njrat | f8c4193b1cb25b74e1c5ab43baddb70c1c48a014e3cc0d211f0c7949fb4dd35c

Analysis

user interaction
yes
max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/11/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ret.exe
Size 258KB
Sample261112-cwpcfazz4l
SHA256 f8c4193b1cb25b74e1c5ab43baddb70c1c48a014e3cc0d211f0c7949fb4dd35c
MD5 33914a12da1ef51bd213b2f7a68e6958
SHA1 c3d01b941af6eea356d556ac945a97c40cea2630
SHA512 0f43ea4cb59a439e41ad05c2fd812d9ff96c9694ebb14cd82dcdcdda01a815acfdff7c0ae41c89694b6cad35f8a961e3b76e2e18816c5a3f56221d0aa44f694b
SSDEEP 6144:Ozjx/Vz9/5bTgVziHzZnSKrCbYMEOby8Qq:OzjhVh/5/gVziHlBrCbYx8t
TLSH
T11D443966F69000E6D4BE42358CA35B0267B6F4361721EBEF0B95585D3F637E08D29BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim defense_evasion discovery execution njrat persistence trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

21.tcp.cpolar.top:11896

Mutex

1334382bc1c003793e1c7d50b799d8c5

Attributes

reg_key
1334382bc1c003793e1c7d50b799d8c5
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
1256	5ji3h0xu.mse.exe
5392	er55dfxx.nnx.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Masonret.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	ret.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ret.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ret.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1794450375"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 11 Nov 2026 07:01:04 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001840190734FC61"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={96B71400-871E-4827-918F-1BFAC989C5F3}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4804	SCHTASKS.exe
1464	SCHTASKS.exe
5140	SCHTASKS.exe
4512	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
1256	5ji3h0xu.mse.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe
5392	er55dfxx.nnx.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5868	ret.exe
Token: SeDebugPrivilege	1256	5ji3h0xu.mse.exe
Token: SeShutdownPrivilege	2140	explorer.exe
Token: SeCreatePagefilePrivilege	2140	explorer.exe
Token: SeShutdownPrivilege	2140	explorer.exe
Token: SeCreatePagefilePrivilege	2140	explorer.exe
Token: SeDebugPrivilege	5392	er55dfxx.nnx.exe
Token: SeDebugPrivilege	2900	ret.exe
Token: SeShutdownPrivilege	2140	explorer.exe
Token: SeCreatePagefilePrivilege	2140	explorer.exe
Token: SeShutdownPrivilege	2140	explorer.exe
Token: SeCreatePagefilePrivilege	2140	explorer.exe
Token: SeShutdownPrivilege	2140	explorer.exe
Token: SeCreatePagefilePrivilege	2140	explorer.exe
Token: 33	5868	ret.exe
Token: SeIncBasePriorityPrivilege	5868	ret.exe
Token: SeAssignPrimaryTokenPrivilege	3660	svchost.exe
Token: SeIncreaseQuotaPrivilege	3660	svchost.exe
Token: SeSecurityPrivilege	3660	svchost.exe
Token: SeTakeOwnershipPrivilege	3660	svchost.exe
Token: SeLoadDriverPrivilege	3660	svchost.exe
Token: SeSystemtimePrivilege	3660	svchost.exe
Token: SeBackupPrivilege	3660	svchost.exe
Token: SeRestorePrivilege	3660	svchost.exe
Token: SeShutdownPrivilege	3660	svchost.exe
Token: SeSystemEnvironmentPrivilege	3660	svchost.exe
Token: SeUndockPrivilege	3660	svchost.exe
Token: SeManageVolumePrivilege	3660	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3660	svchost.exe
Token: SeIncreaseQuotaPrivilege	3660	svchost.exe
Token: SeSecurityPrivilege	3660	svchost.exe
Token: SeTakeOwnershipPrivilege	3660	svchost.exe
Token: SeLoadDriverPrivilege	3660	svchost.exe
Token: SeSystemtimePrivilege	3660	svchost.exe
Token: SeBackupPrivilege	3660	svchost.exe
Token: SeRestorePrivilege	3660	svchost.exe
Token: SeShutdownPrivilege	3660	svchost.exe
Token: SeSystemEnvironmentPrivilege	3660	svchost.exe
Token: SeUndockPrivilege	3660	svchost.exe
Token: SeManageVolumePrivilege	3660	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3660	svchost.exe
Token: SeIncreaseQuotaPrivilege	3660	svchost.exe
Token: SeSecurityPrivilege	3660	svchost.exe
Token: SeTakeOwnershipPrivilege	3660	svchost.exe
Token: SeLoadDriverPrivilege	3660	svchost.exe
Token: SeSystemtimePrivilege	3660	svchost.exe
Token: SeBackupPrivilege	3660	svchost.exe
Token: SeRestorePrivilege	3660	svchost.exe
Token: SeShutdownPrivilege	3660	svchost.exe
Token: SeSystemEnvironmentPrivilege	3660	svchost.exe
Token: SeUndockPrivilege	3660	svchost.exe
Token: SeManageVolumePrivilege	3660	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3660	svchost.exe
Token: SeIncreaseQuotaPrivilege	3660	svchost.exe
Token: SeSecurityPrivilege	3660	svchost.exe
Token: SeTakeOwnershipPrivilege	3660	svchost.exe
Token: SeLoadDriverPrivilege	3660	svchost.exe
Token: SeSystemtimePrivilege	3660	svchost.exe
Token: SeBackupPrivilege	3660	svchost.exe
Token: SeRestorePrivilege	3660	svchost.exe
Token: SeShutdownPrivilege	3660	svchost.exe
Token: SeSystemEnvironmentPrivilege	3660	svchost.exe
Token: SeUndockPrivilege	3660	svchost.exe
Token: SeManageVolumePrivilege	3660	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 1256	5868	ret.exe	88
PID 5868 wrote to memory of 4804	5868	ret.exe	89
PID 1256 wrote to memory of 744	1256	5ji3h0xu.mse.exe	5
PID 1256 wrote to memory of 952	1256	5ji3h0xu.mse.exe	9
PID 1256 wrote to memory of 960	1256	5ji3h0xu.mse.exe	10
PID 1256 wrote to memory of 972	1256	5ji3h0xu.mse.exe	11
PID 1256 wrote to memory of 1028	1256	5ji3h0xu.mse.exe	13
PID 1256 wrote to memory of 1088	1256	5ji3h0xu.mse.exe	14
PID 1256 wrote to memory of 1144	1256	5ji3h0xu.mse.exe	15
PID 1256 wrote to memory of 1208	1256	5ji3h0xu.mse.exe	16
PID 1256 wrote to memory of 1236	1256	5ji3h0xu.mse.exe	17
PID 1256 wrote to memory of 1288	1256	5ji3h0xu.mse.exe	18
PID 1256 wrote to memory of 1332	1256	5ji3h0xu.mse.exe	19
PID 1256 wrote to memory of 1516	1256	5ji3h0xu.mse.exe	22
PID 1256 wrote to memory of 1540	1256	5ji3h0xu.mse.exe	23
PID 1256 wrote to memory of 1592	1256	5ji3h0xu.mse.exe	24
PID 1256 wrote to memory of 1636	1256	5ji3h0xu.mse.exe	25
PID 1256 wrote to memory of 1820	1256	5ji3h0xu.mse.exe	26
PID 1256 wrote to memory of 1844	1256	5ji3h0xu.mse.exe	27
PID 1256 wrote to memory of 1892	1256	5ji3h0xu.mse.exe	28
PID 1256 wrote to memory of 1972	1256	5ji3h0xu.mse.exe	29
PID 1256 wrote to memory of 2012	1256	5ji3h0xu.mse.exe	30
PID 1256 wrote to memory of 2032	1256	5ji3h0xu.mse.exe	31
PID 1256 wrote to memory of 2100	1256	5ji3h0xu.mse.exe	32
PID 1256 wrote to memory of 2228	1256	5ji3h0xu.mse.exe	33
PID 1256 wrote to memory of 2256	1256	5ji3h0xu.mse.exe	34
PID 1256 wrote to memory of 2316	1256	5ji3h0xu.mse.exe	35
PID 1256 wrote to memory of 2400	1256	5ji3h0xu.mse.exe	36
PID 1256 wrote to memory of 2440	1256	5ji3h0xu.mse.exe	37
PID 1256 wrote to memory of 2524	1256	5ji3h0xu.mse.exe	38
PID 1256 wrote to memory of 2556	1256	5ji3h0xu.mse.exe	39
PID 1256 wrote to memory of 2588	1256	5ji3h0xu.mse.exe	40
PID 1256 wrote to memory of 2668	1256	5ji3h0xu.mse.exe	41
PID 1256 wrote to memory of 2944	1256	5ji3h0xu.mse.exe	42
PID 1256 wrote to memory of 3000	1256	5ji3h0xu.mse.exe	43
PID 1256 wrote to memory of 3028	1256	5ji3h0xu.mse.exe	44
PID 1256 wrote to memory of 1364	1256	5ji3h0xu.mse.exe	45
PID 1256 wrote to memory of 3128	1256	5ji3h0xu.mse.exe	46
PID 1256 wrote to memory of 3232	1256	5ji3h0xu.mse.exe	48
PID 1256 wrote to memory of 3432	1256	5ji3h0xu.mse.exe	50
PID 1256 wrote to memory of 3600	1256	5ji3h0xu.mse.exe	51
PID 1256 wrote to memory of 3632	1256	5ji3h0xu.mse.exe	52
PID 1256 wrote to memory of 3644	1256	5ji3h0xu.mse.exe	53
PID 1256 wrote to memory of 3660	1256	5ji3h0xu.mse.exe	54
PID 1256 wrote to memory of 3672	1256	5ji3h0xu.mse.exe	55
PID 1256 wrote to memory of 3684	1256	5ji3h0xu.mse.exe	56
PID 1256 wrote to memory of 4088	1256	5ji3h0xu.mse.exe	57
PID 1256 wrote to memory of 3156	1256	5ji3h0xu.mse.exe	58
PID 1256 wrote to memory of 4288	1256	5ji3h0xu.mse.exe	59
PID 1256 wrote to memory of 4384	1256	5ji3h0xu.mse.exe	60
PID 1256 wrote to memory of 4404	1256	5ji3h0xu.mse.exe	61
PID 1256 wrote to memory of 4576	1256	5ji3h0xu.mse.exe	62
PID 1256 wrote to memory of 4720	1256	5ji3h0xu.mse.exe	63
PID 1256 wrote to memory of 5104	1256	5ji3h0xu.mse.exe	64
PID 1256 wrote to memory of 5176	1256	5ji3h0xu.mse.exe	65
PID 1256 wrote to memory of 5316	1256	5ji3h0xu.mse.exe	66
PID 1256 wrote to memory of 5508	1256	5ji3h0xu.mse.exe	69
PID 1256 wrote to memory of 4208	1256	5ji3h0xu.mse.exe	71
PID 1256 wrote to memory of 3696	1256	5ji3h0xu.mse.exe	73
PID 1256 wrote to memory of 5064	1256	5ji3h0xu.mse.exe	74
PID 1256 wrote to memory of 6040	1256	5ji3h0xu.mse.exe	77
PID 1256 wrote to memory of 1152	1256	5ji3h0xu.mse.exe	78
PID 1256 wrote to memory of 4256	1256	5ji3h0xu.mse.exe	79
PID 1256 wrote to memory of 2140	1256	5ji3h0xu.mse.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:960
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1144

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:952

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c38d6c03-f655-4d4c-a49b-54e4d53a38d4 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0c588d4e-7c7e-4594-a3d1-aef7cc6b4767 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-99ddbe9b-3c1a-47e6-af8e-fe6974bab8a0 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-90faced6-0e22-4318-a80f-b771b78949e0 -LifetimeId:915d2d36-38a6-443b-b0d7-cc472d5444a8 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1972
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4256
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\ret.exe
      "C:\Users\Admin\AppData\Local\Temp\ret.exe"
      4⤵
      Enumerates video capture drivers
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\5ji3h0xu.mse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5ji3h0xu.mse.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1256
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masonret.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\ret.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4804
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4340
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Masonret.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\ret.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1464
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2440
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:000000000000026C;0000000000000270;
  2⤵
  PID:5104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:1364

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3232

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:4088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3156

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4384

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4576

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4720

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5176

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:6040

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1152

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:3056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3544

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4912

C:\Users\Admin\AppData\Local\Temp\ret.exe
"C:\Users\Admin\AppData\Local\Temp\ret.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900
- C:\Users\Admin\AppData\Local\Temp\er55dfxx.nnx.exe
  "C:\Users\Admin\AppData\Local\Temp\er55dfxx.nnx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Masonret.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\ret.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1688
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Masonret.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\ret.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4512
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4700

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5ji3h0xu.mse.exe

Path C:\Users\Admin\AppData\Local\Temp\5ji3h0xu.mse.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 9cffada15519c5421518469bd8c626850192d689c18bd3b75a9cee28a0c7d71a
MD5 39b802aa06d36499bacbcbbafb55570d
SHA1 71cc8b0a01550f8c01f223d115937bdc00406996
SHA512 9ee9b3971c98127055e74f927dd807bb9c9eec2237b4a91d2df0acceda3223757ee494dfd4810118813da779fd625e286092c4e96a0de0f08250042400af9d32
TLSH
T1EAE0C2217BE40600F1332B3CBD72618A063BB627F901CA8E0B38008C6D39B34C83231E
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 cb9a352fd2fd7a39d1d29f0fc47b642a3e4ed11805f8bf69bd0d28c216d7276d
MD5 4540d0d10b8d95f5b181e52e596613de
SHA1 b0bcf38f99d45c3f6d58199d98c15987e29466f1
SHA512 45b3a3fd380889ea28b4636da71e619268cb12a073ce989c59b30466a432ed29d0c37a4dad1bc260db1036406fc1fd30432b407fd8d2b6fdd6e3b9955a92df37
TLSH
T1E7E0C02451FF511CF4E4D03987D978220A99F0610409F3FD1AE15B04660B680EC02934
MD5 SHA1 SHA512 TLSH

Submit Download

memory/744-514-0x0000023686660000-0x000002368668B000-memory.dmp

Download

memory/744-19-0x0000023686660000-0x000002368668B000-memory.dmp

Download

memory/744-284-0x0000023686660000-0x000002368668B000-memory.dmp

Download

memory/744-20-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/744-16-0x0000023686630000-0x0000023686655000-memory.dmp

Download

memory/952-23-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/952-515-0x000002C05DE70000-0x000002C05DE9B000-memory.dmp

Download

memory/952-22-0x000002C05DE70000-0x000002C05DE9B000-memory.dmp

Download

memory/952-285-0x000002C05DE70000-0x000002C05DE9B000-memory.dmp

Download

memory/960-286-0x0000020780610000-0x000002078063B000-memory.dmp

Download

memory/960-25-0x0000020780610000-0x000002078063B000-memory.dmp

Download

memory/960-26-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/972-105-0x000001D77ED60000-0x000001D77ED8B000-memory.dmp

Download

memory/972-106-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1028-109-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1028-108-0x0000012124EB0000-0x0000012124EDB000-memory.dmp

Download

memory/1088-112-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1088-111-0x00000203E5E90000-0x00000203E5EBB000-memory.dmp

Download

memory/1144-33-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1144-287-0x000002C3FF7A0000-0x000002C3FF7CB000-memory.dmp

Download

memory/1144-516-0x000002C3FF7A0000-0x000002C3FF7CB000-memory.dmp

Download

memory/1144-32-0x000002C3FF7A0000-0x000002C3FF7CB000-memory.dmp

Download

memory/1208-114-0x0000018048720000-0x000001804874B000-memory.dmp

Download

memory/1208-115-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1236-118-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1236-117-0x0000024E47A60000-0x0000024E47A8B000-memory.dmp

Download

memory/1256-13-0x00007FF8C2A20000-0x00007FF8C2C83000-memory.dmp

Download

memory/1256-14-0x00007FF8C1170000-0x00007FF8C1237000-memory.dmp

Download

memory/1288-120-0x0000027CD6F40000-0x0000027CD6F6B000-memory.dmp

Download

memory/1288-121-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1332-123-0x0000019DE8690000-0x0000019DE86BB000-memory.dmp

Download

memory/1332-124-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1516-126-0x000002A7DF730000-0x000002A7DF75B000-memory.dmp

Download

memory/1516-127-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1540-130-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1540-129-0x000001D51DC60000-0x000001D51DC8B000-memory.dmp

Download

memory/1592-42-0x0000015804660000-0x000001580468B000-memory.dmp

Download

memory/1592-288-0x0000015804660000-0x000001580468B000-memory.dmp

Download

memory/1592-43-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1636-133-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1636-132-0x000001D865BF0000-0x000001D865C1B000-memory.dmp

Download

memory/1820-136-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1820-135-0x000001841B2C0000-0x000001841B2EB000-memory.dmp

Download

memory/1844-138-0x0000026A7D840000-0x0000026A7D86B000-memory.dmp

Download

memory/1844-139-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1892-141-0x0000028984760000-0x000002898478B000-memory.dmp

Download

memory/1892-142-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1972-145-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/1972-144-0x0000014ABE780000-0x0000014ABE7AB000-memory.dmp

Download

memory/2012-148-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2012-147-0x000002069F060000-0x000002069F08B000-memory.dmp

Download

memory/2032-150-0x00000206E3AB0000-0x00000206E3ADB000-memory.dmp

Download

memory/2032-151-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2100-154-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2100-153-0x0000020D07ED0000-0x0000020D07EFB000-memory.dmp

Download

memory/2140-518-0x0000000001310000-0x000000000133B000-memory.dmp

Download

memory/2140-290-0x0000000001310000-0x000000000133B000-memory.dmp

Download

memory/2140-97-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2140-96-0x0000000001310000-0x000000000133B000-memory.dmp

Download

memory/2228-157-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2228-156-0x0000026E137D0000-0x0000026E137FB000-memory.dmp

Download

memory/2256-159-0x0000022273EC0000-0x0000022273EEB000-memory.dmp

Download

memory/2256-160-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2316-162-0x0000020326B40000-0x0000020326B6B000-memory.dmp

Download

memory/2316-163-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2400-165-0x0000021218AA0000-0x0000021218ACB000-memory.dmp

Download

memory/2400-166-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2440-169-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2440-168-0x00000145033F0000-0x000001450341B000-memory.dmp

Download

memory/2524-172-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/2524-171-0x000001C957570000-0x000001C95759B000-memory.dmp

Download

memory/2556-174-0x000001FA58A20000-0x000001FA58A4B000-memory.dmp

Download

memory/2900-311-0x0000013D8BD80000-0x0000013D8BDC6000-memory.dmp

Download

memory/5104-517-0x0000016CD01C0000-0x0000016CD01EB000-memory.dmp

Download

memory/5104-84-0x00007FF882B60000-0x00007FF882B70000-memory.dmp

Download

memory/5104-289-0x0000016CD01C0000-0x0000016CD01EB000-memory.dmp

Download

memory/5104-83-0x0000016CD01C0000-0x0000016CD01EB000-memory.dmp

Download

memory/5868-507-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5868-15-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5868-508-0x000001F9FFFE0000-0x000001F9FFFF0000-memory.dmp

Download

memory/5868-512-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5868-513-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5868-339-0x000001F9998F0000-0x000001F999906000-memory.dmp

Download

memory/5868-0-0x00007FF89FD7F000-0x00007FF89FD80000-memory.dmp

Download

memory/5868-5-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5868-4-0x00007FF89FBF0000-0x00007FF8A0594000-memory.dmp

Download

memory/5868-1-0x000001F9FEE10000-0x000001F9FEE56000-memory.dmp

Download

memory/5868-529-0x000001F9FFFE0000-0x000001F9FFFF0000-memory.dmp

Download

memory/5868-531-0x000001F99A530000-0x000001F99A544000-memory.dmp

Download

memory/5868-2-0x000001F9FF2A0000-0x000001F9FF2CC000-memory.dmp

Download