hijackloader | f3176e0859ba92049dcd57685c1b5f49b97183ff49fcc79f2ce4ad2b31d2d843

Analysis

max time kernel
835s
max time network
837s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vortax App Setup.exe
Size

47.3MB
MD5

cab622641242a6f2fcbb8a1ae2698fd2
SHA1

9d56b54643706787c16f0cae4e9e565c1e1a49ec
SHA256

f3176e0859ba92049dcd57685c1b5f49b97183ff49fcc79f2ce4ad2b31d2d843
SHA512

324ad8a7669d15ef19d0c1d7b362d17f2118414b4e8672921fe45994db0425200a38e26fc4c169ecb19f7c4aa8233fc5dfd32c3cb32e600cc031139d0e530cf1
SSDEEP

786432:MXCn7F7DZHw0SLuXUG6fssNb8ReGJqznv+DGODFjupn5oZfikV6PH2fLbTvkw0Y7:MyRPZQ5LKQ0sNGWO1FpZf+PH67vkoGKL

Score

10^/10

hijackloader stealc vor16 discovery execution loader spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

vor16

http://89.105.198.134

Attributes

url_path
/244cbe83570df263.php

Signatures

Detects HijackLoader (aka IDAT Loader) 6 IoCs

resource	yara_rule
behavioral1/memory/1544-758-0x0000000000400000-0x0000000000691000-memory.dmp	family_hijackloader
behavioral1/memory/1544-759-0x0000000000400000-0x0000000000691000-memory.dmp	family_hijackloader
behavioral1/memory/2972-822-0x0000000140000000-0x000000014015F000-memory.dmp	family_hijackloader
behavioral1/files/0x000400000001dae8-907.dat	family_hijackloader
behavioral1/memory/1588-910-0x0000000000400000-0x0000000000691000-memory.dmp	family_hijackloader
behavioral1/memory/1996-929-0x0000000140000000-0x000000014015F000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2480	powershell.exe
2420	powershell.exe
2676	powershell.exe
1272	powershell.exe
1612	powershell.exe
844	powershell.exe
2944	powershell.exe
2616	powershell.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x000500000001c940-689.dat	net_reactor

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Downloads MZ/PE file

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 2036	1544	snss1.exe	42
PID 2972 set thread context of 1472	2972	snss2.exe	48
PID 1588 set thread context of 1612	1588	snss1.exe	69
PID 1996 set thread context of 2772	1996	snss2.exe	75

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Vortax\PresentationFramework-SystemCore.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.WebClient.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\de\PresentationUI.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ja\UIAutomationClientSideProviders.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\Microsoft.DiaSymReader.Native.amd64.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Threading.Tasks.Dataflow.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\tr\UIAutomationClient.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\PresentationFramework.Aero.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Private.DataContractSerialization.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.ComponentModel.DataAnnotations.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Xml.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\es\WindowsBase.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ja\System.Xaml.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\zh-Hant\WindowsFormsIntegration.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Configuration.ConfigurationManager.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\tr\WindowsFormsIntegration.resources.dll	Vortax App Setup.exe
File opened for modification	C:\Program Files (x86)\Vortax\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Program Files (x86)\Vortax\it\System.Windows.Input.Manipulations.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.Security.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\UIAutomationClientSideProviders.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ko\ReachFramework.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\de\System.Windows.Controls.Ribbon.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Linq.Queryable.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Principal.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Windows.Controls.Ribbon.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\pt-BR\System.Windows.Forms.Design.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.IO.Compression.FileSystem.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Private.CoreLib.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\mscordaccore_amd64_amd64_8.0.23.53103.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\cs\WindowsFormsIntegration.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\fr\System.Windows.Controls.Ribbon.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\PresentationUI.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\PresentationFramework-SystemXmlLinq.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Cryptography.Encoding.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ja\System.Windows.Input.Manipulations.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ko\UIAutomationClient.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\pl\UIAutomationTypes.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.IO.FileSystem.DriveInfo.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Configuration.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Runtime.CompilerServices.VisualC.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ja\PresentationCore.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ko\UIAutomationTypes.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\DirectWriteForwarder.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.IO.Packaging.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Cryptography.Primitives.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.ValueTuple.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\WindowsFormsIntegration.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.DirectoryServices.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.Primitives.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\UIAutomationClientSideProviders.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\ja\System.Windows.Forms.Design.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\PresentationFramework.Aero2.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Cryptography.Cng.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Threading.Thread.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Net.ServicePoint.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\System.Windows.Controls.Ribbon.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\it\System.Windows.Forms.Primitives.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\pt-BR\WindowsBase.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\de\System.Windows.Forms.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Security.Cryptography.ProtectedData.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\es\UIAutomationClient.resources.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Resources.Reader.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\System.Threading.Overlapped.dll	Vortax App Setup.exe
File created	C:\Program Files (x86)\Vortax\zh-Hans\ReachFramework.resources.dll	Vortax App Setup.exe

Executes dropped EXE 12 IoCs

pid	Process
2252	Vortax.exe
1544	snss1.exe
2972	snss2.exe
880	Vortax.exe
1536	JEHIDHDAKJ.exe
2272	JEHIDHDAKJ.exe
2756	HCBGDGCAAK.exe
2468	HCBGDGCAAK.exe
1588	snss1.exe
2212	pythonw.exe
2112	pythonw.exe
1996	snss2.exe

Loads dropped DLL 64 IoCs

pid	Process
2264	Vortax App Setup.exe
2264	Vortax App Setup.exe
2264	Vortax App Setup.exe
2264	Vortax App Setup.exe
2264	Vortax App Setup.exe
2264	Vortax App Setup.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
1200	Process not Found
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
2252	Vortax.exe
880	Vortax.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Vortax.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Vortax.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Vortax.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Vortax.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2420	powershell.exe
2676	powershell.exe
1272	powershell.exe
1612	powershell.exe
1544	snss1.exe
1544	snss1.exe
2036	cmd.exe
2036	cmd.exe
2216	explorer.exe
2972	snss2.exe
2972	snss2.exe
2972	snss2.exe
2972	snss2.exe
2972	snss2.exe
1472	cmd.exe
1472	cmd.exe
844	powershell.exe
2944	powershell.exe
2616	powershell.exe
2480	powershell.exe
1588	snss1.exe
1588	snss1.exe
1612	cmd.exe
1612	cmd.exe
1996	snss2.exe
1996	snss2.exe
1996	snss2.exe
1996	snss2.exe
1996	snss2.exe
2772	cmd.exe
2772	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2264	Vortax App Setup.exe
880	Vortax.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1544	snss1.exe
2036	cmd.exe
2972	snss2.exe
1472	cmd.exe
1588	snss1.exe
1612	cmd.exe
1996	snss2.exe
2772	cmd.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	844	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2972	snss2.exe
1996	snss2.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2972	snss2.exe
1996	snss2.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1544	snss1.exe
1544	snss1.exe
1588	snss1.exe
1588	snss1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2252	2264	Vortax App Setup.exe	31
PID 2264 wrote to memory of 2252	2264	Vortax App Setup.exe	31
PID 2264 wrote to memory of 2252	2264	Vortax App Setup.exe	31
PID 2264 wrote to memory of 2252	2264	Vortax App Setup.exe	31
PID 2252 wrote to memory of 2420	2252	Vortax.exe	32
PID 2252 wrote to memory of 2420	2252	Vortax.exe	32
PID 2252 wrote to memory of 2420	2252	Vortax.exe	32
PID 2252 wrote to memory of 2676	2252	Vortax.exe	34
PID 2252 wrote to memory of 2676	2252	Vortax.exe	34
PID 2252 wrote to memory of 2676	2252	Vortax.exe	34
PID 2252 wrote to memory of 1272	2252	Vortax.exe	36
PID 2252 wrote to memory of 1272	2252	Vortax.exe	36
PID 2252 wrote to memory of 1272	2252	Vortax.exe	36
PID 2252 wrote to memory of 1612	2252	Vortax.exe	38
PID 2252 wrote to memory of 1612	2252	Vortax.exe	38
PID 2252 wrote to memory of 1612	2252	Vortax.exe	38
PID 2252 wrote to memory of 1544	2252	Vortax.exe	40
PID 2252 wrote to memory of 1544	2252	Vortax.exe	40
PID 2252 wrote to memory of 1544	2252	Vortax.exe	40
PID 2252 wrote to memory of 1544	2252	Vortax.exe	40
PID 1544 wrote to memory of 2036	1544	snss1.exe	42
PID 1544 wrote to memory of 2036	1544	snss1.exe	42
PID 1544 wrote to memory of 2036	1544	snss1.exe	42
PID 1544 wrote to memory of 2036	1544	snss1.exe	42
PID 1544 wrote to memory of 2036	1544	snss1.exe	42
PID 2036 wrote to memory of 2216	2036	cmd.exe	44
PID 2036 wrote to memory of 2216	2036	cmd.exe	44
PID 2036 wrote to memory of 2216	2036	cmd.exe	44
PID 2036 wrote to memory of 2216	2036	cmd.exe	44
PID 2036 wrote to memory of 2216	2036	cmd.exe	44
PID 2036 wrote to memory of 2216	2036	cmd.exe	44
PID 2252 wrote to memory of 2972	2252	Vortax.exe	47
PID 2252 wrote to memory of 2972	2252	Vortax.exe	47
PID 2252 wrote to memory of 2972	2252	Vortax.exe	47
PID 2972 wrote to memory of 1472	2972	snss2.exe	48
PID 2972 wrote to memory of 1472	2972	snss2.exe	48
PID 2972 wrote to memory of 1472	2972	snss2.exe	48
PID 2972 wrote to memory of 1472	2972	snss2.exe	48
PID 2972 wrote to memory of 1472	2972	snss2.exe	48
PID 1472 wrote to memory of 2788	1472	cmd.exe	50
PID 1472 wrote to memory of 2788	1472	cmd.exe	50
PID 1472 wrote to memory of 2788	1472	cmd.exe	50
PID 1472 wrote to memory of 2788	1472	cmd.exe	50
PID 1472 wrote to memory of 2788	1472	cmd.exe	50
PID 2216 wrote to memory of 2988	2216	explorer.exe	52
PID 2216 wrote to memory of 2988	2216	explorer.exe	52
PID 2216 wrote to memory of 2988	2216	explorer.exe	52
PID 2216 wrote to memory of 2988	2216	explorer.exe	52
PID 880 wrote to memory of 844	880	Vortax.exe	53
PID 880 wrote to memory of 844	880	Vortax.exe	53
PID 880 wrote to memory of 844	880	Vortax.exe	53
PID 2988 wrote to memory of 1536	2988	cmd.exe	56
PID 2988 wrote to memory of 1536	2988	cmd.exe	56
PID 2988 wrote to memory of 1536	2988	cmd.exe	56
PID 2988 wrote to memory of 1536	2988	cmd.exe	56
PID 2988 wrote to memory of 1536	2988	cmd.exe	56
PID 2988 wrote to memory of 1536	2988	cmd.exe	56
PID 2988 wrote to memory of 1536	2988	cmd.exe	56
PID 1536 wrote to memory of 2272	1536	JEHIDHDAKJ.exe	57
PID 1536 wrote to memory of 2272	1536	JEHIDHDAKJ.exe	57
PID 1536 wrote to memory of 2272	1536	JEHIDHDAKJ.exe	57
PID 1536 wrote to memory of 2272	1536	JEHIDHDAKJ.exe	57
PID 1536 wrote to memory of 2272	1536	JEHIDHDAKJ.exe	57
PID 1536 wrote to memory of 2272	1536	JEHIDHDAKJ.exe	57

C:\Users\Admin\AppData\Local\Temp\Vortax App Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Vortax App Setup.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Vortax\Vortax.exe
  "C:\Program Files (x86)\Vortax\Vortax.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\0d08c0cf-b74f-479a-8d5d-07bb9189e7a0\snss1.exe
    "C:\Users\Admin\AppData\Local\Temp\0d08c0cf-b74f-479a-8d5d-07bb9189e7a0\snss1.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2216
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\JEHIDHDAKJ.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\JEHIDHDAKJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JEHIDHDAKJ.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\Temp\{612A123F-C07C-4D0B-B0E9-5D7F48E48FC6}\.cr\JEHIDHDAKJ.exe
        
        "C:\Windows\Temp\{612A123F-C07C-4D0B-B0E9-5D7F48E48FC6}\.cr\JEHIDHDAKJ.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\JEHIDHDAKJ.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
        8⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\Temp\{AF4083D1-21FB-45A3-B804-AD42D944BF61}\.ba\pythonw.exe
        
        "C:\Windows\Temp\{AF4083D1-21FB-45A3-B804-AD42D944BF61}\.ba\pythonw.exe"
        9⤵
        Executes dropped EXE
        
        PID:2212
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe"
        6⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe"
        7⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\Temp\{A749D88B-1A6B-475B-9825-94649134BED9}\.cr\HCBGDGCAAK.exe
        
        "C:\Windows\Temp\{A749D88B-1A6B-475B-9825-94649134BED9}\.cr\HCBGDGCAAK.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\HCBGDGCAAK.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
        8⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\Temp\{0D85FA9A-073A-437D-B71D-24ABE6B31F64}\.ba\pythonw.exe
        
        "C:\Windows\Temp\{0D85FA9A-073A-437D-B71D-24ABE6B31F64}\.ba\pythonw.exe"
        9⤵
        Executes dropped EXE
        
        PID:2112
- - C:\Users\Admin\AppData\Local\Temp\0d08c0cf-b74f-479a-8d5d-07bb9189e7a0\snss2.exe
    "C:\Users\Admin\AppData\Local\Temp\0d08c0cf-b74f-479a-8d5d-07bb9189e7a0\snss2.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        
        PID:2788

C:\Program Files (x86)\Vortax\Vortax.exe
"C:\Program Files (x86)\Vortax\Vortax.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\ac3ffd24-9663-42ec-93de-86c05d0f702e\snss1.exe
  "C:\Users\Admin\AppData\Local\Temp\ac3ffd24-9663-42ec-93de-86c05d0f702e\snss1.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1612
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      PID:2824
- C:\Users\Admin\AppData\Local\Temp\ac3ffd24-9663-42ec-93de-86c05d0f702e\snss2.exe
  "C:\Users\Admin\AppData\Local\Temp\ac3ffd24-9663-42ec-93de-86c05d0f702e\snss2.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2772
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Vortax\Accessibility.dll

Filesize
20KB

MD5
fb554f9fe0b91f135d26ac6459cfd6f2

SHA1
b1269a2c28bded872b14fe70b69484631ef3a65d

SHA256
929ea150ad45b7c7dd5427461fbec44d43b67c08081f59b42b6abf570feae271

SHA512
8dffde6cddfc59ec380111fd36048126559e1f1e080c081ca0d09021bb23d6888e93e1659c7b3a8fa46f76602b03cf3e638ec1a80fba79e51648dcb32362e10c

Download Submit
C:\Program Files (x86)\Vortax\Microsoft.Win32.Primitives.dll

Filesize
15KB

MD5
300c95ff95b52e8a02fec6bfcfa58225

SHA1
b646f89fcd463ad5c19889b4fea40540568b780c

SHA256
f1b40565e5c4c41da810aee5b7d2272a0906e88f796812435aa5ed712bcac40c

SHA512
9bfe0eb6eea98b2d35aa42986a273ec82424143965e173b32bb4b7e5537580a027940a6952a45fc54f0b665e871deb2a95651106c2f24c7de3b3d3cd2dec7e89

Download Submit
C:\Program Files (x86)\Vortax\System.Collections.Specialized.dll

Filesize
102KB

MD5
cc26e9e30ffab763a1e54c0ef3713382

SHA1
c3be6646b7a4576ebd7729dbf4dccbd1fc159d51

SHA256
0cbabb81eae22f4c07c6c846054d207ae3f25da15649eb7fa29e4e2cecd24db4

SHA512
c8e57fb70cfa7667f9a5484c99eedd0bf34004ee26e9642e99a6b90624caa804af571d8aaafa7e9b121550af58205f8ed197b4ddb928210d394ff0b4c1897149

Download Submit
C:\Program Files (x86)\Vortax\System.IO.FileSystem.dll

Filesize
15KB

MD5
35e27f4c681085a4b096826ee8ea4f53

SHA1
cf3ea4304e5558c8fdd4422e4d72509cd91ea719

SHA256
7bd41c6b12b73e6e90476f2d56db8581664abe07e7ab9bf2917bb254ed1d75ad

SHA512
1f9e6519ff29524e57cb0b3576ab118014293aade8f30027ef44b1f29a8e9a54e7bcb3b288a92dba996053b16016807d93fa9f44f2c43666ddc6425ddd7ae4b9

Download Submit
C:\Program Files (x86)\Vortax\System.Private.Xml.dll

Filesize
7.6MB

MD5
46aebfbd6d7e74d4d558da62d7600d25

SHA1
9c1cd44ab8b5e283967427e91cbddddfc0c2bf5a

SHA256
834e304221e742a831be5c5178892258e689eae35b730172e74161af2785aab9

SHA512
9c4499d174a988cc3830aafcc42f79defff37b16198f49cf5d2dc86f88809fcb44e0c300351f813d46addf9998f64448c50213f1721c6a307aad21c205db1524

Download Submit
C:\Program Files (x86)\Vortax\System.Runtime.dll

Filesize
42KB

MD5
53501b2f33c210123a1a08a977d16b25

SHA1
354e358d7cf2a655e80c4e4a645733c3db0e7e4d

SHA256
1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

SHA512
9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

Download Submit
C:\Program Files (x86)\Vortax\System.Security.Cryptography.Algorithms.dll

Filesize
17KB

MD5
8f3b379221c31a9c5a39e31e136d0fda

SHA1
e57e8efe5609b27e8c180a04a16fbe1a82f5557d

SHA256
c99c6b384655e1af4ae5161fe9d54d95828ae17b18b884b0a99258f1c45aa388

SHA512
377f4e611a7cf2d5035f4622c590572031a476dd111598168acea1844aaa425c0fe012c763fbc16290c7b32c6c7df7b2563c88227e3dbc5d2bd02250c9d368d9

Download Submit
C:\Program Files (x86)\Vortax\System.Security.Cryptography.Csp.dll

Filesize
15KB

MD5
c7f55dbc6f5090194c5907054779e982

SHA1
efa17e697b8cfd607c728608a3926eda7cd88238

SHA256
16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

SHA512
ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

Download Submit
C:\Program Files (x86)\Vortax\System.Security.Cryptography.Primitives.dll

Filesize
15KB

MD5
777ac34f9d89c6e4753b7a7b3be4ca29

SHA1
27e4bd1bfd7c9d9b0b19f3d6008582b44c156443

SHA256
6703e8d35df4b6389f43df88cc35fc3b3823fb3a7f04e5eb540b0af39f5fa622

SHA512
a791fa27b37c67ace72956680c662eb68f053fa8c8f4205f6ed78ecb2748d27d9010a8de94669d0ee33a8fca885380f8e6cfad9f475b07f60d34cdcb02d57439

Download Submit
C:\Program Files (x86)\Vortax\System.Threading.Thread.dll

Filesize
15KB

MD5
72d839e793c4f3200d4c5a6d4aa28d20

SHA1
fbc25dd97b031a6faddd7e33bc500719e8eead19

SHA256
84c9a95609878542f00fe7da658f62d1a6943a43e6346af80d26bcff069a4dbd

SHA512
a414cd9d7cf6a04709f3bdbef0295349b845a8301171ed6394e97b9993f35816383b958736c814f91c359a783cca86ee04802856486d4b4e0ab90a45da39db1d

Download Submit
C:\Program Files (x86)\Vortax\hostfxr.dll

Filesize
342KB

MD5
16532d13721ba4eac3ca60c29eefb16d

SHA1
f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

SHA256
5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

SHA512
9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

Download Submit
C:\Program Files (x86)\Vortax\mscorrc.dll

Filesize
133KB

MD5
53e03d5e3bffa02fbc7fb1420ac8e858

SHA1
36c44c9ff39815aa167f341c286c5cd1514f771f

SHA256
23a433398be5135222ee14bb1de6334e7b22bad1a38664a83f1cf19dfbddd960

SHA512
f6aca16b90f6b4efa413dc9a8f1d05e83c1e3791b2cb988f9bce69d5272a0077c1edcae4111a494d166b5e3ab4e25956dead4e93ee1e43417c2b7bb082292170

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac3ffd24-9663-42ec-93de-86c05d0f702e\snss1.exe

Filesize
2.5MB

MD5
fafa971fa090bd362c653c317979ba5e

SHA1
a3fc6b004ce507dd1bac69da9d1b245dd10c3345

SHA256
870d97b7f83a15d5046bd8ccb1d975894e9d0b0fb53f677a9eb1fbd2b28ad598

SHA512
a2fc1239ba7c2cc8391a76c7dc86081c6e5b9320977a9b18167ff6141506de42f35e926a100b516039ea5bc87d8a65fc57c4370473187108328a519096b14836

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\ioSpecial.ini

Filesize
1KB

MD5
2f2cc5788e71f5a0fe6fe1d6a2b758c9

SHA1
ef860510e4fe8de74541075f846040afc52aa4cb

SHA256
fe6ba45d89c6fd5c3b5708dad44d73b96953d207540d76c6792416b73d372349

SHA512
8298275dfcf013ab1975f3f257e021eb743df47dd56d3477bdc0ee195a96596c832e6d5ab18b9ab0b8a09e4b71a51be8a1c13118a72b245be73cb2eb2490f0f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\ioSpecial.ini

Filesize
1KB

MD5
6cc02c77b2d5031141e73e0861f0d005

SHA1
e92d46de604eb0f60500813d6ddb5f37e3ff0e6c

SHA256
1a70eeecc32cd2e84d0453596e88193561a7b2a1e47d072bf7be1fd4358be9c7

SHA512
a4db6434a11a3e5917ebc862510c54d724b5a08d50bfcac3efe54daf720f3c31b39a1a555161f96fe7beb37af1aca00936f1de9f365493192b2e7cd3baee2ed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\ioSpecial.ini

Filesize
1KB

MD5
62876098e51b5893f6fef7c0aec65068

SHA1
61a8207012eb0f4686329b1586be212cd906acd5

SHA256
c20405daffa05a418e1085eafbc0dcf9eeca10f0dd0f55a7b3c6a0f5d923a0f6

SHA512
0ebfa0b6c3d8ab52b973617df74cf0f32ffe0a7fcc050dda14a231f0d249c368defafaf33d965b3cc225ea7244dbedd5619d5ef08e35b38437f33549980ca842

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\ioSpecial.ini

Filesize
1KB

MD5
4057d8ad1c36f38ddd846b8c7d5abd4b

SHA1
f31524127ff0c0229f4fa0a4392fbc21a270c6b5

SHA256
6186b498cae8304d855b539a6239d6a32ed6bf931e3323469ccba71c250df445

SHA512
cac81ab0ba880f8f850f5a8bd14dece623260a56edfda8d0385234e508719634b17c1e6b37da0bae530a6badbf56b9530f4903922916a516c5041b8e63a4fd58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0OAZF389YA3S7HS7W4H9.temp

Filesize
7KB

MD5
5d18e8e5c67e25350780af64e8cd14bd

SHA1
692e21e9b6b113ce903a0435ce3afa026872dad2

SHA256
d8f76f986890b8af795d637aa9196dfe425fbaf0a77e543f5743554d0baa063e

SHA512
d09f4f5bb9ae04aadf62fa3c355d5a622ec49eebd29f00e7cb0c03d71939ba305bb7f45d6fa431682d5286130231ad5add1e5bcd30dfe68c11735f299b2860d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ERYWZXKGYL9OKLVZ9AM5.temp

Filesize
7KB

MD5
396017a1c789eeb5cf938ff493613595

SHA1
4fed48d24375a28fb925ba5b10deaba628128423

SHA256
41447f9dd5520afc1a5f8564335c78fb902cba8ed243ae98d71a854021ab8aab

SHA512
dfbc56e6983948cb1f8cdc0908dc1854af247b30ce848bd50f24cfa72f44d6de3d0b9298b015c6612e1fda7e24a9a453b865d99cac282a4ad2ad909f5527b7ba

Download Submit
C:\Windows\Temp\{612A123F-C07C-4D0B-B0E9-5D7F48E48FC6}\.cr\JEHIDHDAKJ.exe

Filesize
4.3MB

MD5
b334579811f496729c1dd567ee9bcf2c

SHA1
ab738bb4e624ff2d41079bb77c8f6cf09672e9cc

SHA256
6971218abcbd7b25abac7a4f35ad3fb27b911f35d156a4112fc3fec672e04512

SHA512
f7bbe2abf885521596dc846e546de7b3f8b23175385c49ef570544b68473ac7a9e169ac8b911f767b94046bd2c633139aee8713afa558ee55d00569bce3d786f

Download Submit
\Program Files (x86)\Vortax\System.Collections.Concurrent.dll

Filesize
270KB

MD5
38d21e067d7673194a84cced59066ac8

SHA1
e64362176f714b23603f3a67f1e741f12e35a832

SHA256
483130bfd1e57a0cbfd8a4f3c6e2353ac3f246276f9476c83cca1cadbc47ef47

SHA512
3fa6f78ff0cb527a8e82261549f24a8609d005821ac5c5e7257670dffd55472a134af3ef78d73779758303ae5a90728181cd4caebc871c5cfa4c309141201baf

Download Submit
\Program Files (x86)\Vortax\System.Collections.dll

Filesize
254KB

MD5
92063926c04f2e4bf5b5fde16542831d

SHA1
e7be34eaff2d3d8796911d21f1fdbb93bf231dec

SHA256
9193aaef3ea8f19408f88c25fcaf5880e7836d1c35028d7e4077f6090b083541

SHA512
e855ee37980d1da2d143ee39133b05fff81937e529cffe74433e73088549daabd3abadbf05f3765bf3ffffd50313f0ed966efec0eb244d7363241affd73cc29f

Download Submit
\Program Files (x86)\Vortax\System.ComponentModel.EventBasedAsync.dll

Filesize
46KB

MD5
333639248121fb67d18323613a8203ea

SHA1
0cee5f7d46596239b833b3b30dccde27b0136959

SHA256
4c97d7bc0742faaa52ba86018b040aac44ddfc88a5835f9e6a659e03b4558999

SHA512
714fcb7299abcb26100b5f4103834c11c58f535ee9853fca2bcb22f43a3d1e7608d6ccae2dcc93d1687a4f1c8b521afe683d537f70f858681e62fff2d79c4acb

Download Submit
\Program Files (x86)\Vortax\System.ComponentModel.Primitives.dll

Filesize
78KB

MD5
1c59c00ab0850af4b4d2bafd6be47db3

SHA1
4c6185b2f42987e25a5fdf2aa30cf4150de25d5b

SHA256
133ec34432ab8fa4f63ade636193864b6a62a089a0c98d746f5532c8a52f437b

SHA512
8425c02c4afb274e862e4ed5dd1c766ebfa1bcf5bf59018d86238014a52603331a8b7c1e233f5a1f22171e90132ddd585db0d2561ff2cd287d703397afdff4b1

Download Submit
\Program Files (x86)\Vortax\System.Diagnostics.TraceSource.dll

Filesize
142KB

MD5
fe6a4b96e144131788108c8396a849eb

SHA1
40e6e5d03cfe036645ae854d5a2262faec6bed32

SHA256
22365ee4e3ba3c991d495e41f92e29bf6ddb38a48c44f55651271b80ee62b6d1

SHA512
61644c0e970dd6a6ff697b110bf99962931dd94deda5a966ea0fded3d23cba7433b802656295e04f1a95421774ea3c838f0a642d26b5e46ae6c05becb52eb7f1

Download Submit
\Program Files (x86)\Vortax\System.Drawing.Common.dll

Filesize
1.5MB

MD5
e4715322db624dc52947a42ac67757ab

SHA1
ba0b0850142ecc3910927d6f2e5781b896d7d442

SHA256
75b1e772a4355145364121af00e5b5cf06c7212aa53d662fdc996bc11e8092a9

SHA512
3c86d44eb209a3a1f2001968a2b139e532a0513fd2decff04aa1bf8b30b6202c70fc0e7ac8b22ace563023671259cd74cf65062132e7f1b97d3580621686b05a

Download Submit
\Program Files (x86)\Vortax\System.Drawing.Primitives.dll

Filesize
130KB

MD5
b5ca10a41cc865048491f617678722a9

SHA1
afe171d9d676b78983b802e18ef8e00927073c64

SHA256
cbe9fbb1d1e4850460854474ffd8c01ddcc756dcb33a86d1674c0cb2e2a0b026

SHA512
2afdce56b7eec6deb82f8b2d5ec3029b5a0ee1e8bbf2e0ff9a0a5310bf265ddcdf63660546b4dbcc3c5fb0cba3cbb94f2408fe5cb4d14dbe0e74aba6dd5a2192

Download Submit
\Program Files (x86)\Vortax\System.Memory.dll

Filesize
154KB

MD5
7e999da530c21a292cec8a642127b8c8

SHA1
6585d0260ae98bab2ad1eaba0f9cfe8ebb8a0b3f

SHA256
3af25e0c81c1462d0db86f55c4e5fd8c048c70685f9a566d29d499bc46935fb4

SHA512
a18b6649b5c2f9f96bf639863df9faad436759200a64f91fb2d955f33c71ce4b2d5798be982f692a247ac864d8acb63fb731b31c06333e5c7d9a9c895ecd6451

Download Submit
\Program Files (x86)\Vortax\System.Private.CoreLib.dll

Filesize
12.6MB

MD5
805cf170e27dd31219a6b873c17dce88

SHA1
ac90fa4690a8b54b6248dcb4c41a2c9a74547667

SHA256
ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

SHA512
fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

Download Submit
\Program Files (x86)\Vortax\System.Private.Xml.Linq.dll

Filesize
394KB

MD5
60ed8b2bffc748d6a2a1fed8fa923368

SHA1
be411429b9a649a495124558c5e5d95a83525d58

SHA256
0b63cebb991d1911a607993ea5b4639f34a2b0b381a73973542db2d3591e9f90

SHA512
b0a4ac2aa96d827258bb30f098512741ad3f93585e05ceae0255e15cd8dc9ab8048788902c1eb32a813e9c69c8a923200a716b4e00f579c22a0b425665e575f8

Download Submit
\Program Files (x86)\Vortax\System.Runtime.InteropServices.dll

Filesize
94KB

MD5
49c86e36b713e2b7daeb7547cede45fb

SHA1
75fe38864362226d2cce32b2c25432b1fd18ba37

SHA256
756de3f5f2e07b478ac046a0ac976b992ef6bc653a1be2bb1e28524a4ff8d67d

SHA512
a9bd42b626158c540be04f8d392620daba544a55b7438d6caefe93b9df10ec2219f28959c4e0d706a86b92008275de94dfdf19de730787cdacf46d99fc45e3a9

Download Submit
\Program Files (x86)\Vortax\System.Security.Cryptography.dll

Filesize
2.0MB

MD5
75f18d3666eb009dd86fab998bb98710

SHA1
b273f135e289d528c0cfffad5613a272437b1f77

SHA256
4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

SHA512
9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

Download Submit
\Program Files (x86)\Vortax\System.Threading.dll

Filesize
82KB

MD5
32aa6e809d0ddb57806c6c23b584440e

SHA1
6bd651b9456f88a28f7054af475031afe52b7b64

SHA256
e8d1f5c422ee0ba3b235b22028ab92dc77c1ff9774edc0b940cad7224a30ba7d

SHA512
fe43b3d6ed5c37d59a44636d3c7522a88d83e6ec074bf69d3cbb6e5454fdd8f0523ea10fdf6fd452cbd0e2fc159cf9d03dfad6b30e80e400e7f1773b5a2e8632

Download Submit
\Program Files (x86)\Vortax\System.Windows.Forms.Primitives.dll

Filesize
2.9MB

MD5
8129c2d72bcba8b50576e7c43e558832

SHA1
f4892f78d2496f3a2e1fa2380ff68fbeb62e2dca

SHA256
5794a3996a0b4ab9cb13f3de0f87d50462615a7d0eb1d243d9324a682c1b58cb

SHA512
40fafbf9590d2b2c8f487f44708e9e97ddce03b1487be5c7cb3d4c92bdb7100a98aebada379f63003f0dd9d447ee2b0b9dfa0b057320ac05f7f77b31c5ffa97d

Download Submit
\Program Files (x86)\Vortax\System.Windows.Forms.dll

Filesize
12.9MB

MD5
a51632facb386d55cc3bc1f0822e4222

SHA1
59144c26183277304933fd8bb5da7d363fcc11fa

SHA256
efc52dbbef5202d9ff424d7adc6e2249b66450a5fd5414891776fc617b00123e

SHA512
2a8d8e2ee8168e6f79476616385320f463ebc161c7393db2b18a7d35ca0111c5100b83954c5eabfe32b12cac3dbfdc514271dde4cc4468dd26235eb7020d9c14

Download Submit
\Program Files (x86)\Vortax\Vortax.dll

Filesize
393KB

MD5
db0a77e84caa01503bea132d7e5ef2f8

SHA1
161661df701e4011570cafb8305f218fa4ac3e50

SHA256
41d023a22c052a1d37bda1f34b8cb73d088fcf6abaf00695360f0a3a8d985239

SHA512
02207090569315f79a5d1f35f39e80cf8b05c87c336da8b52f02cdae4732b7acc3f98f1333986c91ea3f09f054efb09605a1427ba2fe23d90e119797b3984574

Download Submit
\Program Files (x86)\Vortax\Vortax.exe

Filesize
308KB

MD5
aa6ea1381097f6e1201a10a0de1029f5

SHA1
23b162c564b54fdc6fa2a4e56401bcb0ad98b6ac

SHA256
d1240769ed4c6dd4603a00f1e05b0ec4c1b2951661bd478c1e10954ab3123924

SHA512
584155f235b8567a5356307bc139e82df049f49bd9c4c07baa346fa8afb7be7e6f0afd1eec024bcebf5a7c416934f692d183a2977e8a38666652ccc1c124ff40

Download Submit
\Program Files (x86)\Vortax\clrjit.dll

Filesize
1.7MB

MD5
8b81a3f0521b10e9de59507fe8efd685

SHA1
0516ff331e09fbd88817d265ff9dd0b647f31acb

SHA256
0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

SHA512
ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

Download Submit
\Program Files (x86)\Vortax\coreclr.dll

Filesize
4.8MB

MD5
9369162a572d150dca56c7ebcbb19285

SHA1
81ce4faeecbd9ba219411a6e61d3510aa90d971d

SHA256
871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

SHA512
1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

Download Submit
\Program Files (x86)\Vortax\hostpolicy.dll

Filesize
388KB

MD5
a7e9ed205cf16318d90734d184f220d0

SHA1
10de2d33e05728e409e254441e864590b77e9637

SHA256
02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

SHA512
3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

Download Submit
\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\LangDLL.dll

Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
\Users\Admin\AppData\Local\Temp\nsy11CE.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
memory/844-861-0x00000000020D0000-0x00000000020D8000-memory.dmp

Filesize
32KB

Download
memory/844-860-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/1168-936-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1272-748-0x0000000001C70000-0x0000000001C78000-memory.dmp

Filesize
32KB

Download
memory/1272-747-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1472-830-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1472-832-0x0000000073A40000-0x0000000073BB4000-memory.dmp

Filesize
1.5MB

Download
memory/1544-758-0x0000000000400000-0x0000000000691000-memory.dmp

Filesize
2.6MB

Download
memory/1544-759-0x0000000000400000-0x0000000000691000-memory.dmp

Filesize
2.6MB

Download
memory/1544-760-0x0000000074250000-0x00000000743C4000-memory.dmp

Filesize
1.5MB

Download
memory/1544-761-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1544-780-0x0000000074250000-0x00000000743C4000-memory.dmp

Filesize
1.5MB

Download
memory/1588-915-0x0000000073A40000-0x0000000073BB4000-memory.dmp

Filesize
1.5MB

Download
memory/1588-912-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1588-910-0x0000000000400000-0x0000000000691000-memory.dmp

Filesize
2.6MB

Download
memory/1588-911-0x0000000073A40000-0x0000000073BB4000-memory.dmp

Filesize
1.5MB

Download
memory/1612-917-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/1996-930-0x000007FEF21E0000-0x000007FEF2338000-memory.dmp

Filesize
1.3MB

Download
memory/1996-929-0x0000000140000000-0x000000014015F000-memory.dmp

Filesize
1.4MB

Download
memory/1996-931-0x000007FEF21E0000-0x000007FEF2338000-memory.dmp

Filesize
1.3MB

Download
memory/2036-783-0x0000000074250000-0x00000000743C4000-memory.dmp

Filesize
1.5MB

Download
memory/2036-782-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/2216-789-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2216-790-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2216-787-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2216-892-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2216-852-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2216-785-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2216-829-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2216-786-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/2216-816-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2252-683-0x000007FEF5B4A000-0x000007FEF5B4B000-memory.dmp

Filesize
4KB

Download
memory/2252-753-0x000007FEF5B4A000-0x000007FEF5B4B000-memory.dmp

Filesize
4KB

Download
memory/2420-735-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2420-736-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/2616-884-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download
memory/2676-742-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2676-741-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2772-933-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/2772-934-0x00000000744B0000-0x0000000074624000-memory.dmp

Filesize
1.5MB

Download
memory/2788-873-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2788-914-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2788-851-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/2788-850-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2824-927-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/2824-923-0x0000000077000000-0x00000000771A9000-memory.dmp

Filesize
1.7MB

Download
memory/2944-879-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/2944-878-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2972-822-0x0000000140000000-0x000000014015F000-memory.dmp

Filesize
1.4MB

Download
memory/2972-823-0x000007FEF1FD0000-0x000007FEF2128000-memory.dmp

Filesize
1.3MB

Download
memory/2972-824-0x000007FEF1FD0000-0x000007FEF2128000-memory.dmp

Filesize
1.3MB

Download