hijackloader | 1863c944ff0f5f06cafe0f98d6a6f54084ac266936c0dbc16a9d13ab03dda421

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 05:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_37ba10d0ebd22287e120815f5241e1da_elex_wannacry.exe
Size 11.2MB
Sample260818-frffhsxtex
SHA256 1863c944ff0f5f06cafe0f98d6a6f54084ac266936c0dbc16a9d13ab03dda421
MD5 37ba10d0ebd22287e120815f5241e1da
SHA1 5dca5c9264fd863aa8ccd0ef0d4ac944ea9d1561
SHA512 511bd7eb2a3ee10007beb562d279914dffecca8e61621d10d412d68521749a71f978f4beb864d27ab696f2825a1642903eb8dec979d74af3b87a10a8bd341cbe
SSDEEP 196608:+piWYUfSDvL+ViYnwfTA80GlAt5aanoVDK/52r3LRlVhGrL0Kyd9kW/ErIWhzElZ:+p19fSDvC6fT/a2IOq/0KyR/zWdElmZ8
TLSH
T13DC633623BC9F4FAE50886798F55DB3FA23AD9269390AC0345147F017EE18B1710B5FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\ATImgmt_v3_0
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c459-86.dat	family_hijackloader
behavioral2/files/0x000d00000001c493-355.dat	family_hijackloader

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/2580-482-0x00007FF6903A0000-0x00007FF69060C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 3 IoCs

pid	Process
3460	S_Factor16.exe
292	S_Factor16.exe
1132	S_Factor16.exe

Loads dropped DLL 31 IoCs

pid	Process
3460	S_Factor16.exe
3460	S_Factor16.exe
3460	S_Factor16.exe
3460	S_Factor16.exe
3460	S_Factor16.exe
3460	S_Factor16.exe
3460	S_Factor16.exe
3460	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
2580	VerHandler.exe
5316	VertexTrac32.exe
2492	libhost.exe
2332	libhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2580	VerHandler.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 292 set thread context of 2580	292	S_Factor16.exe	93
PID 1132 set thread context of 5316	1132	S_Factor16.exe	94
PID 1132 set thread context of 2492	1132	S_Factor16.exe	95
PID 292 set thread context of 2332	292	S_Factor16.exe	96
PID 5316 set thread context of 3004	5316	VertexTrac32.exe	101
PID 5316 set thread context of 3160	5316	VertexTrac32.exe	129
PID 5316 set thread context of 3004	5316	VertexTrac32.exe	101
PID 5316 set thread context of 5416	5316	VertexTrac32.exe	136

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\NOTICE.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	VertexTrac32.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	VertexTrac32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\net_worker.job	libhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_37ba10d0ebd22287e120815f5241e1da_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Factor16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Factor16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	S_Factor16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VertexTrac32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2376	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315032595873696"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5316	VertexTrac32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3460	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
292	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
2580	VerHandler.exe
2580	VerHandler.exe
2580	VerHandler.exe
2580	VerHandler.exe
2580	VerHandler.exe
2580	VerHandler.exe
2492	libhost.exe
2492	libhost.exe
2492	libhost.exe
2492	libhost.exe
2492	libhost.exe
2492	libhost.exe
2492	libhost.exe
2492	libhost.exe
2332	libhost.exe
2332	libhost.exe
2332	libhost.exe
2332	libhost.exe
2332	libhost.exe
2332	libhost.exe
2332	libhost.exe
2332	libhost.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
3004	chrome.exe
3004	chrome.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe
5316	VertexTrac32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5316	VertexTrac32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
292	S_Factor16.exe
1132	S_Factor16.exe
1132	S_Factor16.exe
292	S_Factor16.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeDebugPrivilege	5316	VertexTrac32.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe
Token: SeCreatePagefilePrivilege	3004	chrome.exe
Token: SeShutdownPrivilege	3004	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe
3004	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 3460	6120	2026-08-18_37ba10d0ebd22287e120815f5241e1da_elex_wannacry.exe	89
PID 3460 wrote to memory of 292	3460	S_Factor16.exe	90
PID 292 wrote to memory of 1132	292	S_Factor16.exe	91
PID 292 wrote to memory of 2580	292	S_Factor16.exe	93
PID 1132 wrote to memory of 5316	1132	S_Factor16.exe	94
PID 292 wrote to memory of 2580	292	S_Factor16.exe	93
PID 1132 wrote to memory of 5316	1132	S_Factor16.exe	94
PID 1132 wrote to memory of 2492	1132	S_Factor16.exe	95
PID 292 wrote to memory of 2332	292	S_Factor16.exe	96
PID 1132 wrote to memory of 2492	1132	S_Factor16.exe	95
PID 292 wrote to memory of 2332	292	S_Factor16.exe	96
PID 3004 wrote to memory of 4472	3004	chrome.exe	102
PID 3004 wrote to memory of 2376	3004	chrome.exe	104
PID 3004 wrote to memory of 2588	3004	chrome.exe	105
PID 3004 wrote to memory of 2588	3004	chrome.exe	105
PID 3004 wrote to memory of 2600	3004	chrome.exe	107
PID 3004 wrote to memory of 2444	3004	chrome.exe	108
PID 3004 wrote to memory of 2600	3004	chrome.exe	107
PID 3004 wrote to memory of 2444	3004	chrome.exe	108
PID 3004 wrote to memory of 944	3004	chrome.exe	106
PID 3004 wrote to memory of 944	3004	chrome.exe	106
PID 3004 wrote to memory of 5676	3004	chrome.exe	109
PID 3004 wrote to memory of 5676	3004	chrome.exe	109
PID 3004 wrote to memory of 2772	3004	chrome.exe	110
PID 3004 wrote to memory of 2772	3004	chrome.exe	110
PID 5316 wrote to memory of 3004	5316	VertexTrac32.exe	101
PID 5316 wrote to memory of 3004	5316	VertexTrac32.exe	101
PID 5316 wrote to memory of 3004	5316	VertexTrac32.exe	101
PID 5316 wrote to memory of 3004	5316	VertexTrac32.exe	101
PID 5316 wrote to memory of 3004	5316	VertexTrac32.exe	101
PID 3004 wrote to memory of 3316	3004	chrome.exe	111
PID 3004 wrote to memory of 5624	3004	chrome.exe	114
PID 3004 wrote to memory of 3240	3004	chrome.exe	113
PID 3004 wrote to memory of 5624	3004	chrome.exe	114
PID 3004 wrote to memory of 3240	3004	chrome.exe	113
PID 3004 wrote to memory of 5000	3004	chrome.exe	118
PID 3004 wrote to memory of 4548	3004	chrome.exe	119
PID 3004 wrote to memory of 5000	3004	chrome.exe	118
PID 3004 wrote to memory of 1072	3004	chrome.exe	120
PID 3004 wrote to memory of 4548	3004	chrome.exe	119
PID 3004 wrote to memory of 1072	3004	chrome.exe	120
PID 3004 wrote to memory of 5008	3004	chrome.exe	121
PID 3004 wrote to memory of 2696	3004	chrome.exe	122
PID 3004 wrote to memory of 2772	3004	chrome.exe	123
PID 3004 wrote to memory of 5008	3004	chrome.exe	121
PID 3004 wrote to memory of 2696	3004	chrome.exe	122
PID 3004 wrote to memory of 2772	3004	chrome.exe	123
PID 3004 wrote to memory of 5200	3004	chrome.exe	124
PID 3004 wrote to memory of 5144	3004	chrome.exe	125
PID 3004 wrote to memory of 5016	3004	chrome.exe	126
PID 3004 wrote to memory of 5200	3004	chrome.exe	124
PID 3004 wrote to memory of 5144	3004	chrome.exe	125
PID 3004 wrote to memory of 5016	3004	chrome.exe	126
PID 3004 wrote to memory of 5396	3004	chrome.exe	127
PID 3004 wrote to memory of 4364	3004	chrome.exe	128
PID 3004 wrote to memory of 4364	3004	chrome.exe	128
PID 3004 wrote to memory of 5396	3004	chrome.exe	127
PID 5316 wrote to memory of 3160	5316	VertexTrac32.exe	129
PID 5316 wrote to memory of 3160	5316	VertexTrac32.exe	129
PID 5316 wrote to memory of 3160	5316	VertexTrac32.exe	129
PID 5316 wrote to memory of 3160	5316	VertexTrac32.exe	129
PID 5316 wrote to memory of 3160	5316	VertexTrac32.exe	129
PID 5316 wrote to memory of 3160	5316	VertexTrac32.exe	129
PID 5316 wrote to memory of 3004	5316	VertexTrac32.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-18_37ba10d0ebd22287e120815f5241e1da_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_37ba10d0ebd22287e120815f5241e1da_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\S_Factor16.exe
  "C:\Users\Admin\AppData\Local\Temp\S_Factor16.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\ProgramData\ATImgmt_v3_0\S_Factor16.exe
    C:\ProgramData\ATImgmt_v3_0\S_Factor16.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:292
  - - C:\Users\Admin\AppData\Roaming\ATImgmt_v3_0\LNDXRVIVWBYANVCQRU\S_Factor16.exe
      C:\Users\Admin\AppData\Roaming\ATImgmt_v3_0\LNDXRVIVWBYANVCQRU\S_Factor16.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\ProgramData\VertexTrac32.exe
        
        C:\ProgramData\VertexTrac32.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5316
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3160
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Roaming\net_tool_trace_net20\libhost.exe
        
        C:\Users\Admin\AppData\Roaming\net_tool_trace_net20\libhost.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\VerHandler.exe
      C:\Users\Admin\AppData\Local\Temp\VerHandler.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:2580
  - - C:\Users\Admin\AppData\Roaming\ATImgmt_v3_0\libhost.exe
      C:\Users\Admin\AppData\Roaming\ATImgmt_v3_0\libhost.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff89731c728,0x7ff89731c734,0x7ff89731c740
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,13611032996607857049,13676693845499948110,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,3421511713465767682,1436378483855333949,262144 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,16783434490556338886,11704044819634286408,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,11824836233072768810,14586291019253071843,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,7499808231640288617,15600922955845059199,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,14920637633244132766,12076641485695434986,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3112,i,6665373679359588856,6325567357678522274,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,11209696720681962287,1172977384287088396,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5764,i,1619503386072465800,14620068458958496052,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5808,i,276303283769716362,18228428545675844958,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6092,i,1156436955884270644,14734934429946521562,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,12582798316109559722,13741142483245664493,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6408,i,9294593544540704340,17385769359225188136,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6708,i,9949374408090104082,14377865098856946112,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,11861570253094265796,5886274270470940010,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5872,i,9371724698711882134,6179801653540193989,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6024,i,2520040778659566389,7587480199986148634,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5816,i,2948009272344924711,14739099066941971710,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,17357090968478054616,4794424758794416322,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6492,i,17042731189764637037,8247329856500398795,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4680,i,15136741382044134060,7531715311820619437,2097152 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:9
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,10717695771769123829,3235873644685303829,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,15317149967642259522,2369302035302487024,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6588,i,17147205047995039244,1592128849554988425,524288 --field-trial-handle=2084,i,7241006036286204682,5580446115632112823,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
  2⤵
  PID:2888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\Gxx\log\as.S_Factor16.exe.log
Size 3KB
SHA256 dbb0aa27bbba1d004363ffa726f5ce6aec4e5cc4162d6fe88bf5c8ceb7d908ae
MD5 1fe83f32a8cf29726d02f4e9b4cdee5a
SHA1 165dd0e21dac15a1ec15ca8f2cc7307aeeb4b486
SHA512 d27364f8bdd701c8de445df0c1e8ba4ffb7679a8ab6559ddff9777da5f944ad477f2e7d59331011847e5e14f750d8f23dc4e03d65d1a6a68bb1f1cd4f90b01ac
TLSH
T12051D4EBA8D2958E75CB1ADB1018046C532A3D0B2F4557ACC79218C7FC8A0D6FDB91F2
MD5 SHA1 SHA512 TLSH

Submit Download

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\Gxx\log\as.S_Factor16.exe.log
Size 7KB
SHA256 f0685a85dd8232bc1d54b276d528ad22d8757336336714ee6daeeb3a58cd00bd
MD5 a2272706fa39c5e7c5db0167c134a2e7
SHA1 53823b9b4139232202b3412e564960599bb11d02
SHA512 5be47c7fc91afcc77d91bdcc7613170d9d175ff76ebfdc19e3daeeeb44bfce04dfc9fb804031411e7a29070f87c0b785791f8953beee7e294a0eb4cde4699fe9
SSDEEP 96:YuuuqYYY+F+F+FYYY+F+F+FLLuOOO5HZZZ/ppp+s+s+sppp+s+s+suuijjjl8iik:7OOO5ajjjlD
TLSH
T13BF137DB95C1869E31D685DFA010086E53263C3B6B0823ACD76242C7EC865D6FCBC8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\Gxx\log\as.S_Factor16.exe.log
Size 10KB
SHA256 3fc5bb7bf763de9d3eac226aeaf5739f8837802d8b3d6760f26e0cc5a671f1a7
MD5 a64c5305fdd83c04d2742666029f5b3e
SHA1 3338a3b1f7312a7c4feb32ddf2b1fbb3a1ec22b4
SHA512 9142a3439cc3978e1c9be2f8fa59eea68eed3a2ab5ee169fc3b1595f58ce000b33aaa1958c678470ca0438097fb739209311384eeba9faad1c3c278f4b2b5d94
SSDEEP 96:YuuuqYYY+F+F+FYYY+F+F+FLLuOOO5HZZZ/ppp+s+s+sppp+s+s+suuijjjl8iiG:7OOO5ajjjlDaaac
TLSH
T177222A8B94D18A9E31D265DFA051086953263DAB2F1913ECCB2241C7DC826D6FDBD8F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\Gxx\log\as.S_Factor16.exe.log
Size 10KB
SHA256 504a36e788dbcace7943340655ea4d0036620da4ec8084414336868e8ab08dfc
MD5 558c3eb11c5c8403f302adc961a29080
SHA1 08c319803b644044dc606792a3949ca7f8705371
SHA512 32642b7a96a732ad74dbc2630a8476ec2a79c68e336cd91078b0475137869bbbcc538bc769e10335fdc386419c599cbaf97803e95c31db4aa2780d839200670b
SSDEEP 96:YuuuqYYY+F+F+FYYY+F+F+FLLuOOO5HZZZ/ppp+s+s+sppp+s+s+suuijjjl8ii+:7OOO5ajjjlDaaaU
TLSH
T126221A8B94D18A9E31D265DFA051086953263DAB2F1913ECCB2241C7DC826D6FDBD8F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\gxx\log\as.S_Factor16.exe.log
Size 2KB
SHA256 f655e098fb3e15aed160e7528a1ddd49e48e7b5d8bed1f4b7e65b6d851a2da3f
MD5 d681f98def1c2179ee9ea5d98dd677e5
SHA1 a320e679cc9a9e5b5b37bf5208c4b8e057a3b081
SHA512 d0dddfc955bf2e8e781a6dd05b3d92376518e4d3a4ecf3476d5c60ad20c4bf33ce368d6e126e1420e5fc0b0262f1106cd6f6fc4a39f5cf6b6fbf244de6c45869
TLSH
T1DB41A2E7ACD2954E75CB1ADB1459046C932A3D0F1F4157EC878248C6FCCA0E6B9B91F2
MD5 SHA1 SHA512 TLSH

Submit Download

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\gxx\log\as.S_Factor16.exe.log
Size 2KB
SHA256 91d4628e4c98eea0c5fd4b6aa092b837255569d95b8a0cb46152cd3c9f5b0468
MD5 a38f13a5e069bc105a58b3893e811902
SHA1 d85e00fcbec053e1c92ce80c5b2b29bfe49e7df4
SHA512 abf34a39e8246e9ef21d13278f4807304c8e3c33d88a36be94c753c5af3701dd1a11701aef051c259d07546e5d174c075e43bc65b34f6b8d9ff1b06df9826935
TLSH
T14351A4EBACD2A54E75CB1ADB1419046C932A3D0A1F4147ACC78248C7FCCA4D6B9B91F2
MD5 SHA1 SHA512 TLSH

Submit Download

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\gxx\log\as.S_Factor16.exe.log
Size 4KB
SHA256 431e06fa5219b5836b40930902bcaf496e8dd63563c6fb225655f47f95004887
MD5 bd1e95ac11a45d9b90b4c5d7d2dbafa0
SHA1 8bf00b9f5073ceafa3e9a0e6c6c41ade31b6dab8
SHA512 a823f403814177ea2b1d8d0262d2d74cfac8ba202ccc9ec70629c24fe41e8c9860046bae61e6e6f1d20efc0afc1afa14cd4f6bd0b6b5f9d7cfd23c0d24c262a6
SSDEEP 96:YuuuqYYY+F+F+FYYY+F+F+FLLuOOO5HZZZ/ppp+s+s+sppp+s+s+suu+:7OOO5m
TLSH
T182813CE7A8C2958E76CB1ADB5014042C532A3D1B2F4553ECCB9205C7EC8A0E6FDB95F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

as.S_Factor16.exe.log

Path C:\ProgramData\Garena\gxx\log\as.S_Factor16.exe.log
Size 1KB
SHA256 d9e4ad53887e6546da268e4086f8a63ac3bba3bb8372009389e9de0918ead9d0
MD5 7fa2cf76574e4694f388b63596d41e23
SHA1 7f2c3ee26ea445af1862b736728526dbf0e746a2
SHA512 ccb665bfbfbeac81a143d1ff3aba6c2fce8f0cb1f9b02d2bcaf6f1f05b81734d7d5608443ed2a186a053236f2a724e7da1f2d6351cdd9d9101f4c04c570f2815
TLSH
T13621FFE76CD2945E7BDB1EEB1469106853297D0F1F4247DD8F8208C6F88A0E5BCB91E2
MD5 SHA1 SHA512 TLSH

Submit Download

VertexTrac32.exe

Path C:\ProgramData\VertexTrac32.exe
Size 418KB
SHA256 b02597c635553c54e77cdafa3a276dd60041f7d4c52438d03857d07e6fb71d20
MD5 8c9740a3b7603b0a746213dae8c89526
SHA1 e4284978fe13c382b4ea2c1df365be560a8334b2
SHA512 ca049227d3370abc87fc79d071ad525a803468343e7d33a889d013729b89d880a67675e25755087d18172eb24e5be3461b9393c1117cb63386592a3c09ff84d6
SSDEEP 6144:iCd8A+yBtj1IVWfAtU7V/tN89zCQ5EkBH06T9pR4z5f28lA7wi/oows0QDkNYS:2yBtGVWfAt8UzH5EkHbgtlcwiSs0xYS
TLSH
T17A947E26F7D08537C13B1A399D5FA6A4A835BE502D2838863BD93D4C9F3DBC13919293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e716f119fb1c5a8ea6aa9e33c32d2a4aafc98aed60cf6faaf63da35d4d1dbd94
MD5 d96c83fd0a4da983b14703c954fcbb60
SHA1 bb27bf57b10f9a2fcf09a17e251f8bc572a2836d
SHA512 67f4574808bf54d3a61403cc96496ee1bce84a4f52c7e2d0076de2c317acac29ce0a87036efb84d60ffb073b290483ab4fca8d6bba4ed736a7ad0d42dc454b45
TLSH
T1AF518CB7D3E4856DC51556F59B216E2FCE6D0A24121C3C2289E4AF5B53F28B3D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c62a717df5a5da5f54bebca914aaf8fc66bf86e918e5c60f497c14f1f8037008
MD5 26b3d5855e963b67ab9c155b4e1894fc
SHA1 417af4727f7519e40e97dfb91d171d85b23c2a3a
SHA512 60ae72d07ffffa71884d6489037cbdc5519ee316cb9d8ae86eb83959a25a5bff85d7bfea819127c1b5eb4cdfa79e9128fc760e98315db64637a7791694fb1360
SSDEEP 192:PR0O+eIv7FAPRp279gHsb+WNnzs03eLaI00PVyIsnAUgR:PR0OPUUXcqwo0qawR
TLSH
T1C232951EB915697B6DDBD22DFE217753D7F6102221942E84EBFC892C14D76CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 59fbcf6d9795ae206d36e3aae7dc4731c2148871a988872ea10a14d7db6439bf
MD5 1f0c0e37a41ceabe0ca5104d3409d450
SHA1 ca81db82c6194f9a3c94f99389696cbeac1ce296
SHA512 99b02bc37345fc302b31c498f1703fa99d7ff93f5a032b7f92105fd3be575d564829e1da5f4f79d4cb48c49d31fc198054df0e692d89bc47b37a005fa8277732
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9LjIAl53I0:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCc
TLSH
T19732F827A44D9A7B0FD8E54DDC126F8B6DF5419272780D2492FBAC0803A97CA115A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d44058c371a00f2eda7841adfbff1e29bcac2f9d07f5284832280e3dbebe3344
MD5 615d97d457445407430c4c9d9f101fc6
SHA1 b8c81b9c14aaba69d878949b211113179a5837e0
SHA512 19feb3a9e5cc45c8b3c06687e63e7b10e5b4f95ef232a45211a8db391422fdfeb62cfb56273ea83122b00f3e9e6f32162a31a8a845a7a50034289fe4df3762be
TLSH
T1FEA0026292E0D425DD8882736075556926538D251DE24B0358B36A56886F1C04155114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac219.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5ac219.TMP
Size 48B
SHA256 36ff32b3c5d1037f228e6f7d6e0168af0ed6e9c5be109caa9e483a247efbdacb
MD5 091baed1787412c1a35d55bd7a4f6f0a
SHA1 b8584c2b731a55025b184265943e8a434f6ea469
SHA512 d8289c81f64a490b897ab20afa0a33e48c32b2cadc7caa2a1981277b45a84b43d99b95bdf3112f81ab3cdb88e84347b0ef7eaf7d0df55a01ee3eed91d08a2d8e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b09fdcee-7561-4358-b728-c7b3f8204738.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b09fdcee-7561-4358-b728-c7b3f8204738.tmp
Size 12KB
SHA256 2cb8311a720a5c370f66c0eba68627a171f19f7b54677bc5de6ee3a625f82b8a
MD5 19bd5bf814c50dd28f2324230d910e72
SHA1 91743bb4ae537b0ebd0246e7b4e43c3d3fc5f604
SHA512 5f8032de3408f87ac454315a2bc6898ceb5f91192982abc9227e29cc990bda650519a672c53fa659a4587143722c8e273542bf4bfe7f0ebea3c1c8156bd7eee4
SSDEEP 192:PR0O+eIv7FUPRpj79gHsb+WNnzs0meLaI00XVyIsnAUgE:PR0OPUwXPqwo0La6E
TLSH
T12742C61EB915697BACDBE71DF9617B53D7F6202220A02E84EBFC892C14E76CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 173KB
SHA256 85e0b9518dcd8fa272f061265fb0e0f8dd8136c55d876b007971c2d144623a53
MD5 75a68b5e1facd27a68adac2a98be46d4
SHA1 04c660ef82a81091ccda4ad5f9663c3cbf6c5dd3
SHA512 3b1c87670050e378f60a288f00c60170321d248ecc9f17d399f8349dd3b70bc36c27ad4dfd2a86682bc02bf9b98b0215258816594037878044e76927c4287f75
SSDEEP 3072:osEwPmNvp5Qbap7LeyDrZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6W:ywPmxpWbq7CnE0gT3VGi6lSzrpQY6V6h
TLSH
T1750412353E0A3F6AEA2277E581546E0F8EE1D06F9F58E1A6BFD15F06C04B5E13A0C461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 ed18c3f085c97efa7a9a9f9706a855a066a44578524698f46c0572c5057661d7
MD5 b5e130b8a3da0c3f66f03172531a459f
SHA1 aa388dbccdf8bc854d24d68b3eab85e3da72a56c
SHA512 f9a76d4778a7042fcbd2f5bd98257d4b63cf0c066c052b3b93f41162c0134690aeeced3c2e7b6b9405ecee59ab7da39d5f7a29eb5ca686a702529173f2d7da9d
SSDEEP 3072:oZZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V6h:NE0gT3VGi6lSzrpQY6V6h
TLSH
T1C6D312653E0D3F55EF22A6F5D1601D0B8EE0852E9B8CF07B6FD25E96C0575D22B18432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 e3893fc6a8804d0b0666c34214f232465e2be787a234d842bcd9f26272355da7
MD5 70f7a17bcecaa19a8595f420f3a62d8d
SHA1 343ded1435825081765b1b1a301ba683a7d2c290
SHA512 87657ab9e3a49789ec3c49a7997f3b8f8cba8d6aaa96929aeaac2b106d59f178a70a7944c5881146021593198e3e3962d10a00a759dbfb68e477b07ed5505601
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5o6DBB6gGyvXNQErbfyYv4a:RC0G4DkG/FZ9kGDUDD3MAQErbfX
TLSH
T148A10971A87D8FB75972D588F5923A07CEA4A0ABA611EF44DDDD0E0C11F71DD1342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 a48986f81fa07f84bb94f29b7604bf197738b6b6552fe8ba50cd285576c2a364
MD5 b2c4485fd575bc421f79c7c07a94f521
SHA1 faf8affab8dd6f75c5de5590d703b8f7b8254da9
SHA512 7b174b159544b22a81952f5cb313272038c099999427bb30a4c550a79d6c398412479acd34e848af8da561534b435702b49c881da6a451ce0ff58ccabc247f45
SSDEEP 3072:1+ZrFkKjkxP4NagXDrVGi02XhAo5IQSwo6VSO2wD+8Hp6pY6V6h:lE0gT3VGi6lSzrpQY6V6h
TLSH
T126D312653E0D3F55EF22A6F5C1601D0B8EE0852E9B8CF07BAFD25E96C0575E22B18432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.0.1909.2618.manifest

Path C:\Users\Admin\AppData\Local\Temp\2.0.1909.2618.manifest
Size 408B
SHA256 8ffdfdf7c4d262d1fd08b5a29fcf04dc53a06cf1a35635ed087b13e95c733f09
MD5 1f234ed2f70d8122faf2f3b2cd7f938e
SHA1 a3f1ad92bf01bfdc386ebac663f551a33059c3eb
SHA512 8a9f1c70496ce1fb59e732017e1c1bfee4506d99066c7d403a870229207c3931e948a6c01ef666e7d80f3c96180c2b35310dcd3507376d84900925819cc17f79
TLSH
T1FAE0E53840B91D192721817A6C027409314BCAB2CD46712FD8FFB497D50787CC6D4BEA
MD5 SHA1 SHA512 TLSH

Submit Download

40AAEE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\40AAEE6.tmp
Size 40B
SHA256 05c3e079aaa78079ae740bbab0e1534e6529d7930eabf91d692de106e29dd4fd
MD5 355560208a507a158ceae6cf740d86ce
SHA1 50f9456dd67b6f8537bcc476bf67f4db41532146
SHA512 1285779662c83a7dbd4b30ec7ea8d042f1dc96c8ade94a61f19070430f5284cf4f3e1a4369303066a802cc2bbf197ba51cf4b0ffdc0a0a8b71c8e12c0cda3cbb
MD5 SHA1 SHA512

Submit Download

DD86DE3.tmp

Path C:\Users\Admin\AppData\Local\Temp\DD86DE3.tmp
Size 14.7MB
SHA256 916f8b11d8e07286c02d843164c3a718baee35d54a03a9e59adf23ab3e508fb6
MD5 b93de26ea443f700b7e499945207f801
SHA1 007fdae5bd1bd8a1eae675d582f956f55ec2376f
SHA512 27f816d4f8ea9a59a9696a8cf98890b8072610f4bd3a98a56085551d900e35cd4ac556af5273f24ccdeea441b2a64664b3a027296c9f2f0019f070aec3ed4617
SSDEEP 393216:6ETh7G1InC0yyNvBDE59Z58Sqrpcs2yE/y48i1WuH:6ETh7G6nxyBVGpoyE/wu/
TLSH
T16AF63344987C5E6746F9F24313C488337D0CA0BBD83543FB23A647A9CA9A766015FAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
TLSH
T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCR120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftInstrumentationEngine.dll

Path C:\Users\Admin\AppData\Local\Temp\MicrosoftInstrumentationEngine.dll
Size 1.2MB
SHA256 c7274cf0728137b51ac4626abc9239202a99cd462d95461aa4ec9bb8d9df7679
MD5 adf39538c164bd09949bee2a6fc2bdcd
SHA1 56a77cdbda3266350fc0740f7aeee9404a68e4c7
SHA512 980969ad8988227a020ac18d38b4107b6cc139313753844eccc4b06e1ab1846b0a1bc770d36ec7009c5e9f7cb99508692d4161501e89592054f21618f807834a
SSDEEP 24576:2ZurcDVRYMCIfbWYv4UafBlo0esOx1++u/4:G2O2CfbWYv4q84
TLSH
T1E245841137FC842AF2FB0772697BAA69653BBC5A1B34C4EF5250541E0C39AC59AB0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S_Factor16.exe

Path C:\Users\Admin\AppData\Local\Temp\S_Factor16.exe
Size 177KB
SHA256 9b3c9a991bcdb5c0c9d023aa839222e58f2e1a35f29d3da6fa364851b363d1be
MD5 2aa3c9a0c8b563dd1e521923d516cdd1
SHA1 fd18e1cb0ea94f54de2d40a65b7fad76f43337c3
SHA512 611db00cb434c887c6995f47de6ba40b679a7e49a46bb845fceafdc635e43e907fb43d2815406a23d5f2e8713772292aa59081c262d3f9137be5b3b4d3549817
SSDEEP 3072:L9kC7xAQH0mBgvNttyonuuvz1l0qlC1vfFLEpMLro:L9v7xAQUmBINttyonuyn0qlC1veAo
TLSH
T15B041812FA8485B2F48902705994AF7B045DDD700B7405E3E2D97E6F9DEAEC31E3628E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VerHandler.exe

Path C:\Users\Admin\AppData\Local\Temp\VerHandler.exe
Size 695KB
SHA256 6176a53307f36e33011294a436e004f6ba79fb06985602654f652de7c7f73b97
MD5 07086519f0c03a67d2ffd439475b0196
SHA1 1a36131d73beb80133c14253902c1f1a4dead88c
SHA512 5ed36ac81855724464b133cf91479b0aa166459f396305218cd61e9c850c07d0cb1b9a96337ee570bf28debf03b47ad98e3aa2efffeae716a29bb8984ad38d0a
SSDEEP 12288:c3F583xfv+pIL4NKPVPfz3zvnXj/zXzvsg0x3hXlw51n+fNJqgd2NAVXoV5l:c3kVGpWPfz3zvnXj/zXzvsO59+1Jq/NR
TLSH
T1B4E48C5DE5A221D8E46BD079C9AD561AF6B43C1C035185FB13E4AA393F33AC45A3BF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appshield.dll

Path C:\Users\Admin\AppData\Local\Temp\appshield.dll
Size 321KB
SHA256 5688d58e5d1a12813a3f8d2171d753c694123c81430b0a02f7548b35504d8ca1
MD5 d91d6cc0ec6bac5c615f1a0435fb48d2
SHA1 b83c9614e83ca49c3bf2daad024dffa579eb9cf4
SHA512 eaf5f107250937183ff1bb2236c643e2cd577bf1d334e65903330e26b3d52e887195b5b7277fbf154fed8408c0c62969994924419105bc2d12749724bac3587a
SSDEEP 6144:CSsdMiIBCP5wfcp83pRQUaYVZiOnNnzojKKHqFb:CpdMiQkbp83cUaY/iOn5MjTq
TLSH
T1BD649D50B646C036DAEF02726538AB2A007CBD758BB5C5C7F7D85A0EDE316C12B32667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

commutil.dll

Path C:\Users\Admin\AppData\Local\Temp\commutil.dll
Size 737KB
SHA256 12daecf1571bbd4c60cde69463b786b317a0c9b3e40bc1850c814c38e0557df0
MD5 a5433bacf9a400e62b55c0a333bdd500
SHA1 6128d5e8f4d6dcebb435e52e2bd5f578461b05ec
SHA512 40a7916bde38075d675b746562cabe6cb1fe8c3ce42187783705cfb44757ab1c5444992103b04519067089f3bc79dc13a021a7022e2fcdd2970a60e30e108973
SSDEEP 12288:hZ0HmSPwckJy29d1YPEr1YVl/7gHx+Fq/qrcRv71ZWvm+G1kR:hZ0HhPwckJy29d1YPEr1YVl/7gHx+FqS
TLSH
T1E3F45A11B742C236F99D02B1997DBB6F5139AD824B3919D3E3C86B1E5E706C72B33242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cryptutil.dll

Path C:\Users\Admin\AppData\Local\Temp\cryptutil.dll
Size 165KB
SHA256 346c2d818bfdc5c1c208495ea3377f2f15c18149d9b2132cad022c68f1e799ac
MD5 b2c375e46c49de804e08fb2e9539a386
SHA1 6de33a1e22bb0b75837656b91790af1fc01b201e
SHA512 2a51af6de7880209f72af1441eb3f7b6ccacf2da7c1b74b736d920b74c0b5fdfc3f467c11643654a680f0f5f26fdcf40e8f0a68c7f67d99e5b86f268aeb0b1d8
SSDEEP 3072:Ibpe+0/oRC2bUu6T+fxGgJShLiggfVUtST94g92UoZKTBfh5FKH6DaCV03d:Up0iggfVUiug9wZKTBbFKH6Da60t
TLSH
T175F3AF40FA4283F6F4FB0276E6EAD67E553D761417694ACFA3EC48591C112E23B3138A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libprotobuf-lite.dll

Path C:\Users\Admin\AppData\Local\Temp\libprotobuf-lite.dll
Size 260KB
SHA256 90d9bcd7dbaf4451584e730e23b14506d54403b6549b66159e6e193ae27a001e
MD5 c19a8b812ebc1c0925bf9ea74002473c
SHA1 d178a806ee69834bf1c58fe525b0e336e378f995
SHA512 59fe65827d988d48fea784e5bdc1ec1c5e099705282a29978d7be9035c4b18821136d90989e25afe2d780c414c67db22556ab504632c201c43799d1aebc7d31d
SSDEEP 3072:GGIKnL51K+tTecDZ/Y9blyYRYRYXjLEgm0vNkVPW2+JL0VFiHN+zpylZxXcEcT:G7y51KCTe42lZLE8S+L0Vwt+8lZxXa
TLSH
T10D440B7278498BBBE6C34176C9EC9B0D168C68018FD953CB50ED9F0629A57C38F353A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4cxx.dll

Path C:\Users\Admin\AppData\Local\Temp\log4cxx.dll
Size 1.9MB
SHA256 8df322975f0e8554eed792ee6985bcdc75e20cb8ff20c4349414fd00eeb47318
MD5 f66482866cfd059f2fcac878ad812173
SHA1 22032f7c5c604d8efaa988032aaf39a1139586ff
SHA512 b361577b76d0152c7e3a9ab22894e8e7dc1191cc283f28b1bd5a83290831ab0cc0021cbcc4250ce2ae213bbf411c28de01ee3482d0de9fbb93761cd1868e893a
SSDEEP 24576:up9ZSXPbb5+QxrMNU+81KSXB9aDm2xSjDQBB9mNxiQh5FTXCzH:E9qb5SU+GtXbSSjdCzH
TLSH
T1B9959311B22985BFE45A32F08C280739E13896A0CB1BE6C7C0C9D55F2D561DEE7B356E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3004_1328097930\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

service-mod.yaml

Path C:\Users\Admin\AppData\Local\Temp\service-mod.yaml
Size 13KB
SHA256 8794c5389b8cb726cf18ffbd3a46af4500e0f5aae9e316db661db04ff8bfedcf
MD5 389c2b606f58e2ffc1aba7407655de10
SHA1 0157782013c8287547167c825a784e8be949b9ad
SHA512 ef958ae625af60e4d7d24e486cdd1ab6785f1f9fdd0ac300267f65b0eb1c63f9ce5532a51dd392359a1d9c48359688b772d4396543af1755b7230d5a75c6f5bb
SSDEEP 384:Q+VU6IpcR3C7hckchcEcq6x+dK6Ld6eeH5AuMQ:Q+eTykchP6x0K6LdiMQ
TLSH
T13F528D138F826D67BC0E55257826A043D301F57375171CB271CEEE8B28B4EA5E260E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracker_setup.dat

Path C:\Users\Admin\AppData\Local\Temp\tracker_setup.dat
Size 10.8MB
SHA256 f057ed1fd8f24dc72275addda3ed478eca62f6d6d51c7885b15fe94b856579c7
MD5 f914776e3ccc3e96338e15d7ccff8c94
SHA1 29dcd51ea471c381b34af513199f12786cb7225a
SHA512 d283952a706662105c23c02ce6643ced888f4056523471c745e4f78e9964a34d08850d3ae753e0da5175915e890efc83d32880908c4f79115d05ec37e238fea5
SSDEEP 196608:Gl4i2N4xeURRFe3FtfBdsRafjmJ6B4Gx3E5mfB4oMFFNyVAAhC9tMEhI:Gl47aPe1tJd2USfvgMF3CzhC5hI
TLSH
T1DBB63345C46E7094D4458B7367A4C8EA2494BCBDAB398F9F9D14FFE89F9C89106003BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yUoO.7z

Path C:\Users\Admin\AppData\Local\Temp\yUoO.7z
Size 17KB
SHA256 bbe0dd26672bfa27beabc93d00969f39d72dfabca7e107fd9a9e6602850ae956
MD5 9521ce66beca39b818ea1dff6a4138fd
SHA1 244e1e6d8598f50cc5585fbd6a6c258c90859b83
SHA512 955a01547f74dddfaef140a5c985a6d86e87648ebdac80496b5adfd4d19d286410944a52a99e15f75268750fa585fd8a7c9f11a09b4912901478a5c7ea56b1bc
SSDEEP 384:U7S5thUmUvoC3SzI9nUQpYHvg5MGifUxpXEKJaMKHzUgQc2hbFJFjibo:UYtGmUwC3MI9nU2YHxzfUxFxUQ/hbhjb
TLSH
T11E82E02D5A4A7FC5E9B464764CA3DA805096843A7423BCEDF2A43CB05976D1EF8F0DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tracker_setup.dat

Path C:\Users\Admin\AppData\Roaming\ATImgmt_v3_0\LNDXRVIVWBYANVCQRU\tracker_setup.dat
Size 4.4MB
SHA256 0a0414d5ae565f6a0b9184290b74d1c4167ec89efb8d020b09051057e22dbb25
MD5 075bdcb9fd47e3628f5b8a26dfa1f5e6
SHA1 f9585e339a92443586fb0c9b5f9ba94ff2f56377
SHA512 fbfdd5f7ad14395a7b50805c53420207a501c11c4ac4ecbb7b8787272d89fe2c49a1dfc18f7ca7a25a34f19fc54bd9b55dd20eee9d8c7fd7a291c96ad916de91
SSDEEP 98304:NDp3h7arGKsTPMAgn1kou6OtIXuFivbcns0:TRGrGLi1Pu6OtfCbcs0
TLSH
T18626239184AB3020F82F41B3A9435B70FED6B448AED93BD09FE591508DA57DFF229B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhost.exe

Path C:\Users\Admin\AppData\Roaming\ATImgmt_v3_0\libhost.exe
Size 432KB
SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
MD5 300414008e092e1e17ff64e831723d58
SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
TLSH
T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/292-160-0x00000000028D0000-0x0000000002931000-memory.dmp

Download

memory/292-337-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/292-223-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/292-173-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/292-158-0x0000000002810000-0x00000000028C7000-memory.dmp

Download

memory/292-186-0x00007FF8BCAC0000-0x00007FF8BCD23000-memory.dmp

Download

memory/292-244-0x00000000749B0000-0x00000000749B1000-memory.dmp

Download

memory/292-202-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/292-199-0x00000000749B0000-0x00000000749B1000-memory.dmp

Download

memory/292-338-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/292-200-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/292-217-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/292-159-0x0000000000FC0000-0x0000000001029000-memory.dmp

Download

memory/1132-345-0x0000000003330000-0x0000000003391000-memory.dmp

Download

memory/1132-387-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/1132-344-0x0000000001610000-0x0000000001679000-memory.dmp

Download

memory/1132-416-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/1132-443-0x0000000000090000-0x00000000000BC000-memory.dmp

Download

memory/1132-343-0x0000000001540000-0x00000000015F7000-memory.dmp

Download

memory/1132-373-0x00007FF8BCAC0000-0x00007FF8BCD23000-memory.dmp

Download

memory/1132-360-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/2332-477-0x00007FF8BCAC0000-0x00007FF8BCD23000-memory.dmp

Download

memory/2492-483-0x0000000074990000-0x00000000749E2000-memory.dmp

Download

memory/2492-462-0x00007FF8BCAC0000-0x00007FF8BCD23000-memory.dmp

Download

memory/2580-482-0x00007FF6903A0000-0x00007FF69060C000-memory.dmp

Download

memory/2580-478-0x00007FF6903A0000-0x00007FF69060C000-memory.dmp

Download

memory/2580-425-0x00007FF6903A0000-0x00007FF69060C000-memory.dmp

Download

memory/3460-91-0x0000000073920000-0x0000000073972000-memory.dmp

Download

memory/3460-74-0x0000000003080000-0x0000000003137000-memory.dmp

Download

memory/3460-75-0x0000000001830000-0x0000000001899000-memory.dmp

Download

memory/3460-76-0x0000000003180000-0x00000000031E1000-memory.dmp

Download

memory/3460-104-0x00007FF8BCAC0000-0x00007FF8BCD23000-memory.dmp

Download

memory/5316-956-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-442-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/5316-441-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-1012-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-424-0x00007FF8BCAC0000-0x00007FF8BCD23000-memory.dmp

Download

memory/5316-1030-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-418-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-1046-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-522-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-916-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download

memory/5316-488-0x00000000007E0000-0x0000000000B6A000-memory.dmp

Download