hijackloader | 1591dc2dd32dc9b5a43ce5c1c01ec18800c54ad3dc6373fd5945453021908f1e

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_3c4d4e718a0fd6c856f1433c2b0c0ea7_coinminer_elex_wannacry.exe
Size 5.1MB
Sample261019-hsmbkaev3p
SHA256 1591dc2dd32dc9b5a43ce5c1c01ec18800c54ad3dc6373fd5945453021908f1e
MD5 3c4d4e718a0fd6c856f1433c2b0c0ea7
SHA1 5de69a734fa437217da95d6e0586da2b9865533a
SHA512 1500bc67894a24d6c319c6b69e823419cfc2c59c9a8947146feb26e0d6c48cc75cfc480493bd84a25616e4b02bd04fcaf1df13b5435d4c06ffc7e3eb0eedd298
SSDEEP 98304:+p0uTJ9gAmuhKlQHHCg8Wyl2ljnI7U6qz7iUX4UqTcF3jb7pm6:+p0u19GuhK6Hig8WVIgZGUXRqTEf
TLSH
T186363319BBE06CB0C1325B73DF7CEF4281B2C78265901EC396958ED59E536E20247BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery hijackloader loader privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\AMDConnector
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Signatures

Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c61a-23.dat	family_hijackloader

Executes dropped EXE 2 IoCs

pid	Process
4396	AsPeer.exe
5368	AsPeer.exe

Loads dropped DLL 4 IoCs

pid	Process
4396	AsPeer.exe
5368	AsPeer.exe
3264	RadiantH64.exe
4744	Spec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5368 set thread context of 3264	5368	AsPeer.exe	91
PID 5368 set thread context of 4744	5368	AsPeer.exe	92
PID 3264 set thread context of 5684	3264	RadiantH64.exe	95
PID 3264 set thread context of 5256	3264	RadiantH64.exe	125
PID 3264 set thread context of 5684	3264	RadiantH64.exe	95
PID 3264 set thread context of 4684	3264	RadiantH64.exe	132

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	RadiantH64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	RadiantH64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	RadiantH64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	RadiantH64.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt	RadiantH64.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	RadiantH64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	RadiantH64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\winbridge.job	Spec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RadiantH64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RadiantH64.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_3c4d4e718a0fd6c856f1433c2b0c0ea7_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RadiantH64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4080	chrome.exe
6016	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3264	RadiantH64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4396	AsPeer.exe
5368	AsPeer.exe
5368	AsPeer.exe
5368	AsPeer.exe
5368	AsPeer.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
5684	chrome.exe
5684	chrome.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
4744	Spec.exe
4744	Spec.exe
4744	Spec.exe
4744	Spec.exe
4744	Spec.exe
4744	Spec.exe
4744	Spec.exe
4744	Spec.exe
4744	Spec.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe
3264	RadiantH64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3264	RadiantH64.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
5368	AsPeer.exe
5368	AsPeer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeDebugPrivilege	3264	RadiantH64.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 4396	1876	2026-10-17_3c4d4e718a0fd6c856f1433c2b0c0ea7_coinminer_elex_wannacry.exe	88
PID 4396 wrote to memory of 5368	4396	AsPeer.exe	89
PID 5368 wrote to memory of 3264	5368	AsPeer.exe	91
PID 5368 wrote to memory of 3264	5368	AsPeer.exe	91
PID 5368 wrote to memory of 4744	5368	AsPeer.exe	92
PID 5368 wrote to memory of 4744	5368	AsPeer.exe	92
PID 5684 wrote to memory of 800	5684	chrome.exe	96
PID 5684 wrote to memory of 4080	5684	chrome.exe	98
PID 5684 wrote to memory of 5116	5684	chrome.exe	99
PID 5684 wrote to memory of 5116	5684	chrome.exe	99
PID 5684 wrote to memory of 708	5684	chrome.exe	100
PID 5684 wrote to memory of 708	5684	chrome.exe	100
PID 5684 wrote to memory of 5992	5684	chrome.exe	101
PID 5684 wrote to memory of 5992	5684	chrome.exe	101
PID 5684 wrote to memory of 4512	5684	chrome.exe	102
PID 5684 wrote to memory of 4512	5684	chrome.exe	102
PID 5684 wrote to memory of 3924	5684	chrome.exe	103
PID 5684 wrote to memory of 3924	5684	chrome.exe	103
PID 5684 wrote to memory of 1420	5684	chrome.exe	104
PID 5684 wrote to memory of 1420	5684	chrome.exe	104
PID 5684 wrote to memory of 1040	5684	chrome.exe	107
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 5684 wrote to memory of 3572	5684	chrome.exe	109
PID 5684 wrote to memory of 3556	5684	chrome.exe	110
PID 5684 wrote to memory of 3572	5684	chrome.exe	109
PID 5684 wrote to memory of 3556	5684	chrome.exe	110
PID 5684 wrote to memory of 2536	5684	chrome.exe	111
PID 5684 wrote to memory of 2536	5684	chrome.exe	111
PID 5684 wrote to memory of 2788	5684	chrome.exe	112
PID 5684 wrote to memory of 2788	5684	chrome.exe	112
PID 5684 wrote to memory of 3376	5684	chrome.exe	113
PID 5684 wrote to memory of 3376	5684	chrome.exe	113
PID 5684 wrote to memory of 4360	5684	chrome.exe	114
PID 5684 wrote to memory of 4360	5684	chrome.exe	114
PID 5684 wrote to memory of 5888	5684	chrome.exe	115
PID 5684 wrote to memory of 5888	5684	chrome.exe	115
PID 5684 wrote to memory of 5260	5684	chrome.exe	116
PID 5684 wrote to memory of 5260	5684	chrome.exe	116
PID 5684 wrote to memory of 3884	5684	chrome.exe	117
PID 5684 wrote to memory of 3884	5684	chrome.exe	117
PID 5684 wrote to memory of 5500	5684	chrome.exe	121
PID 5684 wrote to memory of 5500	5684	chrome.exe	121
PID 5684 wrote to memory of 5428	5684	chrome.exe	122
PID 5684 wrote to memory of 5428	5684	chrome.exe	122
PID 5684 wrote to memory of 4736	5684	chrome.exe	123
PID 5684 wrote to memory of 4736	5684	chrome.exe	123
PID 5684 wrote to memory of 4732	5684	chrome.exe	124
PID 5684 wrote to memory of 4732	5684	chrome.exe	124
PID 3264 wrote to memory of 5256	3264	RadiantH64.exe	125
PID 3264 wrote to memory of 5256	3264	RadiantH64.exe	125
PID 3264 wrote to memory of 5256	3264	RadiantH64.exe	125
PID 3264 wrote to memory of 5256	3264	RadiantH64.exe	125
PID 3264 wrote to memory of 5256	3264	RadiantH64.exe	125
PID 3264 wrote to memory of 5256	3264	RadiantH64.exe	125
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 3264 wrote to memory of 5684	3264	RadiantH64.exe	95
PID 5684 wrote to memory of 4188	5684	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-10-17_3c4d4e718a0fd6c856f1433c2b0c0ea7_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_3c4d4e718a0fd6c856f1433c2b0c0ea7_coinminer_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\AsPeer.exe
  "C:\Users\Admin\AppData\Local\Temp\AsPeer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\ProgramData\AMDConnector\AsPeer.exe
    C:\ProgramData\AMDConnector\AsPeer.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\RadiantH64.exe
      C:\Users\Admin\AppData\Local\Temp\RadiantH64.exe
      4⤵
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4684
  - - C:\Users\Admin\AppData\Roaming\AMDConnector\Spec.exe
      C:\Users\Admin\AppData\Roaming\AMDConnector\Spec.exe
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:2308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdd2d7c728,0x7ffdd2d7c734,0x7ffdd2d7c740
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,2764430554660160493,10065302223987540303,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,16237038903393938386,10674299620382266003,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:13
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,16445507440129035884,5098451299204375996,262144 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,9471417982245829182,16376844143718838169,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,5445179837575968310,6864935824309605386,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,12415212171678678154,8875269647889803332,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,5115859773920353565,5462732198329023127,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,10668773052092480910,3667701678713794193,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5452,i,16049263899567198694,6925247488353592935,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5496,i,4539064899049123260,9295948861853234391,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5748,i,9506663714294929988,18242540847115878133,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5496,i,16262794948374458863,768403529875149231,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6052,i,12677297324329742546,13918889008929416505,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5912,i,16736011874830751412,11369279363175897851,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6296,i,9166907023944688616,1919157438164894499,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6452,i,14336145442113332392,14741941788295855888,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,8111519824725030140,11168164444743634805,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,11295420830702468132,2157465781282149557,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6324,i,9484957469609953475,14383740950987725164,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6428,i,5940878311929139135,3513759607774568401,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6264,i,10284517939305482609,5213404754885305724,2097152 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:9
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,15222816898364062717,3102522336236147404,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,8195157899041269663,13266656199942227383,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,8639107445434630882,11965190789389581491,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,13313656621088198255,15983069709660048278,524288 --field-trial-handle=2520,i,13231455435249224669,13868284338507327627,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1d36f7bc524e26b5d154482001523de1da4f0469

Path C:\ProgramData\Jovise\Cusak\1d36f7bc524e26b5d154482001523de1da4f0469
Size 106B
SHA256 075594131f27760430b198892e8b5bd867889014d5c284c0f85345046d3e8bbc
MD5 d932bbdff173105009acf08166abf7ef
SHA1 7bb094ad5878fa93c440770167bd786444e9db8a
SHA512 483851be6b7148099bc2728f60f356754ced96e130156663bc8c82ec74d600f5e6a46ab11896628989c3680ac3e7bb5918a37528dcd359e487a20900ea798d4b
TLSH
T1BDB09222E9810F114062066D8120A520A62020B8DE5D4F18E061B984049344336C0A88
MD5 SHA1 SHA512 TLSH

Submit Download

3c8b944c-66c7-4940-878b-582fb1aba57d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3c8b944c-66c7-4940-878b-582fb1aba57d.tmp
Size 140KB
SHA256 2ed7d320b76fb96b295207e67a1671818a53a6d55f0a035b76eb02af164706f2
MD5 361bbd719ada4dd20b5054d22badfa46
SHA1 52bbee891ddabb6cfa840ec6a8fe726d721e98e3
SHA512 2356038d69c0e00d84b7fcad72af06eb5f89e38aef33de93e0ddd27724aa0430ddbca886f07dce164ecb52b3ec57115b533a61f62551bcdd9d8c5ccaef01b4e4
SSDEEP 3072:ChrzhJ4OYXTDu0KsPlO2vbwnn4cEbcoX0gGrwuHAycIB/D5Ubjl:CBzYVTDumPw2DwnCWbrdAXbjl
TLSH
T18CE31261DCD7AE9A9CED0634E067770F7E742B4D420A06C8627A491B00AF1E3D7D9723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ffb03a4-0164-4ac7-81f9-b1d63bc6db9b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6ffb03a4-0164-4ac7-81f9-b1d63bc6db9b.tmp
Size 140KB
SHA256 00ffc3c0eb21026ffae81a6900710ccd8de7fb2d135c4d0ea1b5d5e815693884
MD5 6dfc3649a1eb553ab49e19f1201e6b93
SHA1 ed18143bc6aaeb91a5a136e698dc4f6c4bbc9a18
SHA512 b2954c6aa14e63b81fadcadd33e55b6d39a9628918b67f82e908f8288a88cd0861e0c93611b934582339708878c0b8c7fbb47abb745f91ee23e81e402a0eb9ea
SSDEEP 3072:ehrzhJ4OYXTDu0KsPlO2vbwnn4cEbcoX0gGrwuHAycIB/D5Ubjl:eBzYVTDumPw2DwnCWbrdAXbjl
TLSH
T1DFE31261DCD7AE9A9CED0634E067760F7E742B4D420A06C8627A491B04AF2E3D7D9723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 67ee11b51cd6f637795e31ab501f135ed595c8459bce885735f08b0418513a17
MD5 34c29bdb9e41b1f47f2d2786762c12ec
SHA1 4075131b18c3487e3e848361e112009c897629c7
SHA512 ca3a978798e77b2ced27b379f38e935ef18beaa7ea23e34270a9af20b37e1b1c5edf9478606311cf1acabd83992766cb3da8444de9394c674d5955bdbc53c0d0
SSDEEP 12:bHCskaXhVMMBKEKSCemJKlkQfIYVhYJ0X:bi0ROMMBS+MkEPYW
TLSH
T151259286B34455BBC54189B188AA17606274F9E89F82179A3B18E60F1E661DC0F51964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4069419d-36cb-43e2-b5f2-fc628875f183.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4069419d-36cb-43e2-b5f2-fc628875f183.tmp
Size 11KB
SHA256 7d5acfd0392b5c3bdc025ea1f42a7f158059aa23439f041cc12f8b9fd24e1984
MD5 8bbad7eda56f1a63a7fcd044e17ff5c9
SHA1 c1e22f630e03957cbabebbabcf129bfeb6698c32
SHA512 e47dff641c905f5f8a2dad793d6c6064737d915a33bd3f5b820b727d81aa3d2602309f18804e4412daab37fa0f4eb1bdb5683625f92ea4de1afc2f104f622e61
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN9y2AngkoP1:usjYb7KxkXqKf/pUZNCgVLH2HfgslzF4
TLSH
T18B32E92BA48D9A3F4FD8D51DDC176F4FACB502927268096497FB9C0803B978E114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e6f92ce3a0431674e1fedc746f5f9d6acc637064317244b3ee970b801034d239
MD5 3e4a982cad1a3efbdaa90d4a5f46d9a0
SHA1 e6703d1ae7b4b9bd61bfbfcfc2c2e2e731d0c61a
SHA512 6fd2cbee4ddc621901f38c1baaba3b2a7bbcf7b437b28f5f2275b82c544532ecca14214abc0cd141d7177370182e33e2a9c4df982a9a735aadeffef5a3fd583d
TLSH
T165E0E5BACD21E8270DFE0B185454074AD64613562B51495F7A3D611C8FB533B4286D6C
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS
Size 4KB
SHA256 ed043ff7b0020a443824f7bbcbbae81562d03a13a1ace3d78017fac38aea7da8
MD5 262c0580bba9c2d102a813b38f64fff1
SHA1 eff3c54df8e57f5b748dcc935e216c5d0b7d663c
SHA512 eea6b8fa3ba185cede423d6106a9dd35495db2fd8c62eb4b9f469679b529072f750e1efe3e26f4759f4635de7878c54d91a1a2c2321a756d296e05e591d2ee4c
TLSH
T18481044057C000F1D05C07F354D1530C4F17D1D4D5410F1317011155CCC17440C70FD4
MD5 SHA1 SHA512 TLSH

Submit Download

DIPS-wal

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DIPS-wal
Size 44KB
SHA256 100a59e36d2c1020cc72cd6047dd19129afd15a41fc71ed02fa93b62b4ebac6d
MD5 6d047abcb33fee931a7fd186136fe3d1
SHA1 2f2bcb5645cb4f4cf46bb0cbe710adb153a66242
SHA512 f6c8d7363d823312372e9e26bcfdb48e9eaa08277206f38e6232320dcfc83bb664d40c26df7bab32914d4324ec6db304636a8461af40cdfdfe8d6b6969b61a73
SSDEEP 48:YJqQq3qhmr/O43b/Y8uaLNW9WjWbfl4pwUQxFsEtb:+CEmrm43b/LuaLNW9WjWbfl7xDd
TLSH
T1C91366078E2A2CE1D5DA833759C94BD60F794769D35B6D6C6B6C20611DC168480FB0FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG
Size 320B
SHA256 0732a8ef1f0e74c9bc504ba66a7c6dadf7645299bc9e67aad540083574cd9988
MD5 48ccef485d04020fd5087b4689a7e827
SHA1 696efcdb24010005744c41fbc6bc712ba95e4bd1
SHA512 4892314f7249f75a9a1f93488a688cb076142103581cd58b1c0b5f8f0ac93b200f5f013c900dd04decb0ea6e7053635d0df91d93918546ada1ba99804fec4211
TLSH
T13AE0864D688FC16D1159E05786B1D30ECFD0284DE7C5740657C9C5CA318561D72D0B91
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG
Size 324B
SHA256 e138d6e1ee681c0c2406121ae1befc3c1e8d89a0098be91c00eb695ef6523579
MD5 91a3a39965783e31def91b8c3e72b86c
SHA1 509c9aa4ceb55d95b57429ea67050a4bac2f9853
SHA512 60db807dbb2603029309ccc069f3fc3306ee4f1e7aefc7859a779074cac2633ef86be862eaa7dfd0070b880737f571f39ca3320ecf575feb9ad362642918623e
TLSH
T1C1E0864CE88FC16D115994574372E30ECFD0284AA7C5B80657C5CEC9218961972D1FD1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
Size 320B
SHA256 9c1d43281421d12d51de60f0cd6dda2a1414948eb90d6fde43d92c2ba64bab29
MD5 552d2ef1d0466bcaa658461ca7ab5f4d
SHA1 d6a7e5bfc61702f5523d0c6f1f607e4cdac7e251
SHA512 760ea332d8d382cc8b34e36e661156737241d55351e5bc8d9a3fde02ba87128bb3e460a9a819739e942921fb420ec16e87f53525b34c8ad42737af987c275d19
TLSH
T165E02618358EC12E4158C5274765A30ECFD028A0A7CD3C0647CAC86421CA708A2E2682
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log
Size 911B
SHA256 4a6a611342d2817a4712f819f5daddc7ac9aded68c1af288c6664d663b3b246c
MD5 1f27edd5b0622c22e946abc611821f4a
SHA1 382d52c19000658df2c9a9ebb6c24e1d0c0cfd8b
SHA512 c125ae50e3f5c250a708e2e4c2024ee45cbe9c0651654c82e42f7d34a6109e08886e79aa2570812f92255bfecd90e4744acd1b02d1bb5ef0d8d549df7c15afc7
TLSH
T16A1199C82F44F326EA9F4835A8A693012BB9A9F02290489313F55C792DC9A90576B4DA
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\LOG
Size 265B
SHA256 0b9e7bd518b73027a4eee075112de7f67ca5580f29a97bc4cad340297b2a8598
MD5 52aaa23d243fb79f15c6ac0e7076b73c
SHA1 4e608488f148dd3eb0aa1b1d2d0343489674ee54
SHA512 d3452f5f2b8636da91fb1f840e5154a39418c427b8c82567e3afd5c131789e406b04c9e6a6004e91e28e33c9b202cf07dc12b52367e43f0e9d3142c8bbb5395b
TLSH
T154D0C20A26E6C62F02C480D70620930FCF8864889BE9264A8B81E488518A80CA0D0696
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

6b0c27c6-3d49-4f9f-a053-7443542ca4ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6b0c27c6-3d49-4f9f-a053-7443542ca4ff.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cd53a38c-1e06-4e7a-8f83-3b170475ecd5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cd53a38c-1e06-4e7a-8f83-3b170475ecd5.tmp
Size 2KB
SHA256 f2e4cda5186bb780ef869f91be71fa75b1971a8b8d5ac21e603da02de3e976ee
MD5 53889a05006e936cc516fd8c1b5b255f
SHA1 bdbcf0baf2e8d07ff21b6fe13b00e5c980a222dd
SHA512 dd587a297dceb93c59ac0d7853308d8e98496530a1da86f2c505ccc60de682a055acd7127ac349265641400c0d92fc0d353f40c605d821a8d342dfd72812b552
TLSH
T115417BF7C7D88A7E841166E4DA217E2FCD2D1A24121C3D22CCD4AE5B53E6872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 ad51f887fdad362b478362f20b5995d2a74cbed910dbd8d54d4954ecce2cc4f6
MD5 b92a8acbf61e5b0a9e2e4e15b7cf4d37
SHA1 053eefd37432f8ecc5788e61988064800ba5c7db
SHA512 88bef84166226fb2639b979115b3e67aedd3b443f66b09e4c3c9c64dab69bb582b366db2e910d15b41b432c9a6b2bea88a72598959984709f4728d1dfe24573f
TLSH
T16BA0021647D00515CD1092F0F06225813AA7CC14A552534394931554FB5B1C84515198
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7520f57ae8c1f92ed14410d6840cad6e235a9ad37d46f5fa87d1292e73c5ec41
MD5 4af851ab4291fcb21d8a1ae573a0134b
SHA1 6ec211f26f6b22218c83324cc5e604bb243f1329
SHA512 d2b812f03f605eb7e01045d90994b9f97135ae17d049be62e422ec937033206c7b1108ec458ac38437aa0604a7db1287dc6dbec0baf32c29fff0f53bc2a5e240
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

b4492f35-a181-4ed8-a611-602c6409791b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b4492f35-a181-4ed8-a611-602c6409791b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c0acbf2b-4071-4484-98f5-2f59f6f31b65.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c0acbf2b-4071-4484-98f5-2f59f6f31b65.tmp
Size 11KB
SHA256 05fbec17e8f830d9f5b127be6c60501ede362a12b52145534ae309ef590a7a33
MD5 8537c0fa9e1b0e6bb611f470adb87a50
SHA1 d1c7aac38c9b933b21dd4a1bd2ac18edc989775d
SHA512 61d229c10ef1dcef7b54fab0e22437992953ed357d5b973ef176442c9417224e48e151c07f886106e3a5002774819375d7941e9d96bb5bc1acd5afc758180df6
SSDEEP 192:NReT++v7VAPRp2GXsb+WNnZ202kd1kwuJp+iyIsnAUge:NReT+6kXlXwI0nd1sHe
TLSH
T12832952DAE24B53B9CDBD62AFE227753D6F5103134951E80E6FD892C25E79CC622700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8c913b8-7a5b-4bf5-973b-ecde56f704aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f8c913b8-7a5b-4bf5-973b-ecde56f704aa.tmp
Size 11KB
SHA256 8561f19cdb2d375346f2aa0303edb84fffd19efb0f2d6ac72c757472d1b360f3
MD5 631799d2adcf55855a3f5ec155718908
SHA1 1e893604a7a79e51eddfe6db3f336e296bdf7633
SHA512 88da1c2f3821e08fdf705af54e4d6a89c0c66dccf7cffc7952ad36e084eecd67842da24ab49acb63c1c3748315c4cfc3f6f0142124be245e38ced26b884e30bf
SSDEEP 192:NReT++v7VqPRpoGXsb+WNnZ20zUkd1kwuJp+iyIsnAUgE:NReT+6CXfXwI0zJd1qHE
TLSH
T17742B72DAE14B53B9CDBD61AFE627B63D6F5103134911E84E6FD892C25E79CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 140KB
SHA256 4c00930526e7d62f01b63afa0d8997fae90b4bba2093949be8e8875aa8ef6c0f
MD5 18d33e2d383f6b4b3347f523f2a9000f
SHA1 7b1b5fe7b3bad143fba5d511697536a52248d67d
SHA512 590c30a8d2ba52d21562853f6c5342e9737deda979ce9153f743b751f4790d80fe07a7ceb0a7ba2ef12f032fa006f97dbc9744be2b2d78e9d3c522039f75945e
SSDEEP 3072:XhrzhJ4OYXTDu0KsPlO2vbwnn4cEbcoX0gGrwuHAycIB/D5Ubjl:XBzYVTDumPw2DwnCWbrdAXbjl
TLSH
T1C4E31261DCD7AE9A9CED0634E067770F7E742B4D420A06C8627A491B04AF1E3D7D9723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

da36dfbd-5ca7-41e2-b66a-30e3c785e410.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\da36dfbd-5ca7-41e2-b66a-30e3c785e410.tmp
Size 141KB
SHA256 c4c23c3d56a795c0d907b41ccfe18a7ca11c0790b545da379d2843ac3c1b41ee
MD5 a6798e0ab76ce592df8f9f1a96878605
SHA1 9cc58abd01a9bad581a659572976799a74788467
SHA512 c89b3645aa5d32e3b2bff0ee7b9afb5e2561da2b86c75816eb03b619b977ed1164dbbaf67b809e11c18805b3591f7a2e5927e37f06d38a41348556da213643cd
SSDEEP 3072:9thrzhJ4OYXTDu0KsPlO2vbwnn4cEbcoX0gGrwuHAycIB/D5Ubjl:9tBzYVTDumPw2DwnCWbrdAXbjl
TLSH
T122E31271DC97AD9A8DFE0A38D053361B7DB43B4E860916C8716D090B50AF1E2DF8A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4dc6122-3d6c-41bc-855a-8ba925235989.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e4dc6122-3d6c-41bc-855a-8ba925235989.tmp
Size 4KB
SHA256 0da2eb08aff3e06273e98e97c14fde96264d693f42b5071075d09bb91088dcb7
MD5 9da658c9b3d2650a0c4cc34cd7fb823f
SHA1 607a44f3ad94b9df6affc330d4e62c6d37c1aaee
SHA512 5b1618f0b939c713910c4c87a6626e138c65f9a4f12bdd415f3e01e1d9752e2fd376169ef2e5104116a9b3f1a790c4501ee3a0cea6343ad6b237a473262c4dec
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5FAp0cDFwB6vGyvtBWG0ceD3bOj:CC0oWqNVVxi+9oP8DUDE0KCDeW9cq3bQ
TLSH
T12BA12A31A87999778AF6D485B1462E538FB870BBA921DFD4E8EE1D1C20B30DC0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 6a12b70d5f50f77dfc800c8a556294f5e50183348cfed1bea12d79771d515ff3
MD5 6323cc327b22cd2420df109845ca78e9
SHA1 f2074121336d4247965376aa31c81a521651fced
SHA512 ad90ad4e32e51254dce054cf65f640b1270dcf91737c0303fd35ce5acff095b94bddca1b3fa81d6c8635dd30f5cde8d0750c3177db25325ec427d798f8d78df5
SSDEEP 24:TLiz+4/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwBgfxnY:T4/IHRH34kWqB1kQnjhHmr6ITmUrxY
TLSH
T18B23986E9A2CA9A1FEE40B3ED7D1D0127B35AA0EC2E4D5F2099B506746C440405EB63F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

288e6cf6-0790-4262-82e3-1e4ecabeb794.tmp

Path C:\Users\Admin\AppData\Local\Temp\288e6cf6-0790-4262-82e3-1e4ecabeb794.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9DBE891.tmp

Path C:\Users\Admin\AppData\Local\Temp\9DBE891.tmp
Size 6.2MB
SHA256 53bad0d0f98916836c73ec6b88ab84374d94ed79eb142c4bbdc3e5a891cf975c
MD5 055a4ba7650023ccdbb67e03d7f429bc
SHA1 55ce5d302584e686d4a829bae208a6d7f6b05157
SHA512 0b985077ce26fb269bc6c449590cd1334805394d8f91cb2ba79fffdaafdb83a72b97f48945e47b9ae8cc44818f9a18b8dd4baec2fef10a870c9edb0ad37bbd3c
SSDEEP 98304:6qI8O2OY3JxUu+1Oh3XrNDKWnCZ0Bo4uwrFXpdzYGHzt5x9sKLtY+Zh:6F8IY3JxUOhDKUCZ0BoOFTfzgKLP
TLSH
T1386633D53EA4949CBCDA8E3C1329CC5E5C3B5ABAEB745FCC2E69A87205D12046C344B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9DBE891.tmp

Path C:\Users\Admin\AppData\Local\Temp\9DBE891.tmp
Size 6.2MB
SHA256 7aa8c7c561eaec09ec2374eb168c64475bbcc108a18296182f2112e9b6d86ae4
MD5 72854e844669e13429cadd11a1f8bcb4
SHA1 1d3dbc576914f828bc6cb5b997c65c3d5341823c
SHA512 a58cc4a38990516611d8f3e8cc7e084762fc96910a4a1cfa6d7a3df966312eafc8c0abeea2c44c121a9827410ea0b96f072af7068770bc1d3b7b536aade7095b
SSDEEP 98304:UqIzO2OY3JxUu+1Oh3XrNDKWnCZ0Bo4uwrFXpdzYGHzt5x9sKLtY+Zh:UFzIY3JxUOhDKUCZ0BoOFTfzgKLP
TLSH
T1A16633D53E94949CBCDA8E3C1329CC5E5C3B5ABAEB745FCC2E69A87205D12046C344B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AsPeer.exe

Path C:\Users\Admin\AppData\Local\Temp\AsPeer.exe
Size 83KB
SHA256 c3b1665400a527d7993a150fa202ae2060619e330f36ac22310761e0437d1506
MD5 a739794bd54c7f313bfde388f078e284
SHA1 7ee4f39756838b6d3156d8a4afeef234e411acd3
SHA512 ebc133230eb9f1e27e98e9c57ac0b67999dd2732119ae38178078d59227e6e11741462967bea9aca946633e89b03e8c646d3a2fbc4779c4b5c1f2a99e8edf189
SSDEEP 1536:bYuNfTRZRA34B8rC9xrcS0sE6eOGYywBu3PG:hNfT3Rw42rw1csReU2PG
TLSH
T1CD835C4A33A084F5D5524234C8A2CA34E772BC52677943CF2264BE667F737C29E3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C6A35F.tmp

Path C:\Users\Admin\AppData\Local\Temp\C6A35F.tmp
Size 40B
SHA256 c189d756335bfb38331cf83268ae87437434860f9e711ae2568a8e6a592fee18
MD5 03adecd28e38ac3b2212bbeb253f5875
SHA1 1a64e4fa3d48cd8c1f8360059bf699395db9b66f
SHA512 9e79dafeb463bbfb19de16af96cacba6acbb7cac5c1177596379eb884b46437ad8c09648fd7d5dc0af27632bfc2c5e4aa65707f3f7915087861074e62ed9a84f
MD5 SHA1 SHA512

Submit Download

FirewallInstallHelper.dll

Path C:\Users\Admin\AppData\Local\Temp\FirewallInstallHelper.dll
Size 48KB
SHA256 7445d1a81266cdbb6f3d353c81877f697dd5b319f0949d5cc638c49ada73485b
MD5 97b1a9946f28a0f0bd59959b4abaac93
SHA1 03d9bc781aaef3ac32dfb1ca3a6eab57c10f881e
SHA512 fbfcd2785e47deecfe8dcbdc79c5d3a19a2b14ea8f0282eb333f6d265da081c9ab9dbb6547f5bfe059afaebdfd9d6dcd13008e63b34dd611fcb3492176a82b95
SSDEEP 768:OTEkGwmdPFsGbBK01l8A44XgzkncDRKZLbXjkDrVMy1oUu4iYe:OVQsGFYA44XokcDRKxY73u4iYe
TLSH
T15423180633F100B5E0679735C9F39E51E3B2F8829775974E4668829E2FA37E15A39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RadiantH64.exe

Path C:\Users\Admin\AppData\Local\Temp\RadiantH64.exe
Size 1.7MB
SHA256 83144978dd44afb833c63f4dfac5135e27b64c518efdeaaeed5efd7b998b2cdd
MD5 f26dae677c446bf19c170273240a4f75
SHA1 d85a0dc614fb554d5c1e45379fc84013a33a275a
SHA512 cb996fb18d4b2e56fca4aeb83cc4808b8140084a16b21711b8829daa0d5af4d4e0a6551e1cbf3ef4612630b50f0a3ea9b8022c426df259ed601faa8d926c1090
SSDEEP 24576:LbvSW2lPDrBTIzZey2qqMpyYB/FNQYG5tQB4IlsqvFdyOXiT2PeRHdI:A58pNaDtQKIlsqvFd9STkeBu
TLSH
T14B856C23B245B43FD06A0A394877E558993FBFA579169C5F57E0488CCE3A4802E3E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kernelcore61.cfg

Path C:\Users\Admin\AppData\Local\Temp\kernelcore61.cfg
Size 18KB
SHA256 46eabccf863a22bfa3acba0e38d2e74da63b2f0f36a650324862ec236f75cf21
MD5 33f0ec222764a9a870ad921956b2fb49
SHA1 f333ddbf10e295b94c09dd45509cfd1fbc13a062
SHA512 88e98733bb92352155a545c2d2432999bf55d7054553a633106a1d789948bfa925c87b3f0e61fd7b40b1dd915f18b61b3069dda0cb665fa28cb9754559e2c343
SSDEEP 384:mcnXEYkNjWBYlPfJ612YQu4ovOZyIjR6EujZMQxnLwtEj9p:DXrkNqCf3dovujR6EujuQxnLdz
TLSH
T192826DB03E7EEECDDC812ED7A4907113C409E8E466858DE2D09B5E29A55C1C97F3CA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\msvcp_win.dll
Size 626KB
SHA256 e1a99ac49449ef7fcf07ee571553870f3c7bb8b3fdad97ea93276987ecff0333
MD5 bc127f7392bd82f2937ec7d4eed0c5af
SHA1 b7b0b15ab99b1d14802251d43c0f4e59b5d27ce7
SHA512 1f45664867c05ccde52e13cda262d0f2a90928175cf9477bbd9f2dc8cd9db79323a54dc81d7ffb07ab51c2febfaa557f110c613aa20f57688d055e2fd566381d
SSDEEP 12288:O+TTIwt0B5483RXXoTk4iQKQEKZm+jWodEEVUsS8hx:f8wdKnIkPQEKZm+jWodEEmsSS
TLSH
T137D41827BB5906A1D16693BCA5C74306E3F1BC154721A3C742EBE26D2F2B7C8673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resolver_diag.json

Path C:\Users\Admin\AppData\Local\Temp\resolver_diag.json
Size 5.1MB
SHA256 372cdb52914650dd26eea70bac04794cbd735f3d7a5cf7d49b718b561c66d21b
MD5 29a881c385c007dece7f90fd63dbcff1
SHA1 558488ef745ba55546f6ee8bf59168e14b1027bf
SHA512 eba591bc4835fb38d34df1fa0ea96c32761191d67bae9f3e890a3f457551b9d9a26e54a78fc53cd69fb400f5c7de52d1bbc1490975b0f73525a20b7062dcdf24
SSDEEP 98304:laD44pITWheYZvLIz7NvgyPUBWnLptY0Nq6uNCFqMvz4MNAESNCulkR+DP0Q0:EtITWhvDIzUBCHY0N4C3z4M+wNR+8
TLSH
T1B6463324EDEF8E42FDF570B5D4190CA62583BE4CDB640D148E8C70954D9EBABB8BA530
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_259670845\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\ucrtbase.dll
Size 1.3MB
SHA256 db6bc090827c93a24ed59bd73a6889f99b284c59e9abc9ad8bf1985d0b6ad14d
MD5 40ddc069a568ecb3f9db9e8a439278be
SHA1 8e4c5187915e3c224e6e9e2e33ff1de1ba8b947b
SHA512 451ac7db53dfbcfc31ed9bccb754eb7066c114de88b752af72c0aae4a0430eaf6eadb2fb66e54cd7564d151cea4af413fa3d5e996a1ab311608b9190832cafdd
SSDEEP 24576:HM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszZ7ymxvSZX0ypOpT+R:HM622DUVOb+uiMfE+nzTv2Apvz4VpQ
TLSH
T17055BE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ypau.7z

Path C:\Users\Admin\AppData\Local\Temp\ypau.7z
Size 17KB
SHA256 0c17bbb0c9699864fcf6ee719b9a580cc1a4f85f95705bfc5e74cc71b928b95d
MD5 8ccb230b2ea958360d0bfbda8e580680
SHA1 66cb492966fd605a330e9a9ab0ed0758f2258f09
SHA512 b60fa1ff8b8ef581f0a2154ef298b52c7a010d2937b19c63fab4f36ec0ac2723ee9495e0a1825a9d0194393a0604104fc3847687ed0e47ca4873940eb7748a7d
SSDEEP 384:FR17dtX4Ui3b+gJUCMEzqbMIJTf0/0gwxgXcOnncFup:FR17dtXq7iXMIJw/01+cencIp
TLSH
T1DE82D1AD2C27A04DF841B7E1EA502DF0D3DD8147865EF25E907D5FC32B1A86F857108A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spec.exe

Path C:\Users\Admin\AppData\Roaming\AMDConnector\Spec.exe
Size 144KB
SHA256 f99c12933c36ac9b9d33340145434a7d68f1688a7805ca325379a4b927521c99
MD5 7aa9b25a26dea6c18eb6f12bd12fb3b0
SHA1 c733f9e98bed9bde335bb36efedfb2010132e050
SHA512 cadff10f1e31103e443102ff950df5cb586372933899de6e50b83033ae55407f41ed9169c819b7cbcd71190fb960d3d916002312e5836594eadfa54dd84b36c2
SSDEEP 3072:zxxPGrlqO+NDWQ+WMqoQpFWzqSlxmW6PrbFSr:FUrrQ+WMMFWzqSnsXFa
TLSH
T1EBE3D08127703805DE524E31A4E4DB383A3C7D45AF0089BB325BF78F9B73781B95A269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-50-0x0000000000600000-0x00000000009BC000-memory.dmp

Download

memory/3264-46-0x00007FFDF8000000-0x00007FFDF8263000-memory.dmp

Download

memory/3264-41-0x0000000000600000-0x00000000009BC000-memory.dmp

Download

memory/3264-86-0x0000000000600000-0x00000000009BC000-memory.dmp

Download

memory/3264-47-0x0000000000600000-0x00000000009BC000-memory.dmp

Download

memory/3264-51-0x0000000000600000-0x00000000009BC000-memory.dmp

Download

memory/4396-24-0x00007FFDE7EF0000-0x00007FFDE7F53000-memory.dmp

Download

memory/4744-265-0x0000000073FB0000-0x0000000074002000-memory.dmp

Download

memory/4744-64-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4744-74-0x00007FFDF8000000-0x00007FFDF8263000-memory.dmp

Download

memory/5368-49-0x0000000140000000-0x0000000140018000-memory.dmp

Download

memory/5368-39-0x00007FFDE7EF0000-0x00007FFDE7F53000-memory.dmp

Download

memory/5368-36-0x00007FFDE7EF0000-0x00007FFDE7F53000-memory.dmp

Download

memory/5368-37-0x00007FFDE7F0D000-0x00007FFDE7F0F000-memory.dmp

Download

memory/5368-29-0x00007FFDE7EF0000-0x00007FFDE7F53000-memory.dmp

Download

memory/5368-32-0x00007FFDE7EF0000-0x00007FFDE7F53000-memory.dmp

Download

memory/5368-33-0x00007FFDE7EF0000-0x00007FFDE7F53000-memory.dmp

Download

memory/5368-30-0x00007FFDE7F0D000-0x00007FFDE7F0F000-memory.dmp

Download