hijackloader | 3bd4aca1cc93a7af02a6380f0cb7c2bc0dda872e18da7f474eac06406fa8752f

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_235434e1ef6709f9da36f73a8981be28_elex_wannacry.exe
Size 13.9MB
Sample260822-we853astfv
SHA256 3bd4aca1cc93a7af02a6380f0cb7c2bc0dda872e18da7f474eac06406fa8752f
MD5 235434e1ef6709f9da36f73a8981be28
SHA1 03c1c835fd958960908c86c10e401c1665863b0e
SHA512 61a5ea4f67fdc7a46cb0b4de58875b5fd5aa85ae09b9b5b932b9d55ce2724678b462ba3ec7aae240c12228843b88e3645bab84e33f58b45273cd8099e0aa3e3f
SSDEEP 393216:+pDjSekRHLSH8nHAWXUkxBknIc/gFgWXuFvy0tv9LGOac:evySHiHDtBM9wPQVrp
TLSH
T122E6332073A120F1C1A9C6B64F4FD7C6C671FB966354AD9B5984FE07AE87052B2432CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery hijackloader loader spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\VpnJob_i686
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4f5-28.dat	family_hijackloader
behavioral2/files/0x000c00000001c511-120.dat	family_hijackloader

Detects Windows executables referencing non-Windows User-Agents 9 IoCs

resource	yara_rule
behavioral2/memory/4388-147-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-157-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-169-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-172-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-179-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-214-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-620-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-647-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4388-698-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 3 IoCs

pid	Process
4968	Build_Electro.exe
1344	Build_Electro.exe
3040	Aggregator_Data64.exe

Loads dropped DLL 28 IoCs

pid	Process
4968	Build_Electro.exe
4968	Build_Electro.exe
4968	Build_Electro.exe
1344	Build_Electro.exe
1344	Build_Electro.exe
1344	Build_Electro.exe
1344	Build_Electro.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
4388	ThreaArray.exe
6012	libhost.exe
3000	ElevateSer64.exe
1272	libhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4388	ThreaArray.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 4388	1344	Build_Electro.exe	93
PID 1344 set thread context of 6012	1344	Build_Electro.exe	95
PID 3040 set thread context of 3000	3040	Aggregator_Data64.exe	97
PID 3040 set thread context of 1272	3040	Aggregator_Data64.exe	98
PID 3000 set thread context of 3208	3000	ElevateSer64.exe	103
PID 3000 set thread context of 4540	3000	ElevateSer64.exe	131
PID 3000 set thread context of 3208	3000	ElevateSer64.exe	103
PID 3000 set thread context of 3012	3000	ElevateSer64.exe	141

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Windows Defender\ThirdPartyNotices.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	ElevateSer64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	ElevateSer64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\OEVDthread_v4_x64_test.job	libhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ElevateSer64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	libhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_235434e1ef6709f9da36f73a8981be28_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build_Electro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aggregator_Data64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2416	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318947925775855"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3000	ElevateSer64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4968	Build_Electro.exe
1344	Build_Electro.exe
1344	Build_Electro.exe
1344	Build_Electro.exe
1344	Build_Electro.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe
4388	ThreaArray.exe
4388	ThreaArray.exe
4388	ThreaArray.exe
4388	ThreaArray.exe
4388	ThreaArray.exe
4388	ThreaArray.exe
6012	libhost.exe
6012	libhost.exe
6012	libhost.exe
6012	libhost.exe
6012	libhost.exe
6012	libhost.exe
6012	libhost.exe
6012	libhost.exe
6012	libhost.exe
1272	libhost.exe
1272	libhost.exe
1272	libhost.exe
1272	libhost.exe
1272	libhost.exe
1272	libhost.exe
1272	libhost.exe
1272	libhost.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3208	chrome.exe
3208	chrome.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe
3000	ElevateSer64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	ElevateSer64.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1344	Build_Electro.exe
1344	Build_Electro.exe
3040	Aggregator_Data64.exe
3040	Aggregator_Data64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeDebugPrivilege	3000	ElevateSer64.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe
Token: SeCreatePagefilePrivilege	3208	chrome.exe
Token: SeShutdownPrivilege	3208	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe
3208	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4968	1152	2026-08-21_235434e1ef6709f9da36f73a8981be28_elex_wannacry.exe	90
PID 4968 wrote to memory of 1344	4968	Build_Electro.exe	91
PID 1344 wrote to memory of 3040	1344	Build_Electro.exe	92
PID 1344 wrote to memory of 4388	1344	Build_Electro.exe	93
PID 1344 wrote to memory of 4388	1344	Build_Electro.exe	93
PID 1344 wrote to memory of 6012	1344	Build_Electro.exe	95
PID 1344 wrote to memory of 6012	1344	Build_Electro.exe	95
PID 3040 wrote to memory of 3000	3040	Aggregator_Data64.exe	97
PID 3040 wrote to memory of 3000	3040	Aggregator_Data64.exe	97
PID 3040 wrote to memory of 1272	3040	Aggregator_Data64.exe	98
PID 3040 wrote to memory of 1272	3040	Aggregator_Data64.exe	98
PID 3208 wrote to memory of 2380	3208	chrome.exe	104
PID 3208 wrote to memory of 2528	3208	chrome.exe	105
PID 3208 wrote to memory of 2528	3208	chrome.exe	105
PID 3208 wrote to memory of 2416	3208	chrome.exe	106
PID 3208 wrote to memory of 3084	3208	chrome.exe	107
PID 3208 wrote to memory of 3084	3208	chrome.exe	107
PID 3208 wrote to memory of 3360	3208	chrome.exe	109
PID 3208 wrote to memory of 5628	3208	chrome.exe	110
PID 3208 wrote to memory of 3360	3208	chrome.exe	109
PID 3208 wrote to memory of 5628	3208	chrome.exe	110
PID 3208 wrote to memory of 4316	3208	chrome.exe	111
PID 3208 wrote to memory of 4316	3208	chrome.exe	111
PID 3208 wrote to memory of 5900	3208	chrome.exe	112
PID 3208 wrote to memory of 5900	3208	chrome.exe	112
PID 3208 wrote to memory of 5132	3208	chrome.exe	113
PID 3208 wrote to memory of 4948	3208	chrome.exe	115
PID 3208 wrote to memory of 3472	3208	chrome.exe	116
PID 3208 wrote to memory of 4948	3208	chrome.exe	115
PID 3208 wrote to memory of 3472	3208	chrome.exe	116
PID 3000 wrote to memory of 3208	3000	ElevateSer64.exe	103
PID 3000 wrote to memory of 3208	3000	ElevateSer64.exe	103
PID 3000 wrote to memory of 3208	3000	ElevateSer64.exe	103
PID 3000 wrote to memory of 3208	3000	ElevateSer64.exe	103
PID 3000 wrote to memory of 3208	3000	ElevateSer64.exe	103
PID 3208 wrote to memory of 5932	3208	chrome.exe	121
PID 3208 wrote to memory of 3012	3208	chrome.exe	120
PID 3208 wrote to memory of 4304	3208	chrome.exe	122
PID 3208 wrote to memory of 5932	3208	chrome.exe	121
PID 3208 wrote to memory of 3012	3208	chrome.exe	120
PID 3208 wrote to memory of 4304	3208	chrome.exe	122
PID 3208 wrote to memory of 5804	3208	chrome.exe	124
PID 3208 wrote to memory of 2520	3208	chrome.exe	123
PID 3208 wrote to memory of 5804	3208	chrome.exe	124
PID 3208 wrote to memory of 4584	3208	chrome.exe	125
PID 3208 wrote to memory of 2520	3208	chrome.exe	123
PID 3208 wrote to memory of 4584	3208	chrome.exe	125
PID 3208 wrote to memory of 3888	3208	chrome.exe	126
PID 3208 wrote to memory of 3848	3208	chrome.exe	127
PID 3208 wrote to memory of 3888	3208	chrome.exe	126
PID 3208 wrote to memory of 2028	3208	chrome.exe	128
PID 3208 wrote to memory of 3848	3208	chrome.exe	127
PID 3208 wrote to memory of 2028	3208	chrome.exe	128
PID 3208 wrote to memory of 2704	3208	chrome.exe	129
PID 3208 wrote to memory of 2600	3208	chrome.exe	130
PID 3208 wrote to memory of 2704	3208	chrome.exe	129
PID 3208 wrote to memory of 2600	3208	chrome.exe	130
PID 3000 wrote to memory of 4540	3000	ElevateSer64.exe	131
PID 3000 wrote to memory of 4540	3000	ElevateSer64.exe	131
PID 3000 wrote to memory of 4540	3000	ElevateSer64.exe	131
PID 3000 wrote to memory of 4540	3000	ElevateSer64.exe	131
PID 3000 wrote to memory of 4540	3000	ElevateSer64.exe	131
PID 3000 wrote to memory of 4540	3000	ElevateSer64.exe	131
PID 3000 wrote to memory of 3208	3000	ElevateSer64.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-21_235434e1ef6709f9da36f73a8981be28_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_235434e1ef6709f9da36f73a8981be28_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
  "C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\ProgramData\VpnJob_i686\Build_Electro.exe
    C:\ProgramData\VpnJob_i686\Build_Electro.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\Aggregator_Data64.exe
      C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\Aggregator_Data64.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Users\Admin\ElevateSer64.exe
        
        C:\Users\Admin\ElevateSer64.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3000
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4540
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3012
    - - C:\Users\Admin\AppData\Roaming\DLLpool_observer\libhost.exe
        
        C:\Users\Admin\AppData\Roaming\DLLpool_observer\libhost.exe
        5⤵
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1272
  - - C:\Users\Admin\AppData\Local\ThreaArray.exe
      C:\Users\Admin\AppData\Local\ThreaArray.exe
      4⤵
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4388
  - - C:\Users\Admin\AppData\Roaming\VpnJob_i686\libhost.exe
      C:\Users\Admin\AppData\Roaming\VpnJob_i686\libhost.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2960

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8abefc728,0x7ff8abefc734,0x7ff8abefc740
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,17109301735726416904,5596253438526768184,262144 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,2549045898902260451,8616764294594217339,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=1476 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,12699559012882683815,5380249814612562263,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,18033424726627064972,6629927076977099000,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,16240227114185407672,12913578486955713,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4648,i,12494865895655677498,4115127633981844671,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,1887933343038355502,9746601671224654854,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,5795775711904321528,6678978294807141084,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5424,i,6127490505569708741,15698762972342210442,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5420,i,14714921770932584558,8222860945847360338,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5492,i,2455604781911064453,10206750068648979190,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,13976834283146755626,9251012403729806151,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6368,i,7118128708857011264,4606106385178478053,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6692,i,6714764023436610269,6203283213444837289,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5376,i,5071464177106400737,16881120243328758182,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,1981802100647308669,8806456561119377498,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5804,i,14678919433911608801,17962840686563012762,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,3983146817317822042,14858866050474596044,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5600,i,5455017878102747811,9876696031169096521,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5508,i,16589287882665832740,4387502806405963826,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6036,i,6299075388981252180,3408002855791203926,2097152 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:9
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,13532804617003409414,893645133532452387,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,14862080757707000282,440184650853683809,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,16652701925646395046,17592348988900538220,524288 --field-trial-handle=1920,i,16993728851214667930,16875544783945531721,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:4800

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2664

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1b4b4a12dc7cabee4d3c5170c63bd069177949585b71d24b627c6e8f11bc3dfe
MD5 82b7f2c4c7b95a7dbeac478990af5024
SHA1 8f370f65b1f8500e1af1b7fc79866a93e9086684
SHA512 2ea4a46527d2666fa75d7447e093ff6177aefeb5aca78b192a3cce7b974cff90f3431ab6a3a7a9ea53dfc4e86a09642608ef03740f31f59950aba1ddc268cddb
SSDEEP 192:ERjI+Ubv7FAPRp279gHsb+WNnN50ReVskwQwpVyIsnAUgR:ERjIVjUXcqwH0RqsxR
TLSH
T1A232942EBD156C7B5CCBE229FE617793D7F5202621952E84EAFC892C10E79CC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 cf35791253bb7696c73405d539673462d2df26f0d2ad356455d35e9e5282e035
MD5 fc7501264711e8773ff843f35dc7d621
SHA1 5a4d9fd4754f1012c4263f3c83f9032610449c1a
SHA512 019a9b8f777d6274f273888320d5f6cc5127e2a17a550df23d3b0ef6d1da3b8c29ff41a437c96565dfde5b8ffae987c0e0f6ae579b10f43cd9fdb194326bd453
SSDEEP 192:eoj4K6jf7KxkXqK4I40pUZNCgVLHrKHfFKslE/QCXzKD/QD+ErUkKN9ljIAl53IC:pjjIf7KxkXqKf/pUZNCgVLH2HfgsllCs
TLSH
T14B32E927A44D9A7B0FD8E54DDC126F8B6DF5419372780D2462FBAC0803A97CE114A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 1792948b994ef2d03d0d444e6b069e6b79388d7cdd902cf38e57f70548e5ff24
MD5 161e2181c2f17b7f1997a1a70d4709f7
SHA1 0957aad536fa71a50d1852e6540d8fe3bb841a94
SHA512 5488c5c85cdb89cdfbd2cbf64213662909dafc7be578670b6480c565b4ea9088fc2e4aba7a80b1475ee1c1a0736edb2bc8a48cc9186c84de1f3405ef2b4e36d6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 33cba7fcb26b280b84e1fc70ef45f86dc86d4297392847e89b293d470933db5e
MD5 bf05f74e04b87bc73d88e90cbab74a0f
SHA1 b619199a0c21ddbef1f4b6aa526a2b7ff546f610
SHA512 38cba5e8a55cc312c0e2a0e5c9fb21ba0e65c2ddbd7c6de09db4b5e00412bdd91f3b34d39b3ccc08e79810e245c553235651031f8e39d65b8d6b308b958f0fcd
TLSH
T159A002E141C4962BCD15DE74A0650A45726148541591438395962444D86F3F09706601
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f450089328cdc63c49c9ec0cd86145aa472ae35189848a97564e381de2f16d96
MD5 720e71973a8aac7414e6d80f47a7f6a5
SHA1 28e6c7d258f48174179f57e86d1061973e186c69
SHA512 2ecb84e66dc07d441c7ac7ad0e9e0091e56ae0774a08ff86c59cbf28fd2ae43e10f3999e7e726f697e8a01cf5f17414f498849f23672482c6e0d99d40a12a48f
SSDEEP 96:RC0d+OI4Q2k7i/jfTVZ9kuT5RDotok5O6DyB6gGyvXNQdrbfyYv4a:RC0G4DkG/FZ9kGDUDxSMAQdrbfX
TLSH
T17DA10771A86D8EB75976C448F5933A43CEA8A0AFA611AF44DEDC4E0C11FB1ED0342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 bf07ded5adf14f848cfedc8740d775d3ba970a5b4f53a422a518bc2f2579ed3e
MD5 46fa86d48e459e6bfa66be1f4fb69ab7
SHA1 a2c06e72560e017553d0c13a2b56f7366d2eeb14
SHA512 803e51347698726ef2bddda4b25c0c227578ae24d961d406db843e20e735e0a65d8a908d8a2f8fe1e3605d4392e9444d1e5cfdc1bb23083d7e5acd4d08cd8edb
SSDEEP 3072:ef5PoycZ4g6S3l7D31LSMkdhnMCO131x8Lw:S5PoycD6S3l/31Xksp91x/
TLSH
T10BD31250347CEF6E4F1BC56880AF280BC857D0465919B97D9FEBDEC960D64E503272A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 d796a9d9c7a8f56ab44221b0fe34d59556aa9f5b7e3b8f8b0d196653f29ec497
MD5 242cb01526374199939a0ba721df296e
SHA1 49f3ba109f6f64aa7cb99442a18a0cc0b1449472
SHA512 a3d741db5d87a0ee530983ec3722fe348e3e3140dca064a2aed9665950cac64b47db3ff71092890dac4db9ac23e3e11367830aa9b006e534edcfd04271a3da26
SSDEEP 3072:xf5PoycZ4g6S3l7D31LSMkdhnMCO131x8Lw:x5PoycD6S3l/31Xksp91x/
TLSH
T108D31250347CEF6E4F1BC56880AF280BC857D0465919B97D9FEBDEC960D64E503272A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1CFAD3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\1CFAD3E.tmp
Size 6.0MB
SHA256 8751114da52f8e276af837ccfb5d027bfd7fa27c2e6e9875e2b83e66377b7141
MD5 fa8fc6ff52c448671a0a68cfa3c4162e
SHA1 d5436a5c8a135154be0895f55a100b1cd2709e25
SHA512 d6db26f706b780e3e66e4add6a52fe8c4af914fcb66c81382ff56b8ec737d95d80242cabf5f6b4762d0e3f1308447e36cdcc4a49cf82c34dc94fc43c4aecf2fe
SSDEEP 98304:7ET/Z7lyBrny7638F6Wne1HMG0e9ihbjTykvoscRFYqjugUanF7Ne2d+fgKi1A3b:7ETh7YBry7I8F6WaMG0e9sjT7voscjDu
TLSH
T1395633BEFC2FEC1682F922C549215E31DD6A96FFDA01BA339FC843D5F4110876061A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1CFAD3E.tmp

Path C:\Users\Admin\AppData\Local\Temp\1CFAD3E.tmp
Size 6.0MB
SHA256 ea8ea9c5e0d72b281960cbba6ed45bc39cfb1804002c187a8423035fbfd60fd7
MD5 994418924c78fa0d9f4c810b6fdf21eb
SHA1 0dd84f4ec93ba038950d6afe3d326c579d2877dd
SHA512 3de5e40cc97c67d96488e9248e4ca20f8c1f6bf64a054c3744096bef9af4611d6e7452b536270183440cdc139d4eee1191673f02ea8b5d7d23d3df36453e5bee
SSDEEP 98304:RET/ZplyBrny7638F6Wne1HMG0e9ihbjTykvoscRFYqjugUanF7Ne2d+fgKi1A3b:REThpYBry7I8F6WaMG0e9sjT7voscjDu
TLSH
T1FC5633BEFC2FEC1682F922C549215E31DD6A96FFDA05BA339FC843C5F4110876061A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

485C9A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\485C9A1.tmp
Size 40B
SHA256 0bb581c136ac04b3c98bd89ea47dd6231aa297f3eab8f36c54440cdce5f87dc5
MD5 8c79745505fcad0d90d5b7f785e5194a
SHA1 675377ca445dd7612eee133c8bbc537d433b3dcb
SHA512 a075e94fc9147d625b2665dc7b2f8cbb83eb72f9a3dcbc80e3e826c93d6f7a0b716994262f759ec94776635ab01e4174f86f81442dc5b6507e9c349695c8abfd
MD5 SHA1 SHA512

Submit Download

58ED48E.tmp

Path C:\Users\Admin\AppData\Local\Temp\58ED48E.tmp
Size 40B
SHA256 649715f9dd84cf09122445a5d77051304c3bf4b36eca2f4bbee4525fc8a15864
MD5 dc21915c145526c1a3d75c3657c6fae4
SHA1 242ac2c537687b9ac34747c53ae87b1006913e4d
SHA512 c4f1afe54557409d8b1bd07e4c831a885ff9920971e15ab3df6c481c14755e9adad49e7af479c8b9e72625fc69dc1f251eee108759ced5109beda59544c28168
MD5 SHA1 SHA512

Submit Download

Build_Electro.exe

Path C:\Users\Admin\AppData\Local\Temp\Build_Electro.exe
Size 1.1MB
SHA256 5c189db9f77e1678cdba8b2f896ba0188839a5a4d961a86ad11df9f286a808ee
MD5 b5acd76504748b2dcec1b649bdff7d52
SHA1 2695e24bbcd9700b3256d60346f7d7aa684477bf
SHA512 d00ecd826e790f26de7be4ecc401e31bc82e6ab8abb3e71d27c56298fac46c616543f1ca5d9624fdbf925379769eb3abbaf8ce6b3abe99eb1c6fa5f7b76f2e21
SSDEEP 24576:LKv+UYmGOSNChXpuaj1eiNfRhB9bIk7BXJI5u:Lck+jNRhBV7dJI5u
TLSH
T1B635F831F5098E3DD66043B8096EAFFE936ABD2D5BE125FF52C03A9DD0301D22935A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E0B85C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\E0B85C0.tmp
Size 20.2MB
SHA256 9abb6203a1f9637b5f0f930bb9f5f26301895c4db28629f2676ee4a0e411dfb9
MD5 3e8367238891977718ac9c6027bff66d
SHA1 cf2903f78fa488d2385f4e7c3ffd314b15873d55
SHA512 0ae4fcd7c567cb108e004bd71b7b200c545eb1a1cac28a64de291e0ff89559a370df90010a5fe67d53ab1d4fcfd051d012bc7248223823a6fe7bd437f4b76d10
SSDEEP 393216:FETh7Gl3vbvtPSEN2rfkePTaOFO2M8Y5pXqZB+sigpv1+tQP9IYUPya4J1bNcY98:FETh7Gl/j4A2jke7W/80pXqBig/BP9DU
TLSH
T1D2273320FE5E914BDF7088A2AF354258668FF2EEBC06EB85D503CFA4145D535AE0EE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E0B85C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\E0B85C0.tmp
Size 20.2MB
SHA256 e87e20a5fba1a28da5480e7fad61e6f983f9db61587944601f92134e82f9e180
MD5 37cb0bfd0cfcadb42c70dc0bbd377311
SHA1 cb2b5c9030a20502f246c0c0acdb7e70602cfc03
SHA512 7c6ca835cde0c85a8a3c511f071e08468335b94503ddf0a49b259483a418905331da5b54bc35683198d9bcccb4b027a2cfbcbde1a2f0e27e88e24baafc00b633
SSDEEP 393216:PETh7Gl3vbvtPSEN2rfkePTaOFO2M8Y5pXqZB+sigpv1+tQP9IYUPya4J1bNcY98:PETh7Gl/j4A2jke7W/80pXqBig/BP9DU
TLSH
T192273320FE5E914BDF7088A2AF354258668FF2EEBC06EB85D503CFA4145D535AE0EE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll
Size 437KB
SHA256 97e71a3c697fb1ab3af777db39009e4602525e8c3aff0837ecc7031cba188165
MD5 cbf2f368dae5e7dcf338c6f63533a2a9
SHA1 66ed78a01447a005bf1bb5a3950a3e9b728972ca
SHA512 3fedbd8819f2f33ccfa537eea3450157ff445eedaeb8a069d453e22726eb3b90a3c93f8069845fe9dc0ff39d9f4ff71209f61c66aeb5dbb7590d47a91641944a
SSDEEP 12288:zm0Gxo1x5zvNk5/IQUG2MiwB19uaCOmhUgiW6QR7t5s03Ooc8dHkC2esGyadKN:ztR1x5zvNkfp2MiG1303Ooc8dHkC2eX0
TLSH
T1679417227B060DF1E49923B572CA431293F9EC6503A0E3C393DEF5196F662C6A773691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krpt.dll

Path C:\Users\Admin\AppData\Local\Temp\krpt.dll
Size 101KB
SHA256 1f0e5fb35e259c8289ca7657e461f02930de30c72b017b67633b8fb84c616a8d
MD5 a0c38e99aedfca1a2bf2e2dc543c3284
SHA1 e4fc4956c5817546de3de22b2e1d71bc9b99b913
SHA512 05f9db186a18f5cb093f981054b9785c872efcaea5a7880c410e203db158e6f2382d11061799f2339ddd90a4ef56bb0c84953a81aa0dc87fd010dc72684333ab
SSDEEP 1536:4zoHW4DgoOI0c0WSvUuJ39e8mwXAv33drcsxc5dHTkb7a+A76tBNn:72e7kBUOqNr1xc5dzOWhWLl
TLSH
T1B3A35A12B9448474D96E4B7038B97B33B2BDA9289FF245C763860B877E236C63D30756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resolverutil69.ini

Path C:\Users\Admin\AppData\Local\Temp\resolverutil69.ini
Size 15.1MB
SHA256 e023070c707178f6a2fbc0a4b0452c524715192100a5c0428e2b69043ab39d4b
MD5 3eb255e07b431db8932e7b3fc5940db0
SHA1 e7008fcc8486283669be46b2b16d2475039ba939
SHA512 37a2e8ba6148cbd985f8d47e4e52855e0bb0d759c7e4865dc246d8241fe9483c4a42849138d62fb13d5212d0e08b94507b203bc6dc141239d73192dbabac4459
SSDEEP 393216:O9UzhFAF3UX4fuiDkEx8HYQOnyC7DP9Km8xCvBKZAc:IUzhF/4fHkE2YaC7ZmxtR
TLSH
T1B9F63320D9CCDD92E617B5FC5BC11A9C15C4228E8F295C2476DA8AF079FE25C980B3F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3208_1880024129\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

spritedrv.tmp

Path C:\Users\Admin\AppData\Local\Temp\spritedrv.tmp
Size 28KB
SHA256 056c49db2d80f11510dc5bb5ee35de023e44b0d3c3f08e0f79c884b4c0ad06e8
MD5 70be054c9fef88cbbb5fc4cd3a57da3b
SHA1 2132b557c0366dbc9859dddc84815d95cd7bab27
SHA512 9878d5a5c82aee2921fc738f27955aa7542a573c14b199f13efaa986c00a8910964e4ed98b19e515e9ca275e3679b588e7d8227884c43110de18d003de23bea0
SSDEEP 768:o1FwDHiEaYCYtGMditW3RvcfUiA1U4yUMPO:UATaJdrsmU1U4VMPO
TLSH
T154D29E7BBF996E966C5BAD264428F082C210F5FB7F0704B2F9960857B038885D15AD93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.1MB
SHA256 71358d729b01bdf38dbe5440705ea68ea9225f93c834f45c5687b0ea2b417c4e
MD5 d4cf3fd5e8ee95431cfea69fa84ae57d
SHA1 80f5188570001e4fd5fdad9cbf38479dd4edd255
SHA512 a30488c43ca41ed36ee2917fe8e7a5280e0565859f719a1f709b13c18c3398f323c8ef24608e8f696214d9fe882c32b1a8686800490ca781196810220b30d43b
SSDEEP 24576:YWisOihSAdUDRdwE0OpuE4N7qWkGA+g7lyD6ZQtpmcvIZPoy4cncF4dN:zisOihSlDZuNN7qLZyD6yt6nccN
TLSH
T1B6453A093585E0AEDC6D3679136BB522346C76924BA8ECC373840BE98E305D17736EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 89KB
SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
MD5 4bea1ba68690620b78c7502ac968f0ba
SHA1 acdc523fa28632fcecede3eeaf62c6bce26527b4
SHA512 d451625494b54b96a481d34f5b42b9c631810558267e8b37b182fe09583422f1c1171a922c9abfe4227ee91f430f3579e8ab8173234264a435fdcfa6a16ce57e
SSDEEP 1536:WJJFW1PcUMCdLiNWNrjO+MT+S0OeneLDA50Xsd2zkkBGCGVbBBTkfeecb6RWSwgZ:I3W1P/MCdnQ+8EWXsd2ARNBPecb60Swo
TLSH
T10C937E9375F881B2D99E05B0D9BBFB161D3DE6410FF06BD71B949844DEA2BC09B3021A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThreaArray.exe

Path C:\Users\Admin\AppData\Local\ThreaArray.exe
Size 445KB
SHA256 e4334f2cbc32d087a0079a96f2281d21238a3db2771aa0c7c939d08f6916508c
MD5 3b264fc74ad9277ac263bdf9fc623b9e
SHA1 f15e1f77af6779637a6bfdb78744079579ac693b
SHA512 f4cbc1603b0b2588c4724fbec202786b6846ae524eb74b45c26f0cb4d2c082ab7ca1a112a317e2148a5c402e885bb423af713e36fb85d2057315ac3ab3faa62f
SSDEEP 6144:mzw4CZLYpi7tV6SoGERYI2T/0ASDxCFRB3brPdohm1giJQBbPonD7FZ:T4a7gGNI2ABxCFHtosy9onHFZ
TLSH
T1FFA47C16A36404F9E473D1398C525913F67278150330EAEF53A88A6A1F63BE0AE7FF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aggregator_Data64.exe

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\Aggregator_Data64.exe
Size 135KB
SHA256 56cab098626dd709ebb5e5a7262105d4ccc63f64d0a322309555a905cd615d60
MD5 f6e5eec3ace589a83c3ce6b3c49c47ba
SHA1 13d7a6ca7f6fcd3013a5a03a5b22bcb29d92e206
SHA512 ae78874c88d8696ba2c654de1cf5ea7382e9427293631f1b9fbc9f2d77d9bfe647898127eaaadaa03a3cd66499a40f0473ec8fab651ce7af69017b38bf0ebdf7
SSDEEP 3072:auD0UquWuYu/BmHDTreIJZq7OTZcgqt5IZosTLkGrOiS:BxTlYu/IDTre91wLlzS
TLSH
T1F4D36B1132D1D032F19724355BA6C7B24E7E787669A2ECCF3BC686B64F24791D21832E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCGCBPRO1100u100.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\BCGCBPRO1100u100.dll
Size 4.7MB
SHA256 e650ae0d297b0de8b7a708003dc07e5a5ed7542b39e0519dcc11be582986117e
MD5 b560e9da72827308c322f8c18c76617f
SHA1 100e0c71d2890bc5ce600768e31c6c6b13f5695d
SHA512 dccc1ad8ec97f559ef09f3bb245daa82defe558ec561c24512c08b0043851271cc54d09dc46216385f09afadfa287d86ff65061aa8ff0da0ef11adaca80e31fd
SSDEEP 49152:inJn0WQqXU2JY33XK2dMYD3rzMwbzUVujdhHVUkdpRlHtgvDDyQkmMbJxY9XZ+x:inl0WOlK2Gw3fMwboVuH6kXRR
TLSH
T1C1367C30BE7C027AC5DE95B59E3E366F4D5EBD50472842C75168385AB870AC23633E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FeatureSwitch.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\FeatureSwitch.dll
Size 62KB
SHA256 9023552a39117772e5d44c52deef13b1066825f49b538c3849f6c7192091b711
MD5 5ca0ba3dbf6e8adeb99f1ed97cc3123f
SHA1 5af6a411b275c26365b7bc11f6922e5364aa8a28
SHA512 5a64def2f357038a03cdfc8913dbaa06da9a2d947f18733df9dc6cd454b70f5eb1cabd4d6b342ae7bde2f00fddc9293135a48a99b913d18f271a9010b67d2d22
SSDEEP 768:1yyiUPdWUUUWhvPNgpf4YYA/Q1K6h053antEDpm42jFy5vynA+QFAChYiAHfY3h/:0wvBuA/9mEk7ZtnA7ph7j3hCH7c3htz
TLSH
T113537D0565958033F3E35E382AF4E2B94D7F79422BF1508F2B6905B94FA17C19A3837A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAXCODEC.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\MAXCODEC.dll
Size 110KB
SHA256 e4d065c0eb2e9d2212178a928365aeb1b7fcd4f9ee130fbfb9e5e797813c891e
MD5 afc0e83ab3f9f1f045e7d0e55cbe2a0b
SHA1 92f86b237bee8e83034904456ddace056d1b9d62
SHA512 4e49852054b34fbf6afcf2a40fe769c580660911dcd98bf05cd7555880dd872591cee39f34169a0628641abe5d3380b5bc91d9bcd23ae1d97e456b7ef1f44edb
SSDEEP 1536:DI1xxpkfYLtPZdjKL/VUPy3I8FPcoyIO8PjG35OS7xIy8qM7l3hZY7qL3hl:DIhp+YLtaLN4y3ioQ8Py35OS7xqNxYE
TLSH
T1EEB38D12F6818033E5F7067AA8FE9B7D0A3E70648F9610DB7B8467995D205D31B352CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAXKERNL.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\MAXKERNL.dll
Size 185KB
SHA256 05b52151534b2b230cbeb1ba63af027c284329c76480142529af22b17b39b902
MD5 c437f13630424b4ffe37d9acfca19ee7
SHA1 c95ae747e358dc3fcd5f94212d37893284699b2c
SHA512 d422828aa4d61ac9cf9563dbe7fa64cb03b44996ce8b42ab675492e2fd1747f0445fca1828adb247a2dde3562f0d29b2ada7fbb6760a2ed26c977f0c354186ab
SSDEEP 3072:WIpzfcRp2PaPNDb5NOs7EaWTIEkrUiZLxGy24Qw8KjOJN5OtRRd5tXqea:HzURp2PaPNRN97ErUEkrTZLxi5N5OnXU
TLSH
T165047D21FA41C13AE9F70171EBFF6A9E283D9566033444C723D81CAA5D606D37B3929B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MFC100ENU.DLL

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\MFC100ENU.DLL
Size 54KB
SHA256 ee7d56095c1ccaa93fb2e86ae9381f77cc60cb332dbdcca49da63896349f98b8
MD5 3cf266ca615e03dc6c2afac0443d606b
SHA1 92aed0a7811c9ed1eb1a5b87b296253b010ec962
SHA512 838ef68081b91ca0c3dcc9e095fd472681c4bd23304b8b90a8d7858c06d848ffd8f41ddeab32e504741a8ebebdc1515d47eef5b31179fd95be3b5c69a60881c2
SSDEEP 768:HgIdijcuEhCgy4Y6B1CLPLNq5f/nWHBNheOU2fd5c1viY+w:AI0ify4Y6B8PLNYf/nWHNTd61vj+w
TLSH
T1D143736263F98605F5F77F752EB546605E3ABCA2ED38CA0E1640614E0972F50DEA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP100.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\MSVCP100.dll
Size 412KB
SHA256 cd28daeda3c8731030e2077e6eccbb609e2098919b05ff310bef8dce1dce2d8d
MD5 ed40615aa67499e2d2da8389ba9b331a
SHA1 09780d2c9d75878f7a9bb94599f3dc9386cf3789
SHA512 47d94c5f4829a0f901b57084c22b24adefb4aec2f7b8df9ea838e485dbc607aa837ed6d3c7186159499c44a3ff488fb04f770c624649a406854d82cd3baf72ee
SSDEEP 12288:AOb8zxr1aWPaHX7dGP5HrhUgiW6QR7t5qv3Ooc8UHkC2ebe:AOb8Fpa6aHX7dGP5Ov3Ooc8UHkC2ei
TLSH
T11D9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PPUtilLib.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\PPUtilLib.dll
Size 300KB
SHA256 178e832158c7fb2fffbeebb26b2a0ce35b710731b7cad51a600cfb7fe03a4fd6
MD5 ccb172f4b6dac0374e203b9e90342e29
SHA1 04473b0dcbe13bea53cbc90961fab9b206441f5f
SHA512 dabe7b182ef06fc2d61886b568336fb03cce69431c045fc9f0ce0219d4967369d651f15e3c3c966fc538d89eba814d087eb817e5d95bbab44673cb3204586748
SSDEEP 6144:wKg3kdXZ9g1Vg+kIWxpZ11OZhsl+KFJqzD:Ok/96kzpjFl+MK
TLSH
T15E647D207A568E37FAFA02349EBF661655ACB9100774C2C7E34C9E8EE8315C3993574B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XMAXUTIL.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\XMAXUTIL.dll
Size 79KB
SHA256 5665023d6154010e09c38da961fee756abc5d0673dd62f9b9baa0fa70697f4bf
MD5 0ec5fd79b9693951a807b6685c85ba01
SHA1 48b843d2ab1fa7e7518ba4a402972539796dcec8
SHA512 81d89b788de920da59a054e8440dedb2665356be46f6f3fe0dcaa4db98960870a8a47492c48ac40dfe14783bddeb8e08ebd2e179ba0c554ef41dd408add69a99
SSDEEP 1536:KC7rwJtwGQj8CIw5Up5wo6nJp2Zh89MhCbV5OGpwwJfmMMwoT733hNr7M3h6A:KCJ4f6nD2ZaMIbV5OGpwwJfpSXrR
TLSH
T1A6835C527E198422E6F6057079BC6B6E383DB2622BE500CB53171A4D0DB0BD3BF78756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maxrast.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\maxrast.dll
Size 157KB
SHA256 f39c0e4a85171484bade6171f4be8b2951e5de7c39f041160b9da2a44f4220c1
MD5 056d60dbbe43ddcf7729937319b75578
SHA1 643695ad727732d592af8dc4b9ddc10db18667f5
SHA512 d2823f0c228c14444c27f2c3264b5fc80f0651d5cb5594e974be4942ec5665aafbad7f1bcf92359565a54e92638582c5b646c6477621b8637273a766bfa5f0ff
SSDEEP 3072:0FJ2JIbY8XzQA4oASEl6N2Ld8Rj+N8IUpgtH55WEXmK+6jTdyAi8LuL:0FJ2JIbNzKff6UJudJsHn/2K+aTHuL
TLSH
T1F8F38DC2F9529E7ADADB087ED6AAAD3414EE0313077701E73665C941EB407C32DB528B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mesh_def.ini

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\mesh_def.ini
Size 5.2MB
SHA256 2b3544d69481083706eb59adc1ebfebbe37f7f74aa02aa66ae1e2c8dda3fb564
MD5 c09e475efd2a2e537990c8f56daa5a28
SHA1 50198bb6edda904b5bcab0f9ae0ee1b7e23c6375
SHA512 88b1749ff6b9bcc84eb2357e3aff5e5e1ecd271d31ba7dbce604d03543afd6b94435dc74d9351139426b39adf8da3af4dd2f3024ff18677a5a5a1381087ee889
SSDEEP 98304:lXSbb3PXrqFVrfqVerynOPtu28dquz+HZTp2MgGbgUiS6wL+TmPecU:JSbzPbqn7qVrotG7wZgerM1TyJU
TLSH
T1AA4633106F9C527ED0B3E16ACA6B70F343A376911B668D04B035BB50E94FF31A246F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc100u.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\mfc100u.dll
Size 4.2MB
SHA256 515f8c3683c36ffaf64d01693bb83eeb1f0dbfddecf95ec4d7c3f08e7f00c0dc
MD5 6358cc2a77f3c12c5b9b16190d5477f7
SHA1 47ee1895c6e11248fa6cd2a594f6395335453d35
SHA512 8eced5237cbd287b8a66044580b60fedf2a324ba377b2ac1e332f5bcd7aac6b212e9c4da1cd5f3b1aeafcc313da80040e634e05fccea60f803aaad19a18e6e7d
SSDEEP 98304:ZhRRni1aewd5ZnDRB+5sCpffcU1jQV7jztl8bo1pKkXwLNVk7hERtCDJFLOAkGkh:Zhi1/2JIg9JFLOyomFHKnPAK
TLSH
T14D268D227ED990B4CDD321B0469E7679A26EECD4273406C351943BFBE9743C16E3898B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\msvcr100.dll
Size 756KB
SHA256 25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
MD5 ef3e115c225588a680acf365158b2f4a
SHA1 ecda6d3b4642d2451817833b39248778e9c2cbb0
SHA512 d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
SSDEEP 12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
TLSH
T1D8F49E11B692C073C17221300629D7B25D7BB9711034A46BBBD99F3E1FB47C1EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sampler.bin

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\HEVLOYSTCNQS\sampler.bin
Size 21KB
SHA256 6aea8ab6eb723105792c3436d03d3ae8fe0c7fe5916dc5d9d82bb9bd255195d9
MD5 3f378810f585ce0370bf54611c43b68f
SHA1 1dbd46b867885b599cf864460cf5746b9ddee7c5
SHA512 c300f4186d5ab22d710abbbccaaf297495c14ff69c26b3135d591826e954caeca83b9d26ac37da54b78c81769cfcc5960dd25d6eb199de3662485972ab833911
SSDEEP 384:RqGh/1NyihkLmmD3sKgGzZByXX0UZNRqpnRWYOrFeECLJ8JrMLrkbQJEUpP7:RnRQ3gGdBUfKnRWcLJoMLobQJt7
TLSH
T1C1A28DBA8F1B2F476C0967B914A4F0F3CB90F0713B5E8521B7895C4E6430A99D474EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libhost.exe

Path C:\Users\Admin\AppData\Roaming\VpnJob_i686\libhost.exe
Size 432KB
SHA256 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
MD5 300414008e092e1e17ff64e831723d58
SHA1 be381def442f9d0275c80afbc3ce1f1f646dc7de
SHA512 60948e7357978e147073826070cee78021f2d3302145b1b4ab27065e2a57604ac34908cfdd679f388b5a16018cf64b07e0efe78a98c3883a127b52e8e8ef5a5f
SSDEEP 6144:rxQoGR3T8fG9QAgvF6CFpTBL4Qgy9hbWYdB9zlu9BUdN99H4+29Tg:WoKjrjgvF6ChgeFd/lu9BRS
TLSH
T184947B12F1E08031D27235320A75D77689BDB4309A646ACF67D8487FAF71AC19B2672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ElevateSer64.exe

Path C:\Users\Admin\ElevateSer64.exe
Size 1.7MB
SHA256 c085a724a067eec46d9a2c1eeae3cc04db33b9840f5c33eb87cc3027e12a6bcd
MD5 9fe84f7e1a8efc69d6169f47f9b67257
SHA1 f20766f333d6c3031358ca7f531a8abc4404cd42
SHA512 df92d9cf786dcb09d2a0b141bdbc8a6e5f60561450784715d2dc553ac45bb21ab07f2e63b5cb87d1150b1cfd0360c53ee6e4320a764bae72b4cc72c11a72d1bf
SSDEEP 49152:Lnhdaot6TJR9h+sFE0WRMQXZr3T46Uh6I3P:rtt6TJR9MqE0WRM6Dw
TLSH
T1E4858D617B89C22BEA8311B3D97CA74F981AAD610B1451C3F3883E5C5D711E3B939B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1272-173-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1272-167-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1344-54-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-117-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-87-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-69-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-68-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-61-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-51-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-46-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-43-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-41-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/1344-40-0x0000000075200000-0x0000000075201000-memory.dmp

Download

memory/1344-39-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/1344-38-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/3000-238-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3000-156-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/3000-710-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3000-176-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3000-180-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3000-151-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3000-622-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3000-161-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3000-660-0x0000000000F50000-0x00000000012DA000-memory.dmp

Download

memory/3040-160-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/3040-124-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/3040-122-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/3040-149-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/3040-121-0x00000000751E0000-0x0000000075232000-memory.dmp

Download

memory/4388-147-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-169-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-146-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-647-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-157-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-179-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-139-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-620-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-172-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-698-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4388-214-0x00007FF7B4290000-0x00007FF7B44F8000-memory.dmp

Download

memory/4968-30-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download

memory/4968-29-0x0000000073EC0000-0x0000000073F12000-memory.dmp

Download

memory/6012-144-0x00007FF8D1900000-0x00007FF8D1B63000-memory.dmp

Download