000-memory.dmp

Download

memory/1516-614-0x0000027EBC710000-0x0000027EBC73B000-memory.dmp

Download

memory/1516-75-0x0000027EBC710000-0x0000027EBC73B000-memory.dmp

Download

memory/1516-76-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1516-85-0x0000027EBC710000-0x0000027EBC73B000-memory.dmp

Download

memory/1604-86-0x000001EDD3E00000-0x000001EDD3E2B000-memory.dmp

Download

memory/1604-78-0x000001EDD3E00000-0x000001EDD3E2B000-memory.dmp

Download

memory/1604-79-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1604-615-0x000001EDD3E00000-0x000001EDD3E2B000-memory.dmp

Download

memory/1624-82-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1624-81-0x00000184CA090000-0x00000184CA0BB000-memory.dmp

Download

memory/1624-87-0x00000184CA090000-0x00000184CA0BB000-memory.dmp

Download

memory/1624-616-0x00000184CA090000-0x00000184CA0BB000-memory.dmp

Download

memory/1648-90-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1648-95-0x00000293F5E20000-0x00000293F5E4B000-memory.dmp

Download

memory/1648-89-0x00000293F5E20000-0x00000293F5E4B000-memory.dmp

Download

memory/1648-802-0x00000293F5E20000-0x00000293F5E4B000-memory.dmp

Download

memory/1664-92-0x000001FC75F40000-0x000001FC75F6B000-memory.dmp

Download

memory/1664-803-0x000001FC75F40000-0x000001FC75F6B000-memory.dmp

Download

memory/1664-96-0x000001FC75F40000-0x000001FC75F6B000-memory.dmp

Download

memory/1664-93-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1692-148-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1692-147-0x000001D790C00000-0x000001D790C2B000-memory.dmp

Download

memory/1824-1633-0x0000010A18850000-0x0000010A18906000-memory.dmp

Download

memory/1920-993-0x0000022D47440000-0x0000022D47490000-memory.dmp

Download

memory/1920-994-0x0000022D48110000-0x0000022D4812A000-memory.dmp

Download

memory/1936-151-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1936-150-0x000002879EB90000-0x000002879EBBB000-memory.dmp

Download

memory/1996-157-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/1996-156-0x0000015B6BDF0000-0x0000015B6BE1B000-memory.dmp

Download

memory/2036-154-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2036-153-0x000001E6727C0000-0x000001E6727EB000-memory.dmp

Download

memory/2072-159-0x00000249B5380000-0x00000249B53AB000-memory.dmp

Download

memory/2072-160-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2088-163-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2088-162-0x0000021A3ADD0000-0x0000021A3ADFB000-memory.dmp

Download

memory/2228-166-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2228-165-0x00000192AAE70000-0x00000192AAE9B000-memory.dmp

Download

memory/2296-169-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2296-168-0x000001B5BF410000-0x000001B5BF43B000-memory.dmp

Download

memory/2308-1018-0x000001770C830000-0x000001770C8E6000-memory.dmp

Download

memory/2344-172-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2344-171-0x000001D207E10000-0x000001D207E3B000-memory.dmp

Download

memory/2452-175-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2452-174-0x000001BAC4880000-0x000001BAC48AB000-memory.dmp

Download

memory/2548-181-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2548-180-0x00000125D3D10000-0x00000125D3D3B000-memory.dmp

Download

memory/2564-177-0x0000020B6D580000-0x0000020B6D5AB000-memory.dmp

Download

memory/2564-178-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2688-183-0x0000022D62720000-0x0000022D6274B000-memory.dmp

Download

memory/2688-184-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/2732-186-0x000002023B7C0000-0x000002023B7EB000-memory.dmp

Download

memory/3172-1224-0x0000022F9D030000-0x0000022F9D0E2000-memory.dmp

Download

memory/4116-518-0x00000208EEB10000-0x00000208EEB1A000-memory.dmp

Download

memory/4116-517-0x00000208EED30000-0x00000208EEDE2000-memory.dmp

Download

memory/4116-516-0x00000208EEAF0000-0x00000208EEB0E000-memory.dmp

Download

memory/4116-398-0x00000208EEA20000-0x00000208EEA42000-memory.dmp

Download

memory/4356-1266-0x00000196A6C70000-0x00000196A6D26000-memory.dmp

Download

memory/5024-133-0x0000021A016F0000-0x0000021A0171B000-memory.dmp

Download

memory/5024-134-0x00007FF846DA0000-0x00007FF846DB0000-memory.dmp

Download

memory/5620-13-0x00007FF886C60000-0x00007FF886EC3000-memory.dmp

Download

memory/5620-14-0x00007FF8854D0000-0x00007FF885597000-memory.dmp

Download