exelastealer | hxxps://cdn[.]discordapp[.]com/attachments/1267020233915367485/1267036038988173422/PinCrack[.]exe?ex=66a752c4&is=66a60144&hm=b47ad7ceb0123d24dba1ec977fc74c3b8272fd539c26a9624216001af1774749&

Analysis

max time kernel
322s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1267020233915367485/1267036038988173422/PinCrack.exe?ex=66a752c4&is=66a60144&hm=b47ad7ceb0123d24dba1ec977fc74c3b8272fd539c26a9624216001af1774749&

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4052	netsh.exe
5644	netsh.exe
2528	netsh.exe
4940	netsh.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4948	cmd.exe
4072	powershell.exe
4240	cmd.exe
2416	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
5840	PinCrack.exe
5128	PinCrack.exe
3420	comet.exe
6064	comet.exe
5984	comet.exe
1564	comet.exe
4492	comet.exe
6064	comet.exe

Loads dropped DLL 64 IoCs

pid	Process
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
5128	PinCrack.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
6064	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe
1564	comet.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/6064-300-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp	upx
behavioral1/memory/6064-301-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp	upx
behavioral1/memory/6064-302-0x00007FFF4FFD0000-0x00007FFF4FFDF000-memory.dmp	upx
behavioral1/memory/6064-304-0x00007FFF368C0000-0x00007FFF368CD000-memory.dmp	upx
behavioral1/memory/6064-303-0x00007FFF36630000-0x00007FFF36649000-memory.dmp	upx
behavioral1/memory/6064-305-0x00007FFF36590000-0x00007FFF365A9000-memory.dmp	upx
behavioral1/memory/6064-307-0x00007FFF36530000-0x00007FFF36553000-memory.dmp	upx
behavioral1/memory/6064-306-0x00007FFF36560000-0x00007FFF3658D000-memory.dmp	upx
behavioral1/memory/6064-308-0x00007FFF363B0000-0x00007FFF36523000-memory.dmp	upx
behavioral1/memory/6064-310-0x00007FFF33180000-0x00007FFF334F5000-memory.dmp	upx
behavioral1/memory/6064-309-0x00007FFF35AC0000-0x00007FFF35AEE000-memory.dmp	upx
behavioral1/memory/6064-311-0x00007FFF35200000-0x00007FFF352B8000-memory.dmp	upx
behavioral1/memory/6064-316-0x00007FFF351C0000-0x00007FFF351D4000-memory.dmp	upx
behavioral1/memory/6064-315-0x00007FFF351E0000-0x00007FFF351F4000-memory.dmp	upx
behavioral1/memory/6064-318-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp	upx
behavioral1/memory/6064-319-0x00007FFF35190000-0x00007FFF351B2000-memory.dmp	upx
behavioral1/memory/6064-317-0x00007FFF34AE0000-0x00007FFF34BFC000-memory.dmp	upx
behavioral1/memory/6064-314-0x00007FFF35A80000-0x00007FFF35A92000-memory.dmp	upx
behavioral1/memory/6064-313-0x00007FFF35AA0000-0x00007FFF35AB5000-memory.dmp	upx
behavioral1/memory/6064-312-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp	upx
behavioral1/memory/6064-320-0x00007FFF35130000-0x00007FFF35147000-memory.dmp	upx
behavioral1/memory/6064-322-0x00007FFF35110000-0x00007FFF35129000-memory.dmp	upx
behavioral1/memory/6064-321-0x00007FFF36630000-0x00007FFF36649000-memory.dmp	upx
behavioral1/memory/6064-323-0x00007FFF34A90000-0x00007FFF34ADD000-memory.dmp	upx
behavioral1/memory/6064-325-0x00007FFF35000000-0x00007FFF35011000-memory.dmp	upx
behavioral1/memory/6064-324-0x00007FFF36530000-0x00007FFF36553000-memory.dmp	upx
behavioral1/memory/6064-327-0x00007FFF363A0000-0x00007FFF363AA000-memory.dmp	upx
behavioral1/memory/6064-326-0x00007FFF363B0000-0x00007FFF36523000-memory.dmp	upx
behavioral1/memory/6064-330-0x00007FFF34960000-0x00007FFF3497E000-memory.dmp	upx
behavioral1/memory/6064-329-0x00007FFF33180000-0x00007FFF334F5000-memory.dmp	upx
behavioral1/memory/6064-328-0x00007FFF35AC0000-0x00007FFF35AEE000-memory.dmp	upx
behavioral1/memory/6064-332-0x00007FFF35200000-0x00007FFF352B8000-memory.dmp	upx
behavioral1/memory/6064-331-0x00007FFF32A80000-0x00007FFF33175000-memory.dmp	upx
behavioral1/memory/6064-333-0x00007FFF3A390000-0x00007FFF3A3C8000-memory.dmp	upx
behavioral1/memory/6064-381-0x00007FFF3A390000-0x00007FFF3A3C8000-memory.dmp	upx
behavioral1/memory/6064-380-0x00007FFF32A80000-0x00007FFF33175000-memory.dmp	upx
behavioral1/memory/6064-376-0x00007FFF34A90000-0x00007FFF34ADD000-memory.dmp	upx
behavioral1/memory/6064-374-0x00007FFF35130000-0x00007FFF35147000-memory.dmp	upx
behavioral1/memory/6064-373-0x00007FFF35190000-0x00007FFF351B2000-memory.dmp	upx
behavioral1/memory/6064-372-0x00007FFF34AE0000-0x00007FFF34BFC000-memory.dmp	upx
behavioral1/memory/6064-369-0x00007FFF35A80000-0x00007FFF35A92000-memory.dmp	upx
behavioral1/memory/6064-368-0x00007FFF35AA0000-0x00007FFF35AB5000-memory.dmp	upx
behavioral1/memory/6064-357-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp	upx
behavioral1/memory/6064-356-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp	upx
behavioral1/memory/6064-390-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp	upx
behavioral1/memory/6064-402-0x00007FFF35AA0000-0x00007FFF35AB5000-memory.dmp	upx
behavioral1/memory/6064-391-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp	upx
behavioral1/memory/6064-457-0x00007FFF52920000-0x00007FFF5292D000-memory.dmp	upx
behavioral1/memory/6064-475-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp	upx
behavioral1/memory/6064-921-0x00007FFF36530000-0x00007FFF36553000-memory.dmp	upx
behavioral1/memory/6064-915-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp	upx
behavioral1/memory/6064-914-0x00007FFF363B0000-0x00007FFF36523000-memory.dmp	upx
behavioral1/memory/6064-923-0x00007FFF35AC0000-0x00007FFF35AEE000-memory.dmp	upx
behavioral1/memory/6064-922-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp	upx
behavioral1/memory/6064-920-0x00007FFF36560000-0x00007FFF3658D000-memory.dmp	upx
behavioral1/memory/6064-919-0x00007FFF36590000-0x00007FFF365A9000-memory.dmp	upx
behavioral1/memory/6064-918-0x00007FFF368C0000-0x00007FFF368CD000-memory.dmp	upx
behavioral1/memory/6064-917-0x00007FFF36630000-0x00007FFF36649000-memory.dmp	upx
behavioral1/memory/6064-916-0x00007FFF4FFD0000-0x00007FFF4FFDF000-memory.dmp	upx
behavioral1/memory/6064-937-0x00007FFF34960000-0x00007FFF3497E000-memory.dmp	upx
behavioral1/memory/6064-936-0x00007FFF363A0000-0x00007FFF363AA000-memory.dmp	upx
behavioral1/memory/6064-940-0x00007FFF52920000-0x00007FFF5292D000-memory.dmp	upx
behavioral1/memory/6064-939-0x00007FFF3A390000-0x00007FFF3A3C8000-memory.dmp	upx
behavioral1/memory/6064-938-0x00007FFF33180000-0x00007FFF334F5000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
81	discord.com
82	discord.com
83	discord.com
114	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
77	ip-api.com
136	ip-api.com

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4868	cmd.exe
1520	ARP.EXE
1640	cmd.exe
1372	ARP.EXE

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
5608	tasklist.exe
5264	tasklist.exe
1524	tasklist.exe
5156	tasklist.exe
5144	tasklist.exe
3108	tasklist.exe
5252	tasklist.exe
5508	tasklist.exe
4168	tasklist.exe
6056	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5528	cmd.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4876	sc.exe
4168	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000b000000023438-41.dat	pyinstaller
behavioral1/files/0x000700000001db31-386.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1452	cmd.exe
2532	netsh.exe
1244	cmd.exe
2108	netsh.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5500	NETSTAT.EXE
1452	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Collects information from the system 1 TTPs 2 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4416	WMIC.exe
5448	WMIC.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5548	WMIC.exe
3768	WMIC.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1452	NETSTAT.EXE
5580	ipconfig.exe
5500	NETSTAT.EXE
3108	ipconfig.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2332	systeminfo.exe
5568	systeminfo.exe

Kills process with taskkill 19 IoCs

evasion

pid	Process
4840	taskkill.exe
5324	taskkill.exe
1496	taskkill.exe
5452	taskkill.exe
5788	taskkill.exe
3108	taskkill.exe
3256	taskkill.exe
5080	taskkill.exe
1496	taskkill.exe
4528	taskkill.exe
4920	taskkill.exe
3524	taskkill.exe
5932	taskkill.exe
3844	taskkill.exe
3464	taskkill.exe
6024	taskkill.exe
5216	taskkill.exe
5856	taskkill.exe
5952	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-384068567-2943195810-3631207890-1000\{6B8AE184-8D09-478C-980E-A5A09139F309}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-384068567-2943195810-3631207890-1000\{FED3C977-A21F-4DA4-BFE7-AD8B74178F9F}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 386246.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
1176	msedge.exe
1176	msedge.exe
2516	identity_helper.exe
2516	identity_helper.exe
4052	msedge.exe
4052	msedge.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
4072	powershell.exe
4072	powershell.exe
4072	powershell.exe
3744	msedge.exe
3744	msedge.exe
2920	msedge.exe
2920	msedge.exe
4936	identity_helper.exe
4936	identity_helper.exe
5668	msedge.exe
5668	msedge.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe
5400	msedge.exe
5400	msedge.exe
2376	msedge.exe
2376	msedge.exe
3672	identity_helper.exe
3672	identity_helper.exe
2952	msedge.exe
2952	msedge.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe
1112	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	taskmgr.exe
Token: SeSystemProfilePrivilege	808	taskmgr.exe
Token: SeCreateGlobalPrivilege	808	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	5604	WMIC.exe
Token: SeSecurityPrivilege	5604	WMIC.exe
Token: SeTakeOwnershipPrivilege	5604	WMIC.exe
Token: SeLoadDriverPrivilege	5604	WMIC.exe
Token: SeSystemProfilePrivilege	5604	WMIC.exe
Token: SeSystemtimePrivilege	5604	WMIC.exe
Token: SeProfSingleProcessPrivilege	5604	WMIC.exe
Token: SeIncBasePriorityPrivilege	5604	WMIC.exe
Token: SeCreatePagefilePrivilege	5604	WMIC.exe
Token: SeBackupPrivilege	5604	WMIC.exe
Token: SeRestorePrivilege	5604	WMIC.exe
Token: SeShutdownPrivilege	5604	WMIC.exe
Token: SeDebugPrivilege	5604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5604	WMIC.exe
Token: SeRemoteShutdownPrivilege	5604	WMIC.exe
Token: SeUndockPrivilege	5604	WMIC.exe
Token: SeManageVolumePrivilege	5604	WMIC.exe
Token: 33	5604	WMIC.exe
Token: 34	5604	WMIC.exe
Token: 35	5604	WMIC.exe
Token: 36	5604	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5548	WMIC.exe
Token: SeSecurityPrivilege	5548	WMIC.exe
Token: SeTakeOwnershipPrivilege	5548	WMIC.exe
Token: SeLoadDriverPrivilege	5548	WMIC.exe
Token: SeSystemProfilePrivilege	5548	WMIC.exe
Token: SeSystemtimePrivilege	5548	WMIC.exe
Token: SeProfSingleProcessPrivilege	5548	WMIC.exe
Token: SeIncBasePriorityPrivilege	5548	WMIC.exe
Token: SeCreatePagefilePrivilege	5548	WMIC.exe
Token: SeBackupPrivilege	5548	WMIC.exe
Token: SeRestorePrivilege	5548	WMIC.exe
Token: SeShutdownPrivilege	5548	WMIC.exe
Token: SeDebugPrivilege	5548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5548	WMIC.exe
Token: SeRemoteShutdownPrivilege	5548	WMIC.exe
Token: SeUndockPrivilege	5548	WMIC.exe
Token: SeManageVolumePrivilege	5548	WMIC.exe
Token: 33	5548	WMIC.exe
Token: 34	5548	WMIC.exe
Token: 35	5548	WMIC.exe
Token: 36	5548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5604	WMIC.exe
Token: SeSecurityPrivilege	5604	WMIC.exe
Token: SeTakeOwnershipPrivilege	5604	WMIC.exe
Token: SeLoadDriverPrivilege	5604	WMIC.exe
Token: SeSystemProfilePrivilege	5604	WMIC.exe
Token: SeSystemtimePrivilege	5604	WMIC.exe
Token: SeProfSingleProcessPrivilege	5604	WMIC.exe
Token: SeIncBasePriorityPrivilege	5604	WMIC.exe
Token: SeCreatePagefilePrivilege	5604	WMIC.exe
Token: SeBackupPrivilege	5604	WMIC.exe
Token: SeRestorePrivilege	5604	WMIC.exe
Token: SeShutdownPrivilege	5604	WMIC.exe
Token: SeDebugPrivilege	5604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5604	WMIC.exe
Token: SeRemoteShutdownPrivilege	5604	WMIC.exe
Token: SeUndockPrivilege	5604	WMIC.exe
Token: SeManageVolumePrivilege	5604	WMIC.exe
Token: 33	5604	WMIC.exe
Token: 34	5604	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
808	taskmgr.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1524	1176	msedge.exe	84
PID 1176 wrote to memory of 1524	1176	msedge.exe	84
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 4356	1176	msedge.exe	87
PID 1176 wrote to memory of 3144	1176	msedge.exe	88
PID 1176 wrote to memory of 3144	1176	msedge.exe	88
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89
PID 1176 wrote to memory of 4152	1176	msedge.exe	89

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5688	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1267020233915367485/1267036038988173422/PinCrack.exe?ex=66a752c4&is=66a60144&hm=b47ad7ceb0123d24dba1ec977fc74c3b8272fd539c26a9624216001af1774749&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4c4c46f8,0x7fff4c4c4708,0x7fff4c4c4718
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,6091673184703248530,9720005603749962199,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:5132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5440

C:\Users\Admin\Downloads\New folder\PinCrack.exe
"C:\Users\Admin\Downloads\New folder\PinCrack.exe"
1⤵
- Executes dropped EXE
PID:5840
- C:\Users\Admin\Downloads\New folder\PinCrack.exe
  "C:\Users\Admin\Downloads\New folder\PinCrack.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c comet.exe
    3⤵
    PID:3604
  - - C:\Users\Admin\Downloads\New folder\comet.exe
      comet.exe
      4⤵
      Executes dropped EXE
      PID:3420
    - - C:\Users\Admin\Downloads\New folder\comet.exe
        
        comet.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6064
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:4548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:5468
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        6⤵
        
        PID:5436
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5604
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "gdb --version"
        6⤵
        
        PID:5464
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:5448
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:5508
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        6⤵
        
        PID:6020
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        7⤵
        
        PID:6048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:1268
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:4580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:4240
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:4168
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM "taskmgr.exe""
        6⤵
        
        PID:1428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM "taskmgr.exe"
        7⤵
        Kills process with taskkill
        
        PID:4528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
        6⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5528
        
        C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        7⤵
        Views/modifies file attributes
        
        PID:5688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
        6⤵
        
        PID:5616
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
        7⤵
        
        PID:4408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:6004
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:6056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1176"
        6⤵
        
        PID:5976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1176
        7⤵
        Kills process with taskkill
        
        PID:5788
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1524"
        6⤵
        
        PID:4484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1524
        7⤵
        Kills process with taskkill
        
        PID:4840
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4356"
        6⤵
        
        PID:3036
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4356
        7⤵
        Kills process with taskkill
        
        PID:5324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3144"
        6⤵
        
        PID:3192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3144
        7⤵
        Kills process with taskkill
        
        PID:3108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4152"
        6⤵
        
        PID:6012
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4152
        7⤵
        Kills process with taskkill
        
        PID:4920
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4608"
        6⤵
        
        PID:8
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4608
        7⤵
        Kills process with taskkill
        
        PID:3524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3284"
        6⤵
        
        PID:3220
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3284
        7⤵
        Kills process with taskkill
        
        PID:1496
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3756"
        6⤵
        
        PID:1632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3756
        7⤵
        Kills process with taskkill
        
        PID:5932
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2996"
        6⤵
        
        PID:2712
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2996
        7⤵
        Kills process with taskkill
        
        PID:3844
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        6⤵
        
        PID:3660
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        7⤵
        
        PID:544
        
        C:\Windows\system32\chcp.com
        
        chcp
        8⤵
        
        PID:3528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        6⤵
        
        PID:3752
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        7⤵
        
        PID:1912
        
        C:\Windows\system32\chcp.com
        
        chcp
        8⤵
        
        PID:2300
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:2736
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:1524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        6⤵
        Clipboard Data
        
        PID:4948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        7⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4072
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        6⤵
        Network Service Discovery
        
        PID:4868
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:2332
        
        C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        7⤵
        
        PID:3032
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        7⤵
        Collects information from the system
        
        PID:4416
        
        C:\Windows\system32\net.exe
        
        net user
        7⤵
        
        PID:1160
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        8⤵
        
        PID:1948
        
        C:\Windows\system32\query.exe
        
        query user
        7⤵
        
        PID:5296
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        8⤵
        
        PID:5804
        
        C:\Windows\system32\net.exe
        
        net localgroup
        7⤵
        
        PID:2396
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        8⤵
        
        PID:5368
        
        C:\Windows\system32\net.exe
        
        net localgroup administrators
        7⤵
        
        PID:4832
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        8⤵
        
        PID:5716
        
        C:\Windows\system32\net.exe
        
        net user guest
        7⤵
        
        PID:4688
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        8⤵
        
        PID:4596
        
        C:\Windows\system32\net.exe
        
        net user administrator
        7⤵
        
        PID:4524
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        8⤵
        
        PID:972
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        7⤵
        
        PID:1532
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        7⤵
        Enumerates processes with tasklist
        
        PID:5608
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:5580
        
        C:\Windows\system32\ROUTE.EXE
        
        route print
        7⤵
        
        PID:5216
        
        C:\Windows\system32\ARP.EXE
        
        arp -a
        7⤵
        Network Service Discovery
        
        PID:1520
        
        C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        7⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:5500
        
        C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        7⤵
        Launches sc.exe
        
        PID:4876
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4052
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5644
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1244
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:1496
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:5516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:1552
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:4248

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x104,0x128,0x7fff468346f8,0x7fff46834708,0x7fff46834718
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,18046084460966730438,9120661213676391916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:5380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Users\Admin\Downloads\New folder\comet.exe
"C:\Users\Admin\Downloads\New folder\comet.exe"
1⤵
- Executes dropped EXE
PID:5984
- C:\Users\Admin\Downloads\New folder\comet.exe
  "C:\Users\Admin\Downloads\New folder\comet.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4164
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:1816
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1492
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:772
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5608
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1428
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5808
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:180
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:60
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2920"
    3⤵
    PID:3316
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2920
      4⤵
      Kills process with taskkill
      PID:5216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1856"
    3⤵
    PID:116
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1856
      4⤵
      Kills process with taskkill
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3560"
    3⤵
    PID:3772
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3560
      4⤵
      Kills process with taskkill
      PID:3464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3744"
    3⤵
    PID:3660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3524
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3744
      4⤵
      Kills process with taskkill
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1704"
    3⤵
    PID:1556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4408
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1704
      4⤵
      Kills process with taskkill
      PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4832"
    3⤵
    PID:5416
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4832
      4⤵
      Kills process with taskkill
      PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1140"
    3⤵
    PID:5512
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1140
      4⤵
      Kills process with taskkill
      PID:5080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5840"
    3⤵
    PID:3144
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5840
      4⤵
      Kills process with taskkill
      PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5380"
    3⤵
    PID:3104
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5380
      4⤵
      Kills process with taskkill
      PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:1152
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:4468
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:5584
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:1800
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3280
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1452
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:1640
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5568
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:5792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:5448
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:4152
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:5024
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:5092
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:5004
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:5972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:1432
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:4468
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:5212
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:1528
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:1696
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:1152
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:4308
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:1728
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5252
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3108
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3588
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:1372
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1452
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:4168
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2528
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2948
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5092
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5728

C:\Users\Admin\Downloads\New folder\comet.exe
"C:\Users\Admin\Downloads\New folder\comet.exe"
1⤵
- Executes dropped EXE
PID:4492
- C:\Users\Admin\Downloads\New folder\comet.exe
  "C:\Users\Admin\Downloads\New folder\comet.exe"
  2⤵
  - Executes dropped EXE
  PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2344

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4248

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff468346f8,0x7fff46834708,0x7fff46834718
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4036 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,7267390898003636923,6196134851191344027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

Filesize
10.9MB

MD5
3648a657565b3537bbe7e56bf6a71a08

SHA1
4e81898d461e94da39a18c04aaa89e6e3971c649

SHA256
4c238ebf0c59b2554d05e8ed10597e9e453e37db5b1fafc5d26ec7c3425edf56

SHA512
04d35555d63921f603e945458fcde200dc8b9d564c679647478c86cd340e8b3adbf1e5fa57b4155c0dc428d5c400e6d781c6b633322abcab338c1380c3267d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
13fcc4fd7252f4d330a583951f8b43bc

SHA1
a82934a65679bf25561d21e3290f1c3a5433b070

SHA256
ed0a6a9b08ee17c4e8cc9c9313e7b21234df19bf3e4a7884e38af569d5323a59

SHA512
b61e0d80e282a15d325ee0bfcd964006207ce867c0faf11f1cf0916e6d271de60863c847de9a92ea7c0d5f4cd08019adedca6d346e5f82bddcd01e9d8363b5ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24a861537278eacf94e9522eb07564ac

SHA1
4bda6d7e01fc6a4de515c95700518111fd889c47

SHA256
60e1e9ddcf567e175c9558175e84c89cdf315b081ccf2403e94e4dee769ae110

SHA512
73c6a06a0a954038a31e845193b18a95bdcf987d59710eb802348b893f982d03a5ea654794b2f559bac863fab8ae5d404c14040b68e0307f3cd72e67cebe7557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58844fa18031652691c90361c9f37b15

SHA1
1b34c239185a39b0c2f425e78b1f002c7b63cd2e

SHA256
71bf1a6753e53908133a16f9c3cbca84f63001ddb03d9f604d23dfabc514e291

SHA512
4ba71b623c8f5a32cefdd6b021a95bdb7545bca854a13ddb37a1a96432834ee604ce986c61a72f609809f57ebc7c043111609c1f075c8f08e8b562c4bee9aba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04f275f9-99fe-473f-9326-3f5614d51232.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
0fb2d7902ac9061b8cf376ee3f2f1726

SHA1
be8e776bd0501cdb1d2b763a8bbd3d298f57adf6

SHA256
ecbe6a737ca5f4edcc0d4b3ee9ff5f2c4616c36f96a4e084972cbd574fa5065e

SHA512
0532bee9a6dc0cf4863d572b71d65b0ea5a34eee60b90aa225322c60f1ea8e70378c791ad022707cbb2d76e7ca476578a662b1b1cba078aa869a4ec7a6808f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ae59e.TMP

Filesize
2KB

MD5
a6415563fa0d4f9510b84261d32698d5

SHA1
4cc536848d17dfd488872757dab6992b854b5914

SHA256
f6dbd3082b4f7c4286bc032302ab5e07440604b3b9128066dbc762156e0cacd8

SHA512
7ad7094217a49e255258275eb9c096a0a6f0110487d98c7f9c42e8b52a2698ee84b5c28630ff7345dbf164ea33f801abc380216157f84056b0fd5c88a9dc7321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
816B

MD5
03c0cd959586f40b17b5ee992230a427

SHA1
21118dcfb48d74df5e5a8dd002a15531664be43c

SHA256
16a26e0c218ccee58fb8410b4584ab8a890ff62f07873bfe438e9ef8902ceee3

SHA512
f6df2c7584d298ec7b9b17fd74cb6d5397f30e59677d61d6dbbf27d120bfbc1f9199388d317fb7340555e6447d7619610d44518b0e80aba037252fea27ff454c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c11df99f328cf4396f75e516c127606f

SHA1
3c1f106bf79c6874c887e15612629869eb783734

SHA256
136bf8c726d5901ae2471b1eb1b9bf1eaccfc9a155f4ea6c371e6d5b5f343321

SHA512
3ad0a386cead83abd203949909804902a9bafb8738ba403d3dc6e3fd2ed663eab19af632e5978423527a8d93569eae493b378eff7ed5b2824e6be9fd2ba1e17e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0db50263155268901cf938d8564a135b

SHA1
8a0a5c28847df5bc2f2f3faf8ad8a89aed5cf3f4

SHA256
3029c9ab0716e54c792fad457835b830a7dd3f5b37eabc5fa695865e8a4e8dbc

SHA512
4a78e16acbf6571a91c1da8ff5ec3ba35a14bdc2ca4ce3d86673925d324d7d07def0c14bc1011396accd70ae0f34ddfcf845a4257a6e3a467a3505bcf7656228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e987cea08fc29bc09b923b98c312de5

SHA1
b091c32337e024f40c8d7b546abf901d0e3c67f8

SHA256
0f0742982e9d016692e37e039dcc7c7f49d70dec61c357be1ae4dbf8be4197c0

SHA512
7f139720d81db283e1c3c59f4d535b05799cfd4c89030c5625978fad38f8f920fe36f62fd63d0f95e2af9f58692d80ca13ecb175baa741d0ce04bc4855d72c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79fc02989b2d7d5de9146839bbc9ea56

SHA1
69cea57dd699ab2f81bfbbb78593831cca25c1cb

SHA256
b4e6de6fb1010021a0a30775f1173a4d40e57f88f96a838183341e7a501187b4

SHA512
a2fc5f47378c28042727b1dd923e3e69c6796f3a25bcf90334020b89d09c973cf36421b6b01c7d67badc611c2139a5ac9653b5367301dd384214247453fb203e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31881823454e2732916251d5478a8be6

SHA1
0cefdccf3cc0fbb7fc31cd14baa1557e4870792f

SHA256
4f7dcc4204a7b3dfc74d076f11224f06191915329099ad7feeb8d749601994bf

SHA512
551fb63e276babcae8a5f5fe38f56325ba3a0b7c5d9046f211718be8a2950f4d4a9860f9c15d984bdf403a03b7e95a02f445be1feb4e87d32aff3bffa00cbb32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ddfbfd24d0753bb7f1d6cfa51c21d607

SHA1
18a75dc784079c1929ac48ba119f6b074364e5bb

SHA256
434df84428b5abdc9af0d44ff6610f3596bcfc196a8ea946e7857ec941a82628

SHA512
d4d22ac4251b81ba5f3f0fdec6e177b0cbce2c717cb83f129f4c4fa6c501b84da543830b87d5d51ffe104b97d2f26dc667e319fe43868042f453140164fe7291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3560f3ae8c738fe875f9fe419d9302e

SHA1
3338ec4457245a3ffdf97fa31fc641344c369fca

SHA256
cd3c9d19c784a513a374dab9f93883c05ff61e5c0e7716aade9fbe548a395214

SHA512
ba5a07105dbc6671f6c272069173a7aeedb56842d9b87ceef776a4c68999a56e65845cada75f6247d2aad089475698255d375c604e5448d6ddc6c24bb84b342e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4396aee0d2ef951eff63f5c1df92df4d

SHA1
fc62f0925f956935bd25c57c780bcb3001838409

SHA256
0ac6f464f913ae537fdf3f85e48ac32e09b7bbaadeef93b3cafc8ecbe6918e4b

SHA512
ee5759376be73f66220a5a5830f214d06a1d775fbc7376faa069b8e91965d0bcd0abd53d04c55391a4f1e6860e4f5c41aad470e9b58d0f59dc5f4b3cb5b83be9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c1f9a26e114a83bdcd1f003eacc5c238

SHA1
f611759636012e2c7e45b734519ecffdc8f0205e

SHA256
c51bc887703ade9baf91e6e4ee0552045f3d8802fd4162a2c1ade8c17f991072

SHA512
e5b758d017215115836372f1fc103b4c1ea6cccb5609a5856ff0ab2c3ba251b4a0e5079ced758b355559dac489302c7a97a5b978aff960aa0c03aac1279c1ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
164fb7b37dc6bf808f83597630ab43e6

SHA1
3e6e89ecfd440c493648209f3fab605cd8b07650

SHA256
4d25eb7b64e9c61bcd698dac5bad39f9d3fd0cd52ba58a0df34dcb9389474f1d

SHA512
bc2281444cbfef1d2e0541e357a86739bfb176a7db550438d1a9aafddb682bd87962a5f0ed3613f28a669db4b48d278102f164a43d3fecab723951f1a6e9f985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
13c7208b624bfae687a7113620aba4cf

SHA1
19329afa596786e587ec85fc6a5a3dd6e6e8df45

SHA256
c919b6aafe6959d8c9742799a948f92799d016ed9a75326d320222357a275430

SHA512
9e32511ba40b653a545c6b95045be2681fcc3f2892dc570f4a417bf73be294fd38045c3a3d2fc8bff32cc3a7bb3bcf7fa3063a8c8d49a68421d9622053279194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
0714da31132b5d3ebc02a223bd8c1e9e

SHA1
18481c6c055c61d149977723bf733f7515494604

SHA256
e9e97a8e2194f7e3748394adc621a8bba1fb3989d1e5e813263e4b725d76c3df

SHA512
dd49a637745b761527c8abf4fe0e0de0286d649e184b1f11ba5e68b08afab609b867fa4e16c23ac18d76c0b787cdfbfece0a98ad00b2cde50681f7813d58aa93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c356efac7d325a96a10c32f70b09322

SHA1
084f6369dc61270f43b15a96dc79c384eccddbf5

SHA256
ef702dca9d350a63e22ed8c292fb1289cb523f6b5835abbc36a7b9be321b2ea9

SHA512
26eaed22d04d7e969a6934b564227a9b6adf2a40ce0ca359ccae654e72df6a4b667787556693f472174e6bfb1822643495edbc88c1780fc8bb14b4a23f30430b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a0fe0.TMP

Filesize
370B

MD5
5b678dc9c4eaa7cac43610cb8dedead0

SHA1
6a4f1a01069a731fb4ebcb63373ed9d788142540

SHA256
51e1adf3150386eb130d60a4e1cabded376dd66625145d47c1b3205faed9c6f3

SHA512
068c1e3509f0aea89420d64c27f62e40cc7d03e39d536d1ab712ba986b3f69237e11eb5963d0a39381cd32fe5641b32f7144274a68be9d96327f78f4d9d98077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1ab90fe822ddb7961690cb0b7354449

SHA1
484be6485916aa0aafdc088651bdcdacacb15a35

SHA256
93cc2b6242f4dd20a661f029ba96673caf31d1cad47518099f7e3fe6713b9571

SHA512
824862cd44c00402a30ba6159cbd9c01602070a15275ea3b9f369e578137f649d7f11cdf74adfa82f36f5e90875cf08ebfaec85149567c5faa97e78fd263e458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4ea800480a14e3a8a885f1fb55084d0d

SHA1
c5a0fd204c3dd905c39809d881ed28e0fdf86c38

SHA256
3a1034b41b6355a994f8dcbe1e083e4c38bc37008d075cac1486bd08caa74ff2

SHA512
f365fc5ba8bcba31f25cb344f6bfa62659bc48855febc53eea14e1e14887d79e9f8531a9d5cee2fe24d8c6b2ad69a85f5516a3acf4489232719f82429bb212ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7aba59f35509c3d8c9493353d2756ac0

SHA1
acd483e256ea136b843664f5038e941613931be0

SHA256
8dd9b557831a69c03506b058474aaa4b26811b7e318715ff8200b83ac6c0870c

SHA512
0c1b466688ca47956193bcc49d8d9c3171d01f89766e83c0d59a2877bc2bd1795c906fabdacb6c79156a1e4ec2cb7f9b4c5558c0f54dc60826ba91c7f2fcbd46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81599d18e7fedce8f15c1fc9b2724f5e

SHA1
061152400129f520f94e5e07a391d4fe09bbaf19

SHA256
07991828484410198c6a301e399e70d561520d09d041df20ed6c5761e8ce65c5

SHA512
344f1b8af2ff83527562cd88fffb9f61d01e859a1386b403ed7b0ac07756d3ff4fbec5677c9fc9a07721fd9cce9b11e32fe73c5b5b83afa79c0554e4b43ceead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3bfda414fa46d0ab77e0ed3cfa50b6be

SHA1
457a0478b1683165983f4bef57d9fe3186b934b2

SHA256
87665efecb687ffbec6b237cf3ced1c7a09dcbcae972a545f0d146e52f7485dd

SHA512
08a99badd4b1dbf2c05447a01440df9bdd734c8871ae4f8c3f775dcc78586556381be7327f91f4e705826f4bc7f22c85efe55b32b6bd8769d4b7861eb32fafc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\AssertClear.docx

Filesize
13KB

MD5
1b71053b8d9b22247790f9ecfb8c19b9

SHA1
56f903e8460693d0d2ef25f236bf27ef19bae98b

SHA256
c78a69399a75dd5f8385f52c576022c88384c87ad75426927292e450f31fe80f

SHA512
b7a4a1e191e7fbfaeef41714c3d769f2e6ddf7a0329c2327a3f86043e93527f23d68055659d5de6b042f20bd2613811df8fd658a3f62ae08aa386b5dd074f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\LockBackup.mpeg2

Filesize
274KB

MD5
fba6457784901c7f9e0983adaa9f0689

SHA1
99771b6d60aa80246ab9e462e88fd41cc919ef7a

SHA256
87a8242a8e3091daf23e2fff66fdfe29fbc204504f15e5d90d56a7d1a774e745

SHA512
727692a4c86ea9157a6ba60b14f684823135b65386a68bdb2b8387c9db650c0d27112d50566afc31e59993d91b2bda75f444515ae7e45d239a4a981ec000a053

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ReceivePop.docx

Filesize
20KB

MD5
473fe938263e751746bc5b4ea66d21a1

SHA1
2e138641c2e08a0a0b702d3ff45d584ed386bc70

SHA256
3652da77b1381751b41fb70acd79f9ebe711b0d9f326f3fd95272d230bb9c0e1

SHA512
ec0c0cc8cb932a591b53825a9440f205865f526796b859df1513f2a0756d48d4ac528697afb58ffd1c21b727de2cda903e5801cc2affd3884ae4e83eea2363ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RegisterEdit.jpg

Filesize
301KB

MD5
53f0ff73d8e98f9f5150274b3b394b72

SHA1
99f981c98c2164709774439628d84edee49bfcbf

SHA256
11ac0c2328d82210c02467854ac4ae0e1bab03e854c97bfee78847a47ad7e28f

SHA512
c1debf4eb821f1b17e44263d71f8a182cf0c72324b44df8dc594c9fe76cd2ea4c8d7c2f0d030a0801298063d1d1e8565965a6674e8f2f2f44e0a2ab763c691b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UnlockMerge.docx

Filesize
20KB

MD5
402cdb8bce63d2dcbdb694c847b91332

SHA1
5538043f8704bfb7ef457f9a8eb8bdd51a70c74d

SHA256
b8df9402fe5ba02e0e16d7022fb105e9bd63d88079a18f3113fb950938c37f06

SHA512
2522a6717353a8fa5f3c8c3b8915b163432ec2fa948e5157195f4462e903edbfd3d7fccffc003f98b84c3635e205c8e2f101a07f5eedc2fd7e54e7ebbdea666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ClearGrant.docx

Filesize
17KB

MD5
0fc98c98d3c729191592e1dafd413c12

SHA1
f30ca7ceaed9957961e4b3160e7a89e6473053ae

SHA256
273f4a62209145ab05f8e7fdf2be71599d85e6e953f9e58e95597bd7dff3eada

SHA512
5b62aaf88e29321ca66e56faae0b21bec92c199518cd043a1e278df41e81121d589e11206a65587653d14dd5b3d8b728164fca87a7ff932f89749eef5669fab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\FormatBackup.rtf

Filesize
720KB

MD5
74ed27c2207916cf8e4e997fcf36fea1

SHA1
293f4076c23c2b19f607e9f645858ca84cedad07

SHA256
014a3c142da0b8748ee4dc2bb2dbbf23b907a3470d0d1e36438de3548dbb40b0

SHA512
d6af5305298037aafbd12752a0a6c573e116997759a3b3352707e3f55b3f2f9496ad08ac4c16fce419e15165d8c186c002010ab2c7ae5d012f752d35baa1b296

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\GetLimit.csv

Filesize
1.2MB

MD5
c9e4547f87bbe1d638a65f8a0ec2e358

SHA1
49129f53bf22cf3fdc334387b9fbf7a54c463386

SHA256
c29acedb21a404cf93d967353b494d5102549565c09b55120d801a75bc9f1de8

SHA512
c8fc84583cfd1f6bb327664ab707456641ce09755d205f8e55f1097bda9127ac18b24fdbde50eadfdeefb8adc40a778b7b914cae3c5df8b85589b5c03b9a0373

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OutMount.doc

Filesize
520KB

MD5
6bfa27e7def81fc60b31277086c6b6be

SHA1
0d19ba384a25b1bd1cdef44f8fa1a4ecd59f59c9

SHA256
1dab89576bc11aca7682ed253c4733ed77e6304c07073c49fe688373e168f1a3

SHA512
87800b53495e3b0fece04c25690c62a17fd259c3cf319e844b62b2352a1acc34579247ed3ff849d44a14f44031a3624c52e7cf380d2278568b0f583d70f882b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnlockLimit.csv

Filesize
800KB

MD5
ce8343bf67420d42d0dd2134c84640de

SHA1
430ad2b6996679c09a9f21211e16f67bb36b6538

SHA256
faaaa9310f6140a8e4c94dbcd97e364bfa2237dccd18c7b140ab4112d0c1ecdf

SHA512
9ecaf763385becb01861f3a8056167dc2192fb801a15aa3a7c90a16b81f1eba9be3f307dc610ef3b25ded0baa031fb18ce28eaf08e02dde8431fe698b9cc9161

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ClearLock.mp3

Filesize
329KB

MD5
b155b1be269a49eac5c7204506deb8ae

SHA1
05a2481b769833d3451d67ffb2240bc552deb16d

SHA256
c6d10058973417527fe86070a2d0a49554f4e15ccae66e2499505d9f71743dbf

SHA512
b317464e902f5e51067c66b7c536f041a96529cc4f96e74d2a285eadbf4b3dd6681b38c65c88a77c5304583af1eaecab991b759d9fcd37de574975b3ef63875e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\EnableUse.mp3

Filesize
477KB

MD5
890e257517ad31096e3f7990479bf1ea

SHA1
7c1259899cabede28776ad113dadb291061c6486

SHA256
aff712a5b9e4a45fc247a06500c0a0af39d005a11616e9aa77cdfec31fd1f04f

SHA512
984fc45e266fcac2f3b80a655dd46ad76047c806275270602af157466cbae08a924c819b9cb80e4e8995c16e0b42bd1aa31db9ca164d683bce9a66cf6bfa761c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\StopBackup.svgz

Filesize
982KB

MD5
ee5aafe9deb3197a68a24b15534d956f

SHA1
ff3d4026957a0261a5f0a2386d1afd608ce841b9

SHA256
a1506e8645fbab1ea61bb586d0dfc2794f50b64a67fbc09b779c2020904248fa

SHA512
88aa9f633dc4a924fd2957f5d2c12d3d164e5aedb769b9a4e24180b35bdfc7f0d93408e0dd108c5dc8d63a5ad197f2ef5c2ea499b733312e06b860a8c5973b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ProtectPing.jpeg

Filesize
955KB

MD5
ff807c497307ecfd0f633eaec0f1d6c5

SHA1
737eb029124725c5766b6752305d3b37ad002a15

SHA256
54592a6b7a55ac8d40ba46bc2c28a2dd66e4f1906836d994fbe3e64d6118cb02

SHA512
6324e6e45557aeb8744343613276fc3dd585699d7d38dc5bf23d84d38135ba4ed2183e952cd0aa7dda0650a32f3898628c5cbc577353c94af27253d9ea52672f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ReadTrace.zip

Filesize
1.5MB

MD5
dfa7e55804f21eada042d03ce5d4cd5e

SHA1
106c7589071033fa10afaa765cfce781cfa2a1b9

SHA256
7a54aa0ee8cfa6bdebb18cdaff6489d6cf3b77d4c3a03c3668a61f3bec03844e

SHA512
88c1e5ae28744a45a3f63a666eb9713649245cdf75e8e76444a597585ba26952f6420c107bffea3f7c8ae49d46008b37772359f18704adba5a5529b941127a7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ExpandBackup.emf

Filesize
920KB

MD5
b989b7467b21f2c24b8d890ef05b7748

SHA1
cdfca4b54981e9758a4e44b8d91a8d3f486a6ab2

SHA256
62649fb838a6af889c7f7d9e39cbb5b4cae22c57a737e3b5abf16d2a019b7354

SHA512
8e088e7e414c889ebabd0da92883987aff8f4aa340ae166066f80535819713a31c53cae7ff671c8ef143857d796ca3cb97c934282e6a8160d9a522865b160444

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RepairRead.jpeg

Filesize
653KB

MD5
1cda3bf1ec0e496fa281e1f183a89bd9

SHA1
b5d33ef34d224c61cabc586201f369bcec927cbf

SHA256
caf1e7b85c41b3a221ae16dcf90176a4f031654960167eab52dd3c1d332c67d0

SHA512
a098f30461aa20b05fec0404158c4c0cf0ea5e872c15e971d40eabf4b29caa1bac8a0723d788548cb1a9847cfbef56907f66d5b00b9334c67d283289057f82ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SetDeny.png

Filesize
573KB

MD5
696f13c9524b796050f4daf4e7d74cd2

SHA1
1322dba5ffbfd7b43b4a6a922b2dcf9eb36dc4bc

SHA256
9135fcef7aa496beee49676e93e57e1361e1e361702854356787e60e4ad7de8f

SHA512
d05b46ff7549ca55742da57c3a4a96d6fa88b88c231ebbcce0339e098252dc12350df46c1403a95ac33b0317f545e5929a45f42d0a52a3dd5976e1fd602130f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
114KB

MD5
b8cc2baef1f875360bfdda7744393c14

SHA1
0171584e6a536e7d3eda342325f5e2ee6e3c1d01

SHA256
f269bb645500c9111dc28309e3e11562d69339e6c011f68e5eb5116637120f72

SHA512
f766673f9d2a31f9fbcda6b9a7c3036fcbebb3873514685681bb7defa6df4d03ff5d4af7e1753616e52bc65a48bcfde884f5de9df830f01cb8b49e8bd2067971

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-console-l1-1-0.dll

Filesize
21KB

MD5
a148dc22ea14cd5578de22b2dfb0917f

SHA1
eaccb66f62e5b6d7154798e596eabd3cef00b982

SHA256
7603e172853a9711fbdc53b080432ad12984b463768dbc3aa842a26f5b26ae23

SHA512
4e3c927692fc41889b596273aea8bbd776cf7644dae26c411c12bda23cd3299a5c9adc06a930294310f002de74592a244767378fc9e37ec76e86bfa23f4c0478

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-datetime-l1-1-0.dll

Filesize
21KB

MD5
3095c9577395249e105410bdcc585f77

SHA1
7dfc0c81f8f28cbf36c5acdb83523569b430b944

SHA256
c08be448195f46c4b423d0ce0c2cdc343e842ff1f91b16a8d3c09d5152150917

SHA512
555568fc23ade238bcc13a447520d395546def4409a002d795dd3abea03b15321491bc63c97f4ed8eb78aa411a0b1267dce5c528e51dcac8ca9e93b8f5265786

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-debug-l1-1-0.dll

Filesize
21KB

MD5
a00ebd3cf88d668be6d62a25fa4fb525

SHA1
edb07eafd08991611389293e2be80f8ee98f1e62

SHA256
b44646453584305d4edf8ab5f5d1adea6b9650bd2b75f8486fc275be52b86433

SHA512
d63f0e9f2e079ee06aa3ab96a0bd2d169564896027b731ee2597327bdc55456c5fd0c2d8c7e68165fc80bbc3fe0c24a3388d4c3615f33fc9f9fc0b205ae9ba7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
21KB

MD5
98340ffd2b1d8affef27d4b1260aeac5

SHA1
b428b39aa814a7038a1ddff9b64b935f51833a26

SHA256
7388a019922e9a0a3d05a8605a5307e3141b39f7d57b7faca5d34e72adfd5fa5

SHA512
6165c5be0360d55403e9dfd4e9df4ff9a12e5fb6057ed9278da09e688751487e46d9dd64949375c00764cbb4355cc13a1ea714055050f2ab7d432977b8443f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-file-l1-1-0.dll

Filesize
25KB

MD5
abf9850eb219be4976a94144a9eba057

SHA1
3d8c37588b36296240934b2f63a1b135a52fcee2

SHA256
41c5c577fea3ce13d5beb64ce0920f1061f65bcf39eafa8cd3dfc09ff48bcf76

SHA512
dfaafb43ce7f05b2db35eac10b314fb506c6aada80f6c4327b09ec33c170478ebd0eea19f1c6ca2e4832bfa41f769046deca8f15d54b7966134d166ee6036bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
2b36752a5157359da1c0e646ee9bec45

SHA1
708aeb7e945c9c709109cea359cb31bd7ac64889

SHA256
3e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc

SHA512
fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-handle-l1-1-0.dll

Filesize
21KB

MD5
567ff20a8d330cbb3278d3360c8d56f5

SHA1
cdf0cfc650da3a1b57dc3ef982a317d37ffb974d

SHA256
47dfbe1ecc8abc002bd52dcd5281ed7378d457789be4cb1e9bee369150d7f5c8

SHA512
1643e900f13509f0ef9c7b7f8f2401fb3b6f2c0c39b512c623615df92b1e69df042ef1a0c6aace82173ce5d4d3c672c1636d6ee05545ce5c3b7374ab745e0e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-heap-l1-1-0.dll

Filesize
21KB

MD5
a8b967b65232ecce7261eaecf39e7d6d

SHA1
df0792b29c19d46a93291c88a497151a0ba4366d

SHA256
8fcc9a97a8ad3be9a8d0ce6bb502284dd145ebbe587b42cdeaa4262279517c1d

SHA512
b8116208eb646ec1c103f78c768c848eb9d8d7202ebdab4acb58686e6f0706f0d6aaa884e11065d7ece63ebbd452f35b1422bd79e6eb2405fb1892758195ccbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
21KB

MD5
5872cb5ca3980697283aab9007196ae6

SHA1
26e8de47d9bee371f6c7a47f206a131965b6b481

SHA256
0dff50774693fcb71782b5e214419032a8c00b3031151d93be5c971b6f62cd45

SHA512
9b3e2fa9f66d29bfc7a4ca5d673b395bcda223a85fd06c94a11217047c1a312148c9c6270d7f69dfef06b25f8b5ad46717a829bde55f540c804a4ba4c4af070c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
21KB

MD5
d042aa497ce2a9f03296f8de68ed0680

SHA1
f483a343a18b960630ccf0e6de2f82883550f3bf

SHA256
de3d2c5519f74a982f06f3f3fda085571c0cdcf5ad8d2d331c79d9c92062bdc3

SHA512
4e157c8701860982ce0dec956fe4bfb684d2db3eaa9e784f179d385be905fd0551ba90cc27c54179fc39a693d9c742364f2bf1a5444424ba5eae38103b5f0e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
3589557535bba7641da3d76eefb0c73d

SHA1
6f63107c2212300c7cd1573059c08b43e5bd9b95

SHA256
642b01bb93d2cb529acf56070d65aae3202fd0b48d19fd40ec6763b627bcbee6

SHA512
7aedf3cf686b416f8b419f8af1d57675096ab2c2378c5a006f6ecbf2fe1ad701f28b7be8f08c9083230cf4d15d463371e92a6032178cd6c139d60b26fbd49b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-memory-l1-1-0.dll

Filesize
21KB

MD5
064fb2e1b5e90796a68d1edf91269ad3

SHA1
6e3a8c568f038879b7b102975a4471b2489f5493

SHA256
3500935e638f7d0ae2bf564bf77f9329811329261185fcdb9cd702b999889ffd

SHA512
821f091529d45531811a73664473cebb372a310d855e1a4c1a028ad4dc7d36146d3030dcf10de8a4a4bf16fb535fe3d0d2e1fcd22959690842388abb177b0036

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
21KB

MD5
d1bc9b3a7aa94d10c41fa16210aa9dba

SHA1
a358b824b1f26ead420d2100e5f1a3fb74af2b7a

SHA256
75652caf05e86adc88ed214fd208b4a289489cac2b28fd358e302e2e7c3c338f

SHA512
149478dfca0165d5a68e89070017cda3400926284eaa2143a810138ff710079cde413c031721de5b58cb834f03d4c5df5b4bd6c2bdb65687755ad77cae778b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
21KB

MD5
4f1303827a67760d02feb54e9258edb1

SHA1
340d7029c39708d14da79b12a0e2ed0a8bc7c020

SHA256
77fc9adf1a734d9717700b038b98b4337a494fc4f7e1e706c82e97dbca896fd8

SHA512
20f067d1c2749c709e4fc45da8d9eb5b813f54d0e09fa482d00bc4a7e5744c587d0afc00cdd5263b4223fe94baa3f8ca110d010339f9e3f1c6b2700888dbe3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
21KB

MD5
73586decad3b3d90653750504b356a5c

SHA1
39a7ee1660ca1291314ef78150e397b1d8683e03

SHA256
34f560c3e56f40db5df695c967b6e302e961085bc037bb9a1c2d2c866a9df48f

SHA512
9ec299e930d2b89ad379613f8fa63669ec7c858da8a24608b92175f42b0be75f8aa2e1727dabf7638ae9d2942d03840f288eab53f2c9f38dbea1325f1ea8b22b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
774aa9f9318880cb4ad3bf6f464da556

SHA1
3a5c07cf35009c98eb033e1cbde1900135d1abf8

SHA256
ba9fbd3a21879614c050c86a74ad2fffc0362266d6fa7be0ef359de393136346

SHA512
f7b57afb9810e3390d27a5469572fb29f0f1726f599403a180e685466237dff5dec4fdce40105ef1bb057e012d546308213e7cec73e0d7d3c5815eec8189a75d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-profile-l1-1-0.dll

Filesize
21KB

MD5
1be729c6d9bf1b58f435b23e7f87ba49

SHA1
4b2df3fab46a362ee46057c344995fa622e0672a

SHA256
4c425fbb8d2319d838733ab9cec63a576639192d993909e70cf84f49c107f785

SHA512
ceccc5ff2bd90a91cfbb948f979576795ff0a9503ddaafd268c14306f93d887975bd376b62ed688be51bb88b3a0c54ef332be93b4b0d8737b5ab70a661b11416

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
21KB

MD5
0b30c6862b5224cc429fe2eb2b7bf14b

SHA1
5c3affa14e3bfdafe09e9841a2920b57c7fcbc56

SHA256
d9c6f93c4972db08c7888d55e8e59e8aba022d416817d65bc96e5a258c859b5f

SHA512
b378f2a2812245ea948d81a925d041dbd7e7a8fb2770cf7dd47643da20f5c685c6121479f95b293177a9480290b17c49e7b4fc10d33734cf883d2c614daae1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-string-l1-1-0.dll

Filesize
21KB

MD5
b65933f7bcadc7072d5a2d70ecba9f81

SHA1
c53561755b9f33d0ae7874b3a7d67bedcb0129d8

SHA256
eadf535795df58d4f52fc6237fe46feb0f8166daca5eaaa59cec3cee50a9181d

SHA512
4cbb8bda8609404fe84ca36a8cbfe1d69c55dee2b969231b2fa00ca9139d956196a2babbb80a1a2bb430a34e6bd335294f452bcbe9e44411561ebdf21e4aba91

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-synch-l1-1-0.dll

Filesize
21KB

MD5
bccc676f2fb18c1a1864363e5a649a88

SHA1
a095a83a32a4a65fe16aa0be9a517239fac5db0d

SHA256
9d3f803dc791d2ff2e05059f9bb9207cc8f4134e1ac05f20edd20cfadd6e72c0

SHA512
55aab9fa6f7c4904e4beea4ce250f45fb71c2dd6a6f099f4017101ebc45c0a6e303b6a222f49c971992cafe8988a042b7ef8e94671be858c926105021514737a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-synch-l1-2-0.dll

Filesize
21KB

MD5
b962237df7ea045c325e7f97938097cb

SHA1
1115e0e13ecc177d057e3d1c9644ac4d108f780a

SHA256
a24dd6afdb4c4aa450ae4bc6a2861a49032170661b9c1f30cd0460c5dc57e0f7

SHA512
19ac4cccaaa59fbae042d03ba52d89f309bd2591b035f3ec3df430ff399d650fcf9c4d897834a520dea60dc0562a8a6f7d25a1fffcd32f765a4eaffe4c7d5ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
21KB

MD5
e4893842d031b98cac1c6f754a2a3f8d

SHA1
2b0187134e40d27553a85dd4ec89dd6c40e58a24

SHA256
abe4c1464b325365d38e0bc4ae729a17a7f6f7ba482935c66e6840e1b0d126c5

SHA512
fc61a66fdc7213857f204bd0b20671db7092e0010e07b5e0e8e8408ace8ac5b6e696a7d9fc969233b2b3ad5dae4d3b291b007ff27a316e7fb750bfc93257c532

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
b9a20c9223d3e3d3a0c359f001ce1046

SHA1
9710b9a8c393ba00c254cf693c7c37990c447cc8

SHA256
00d9a7353be0a54c17e4862b86196a8b2bc6a007899fa2fbe61afd9765548068

SHA512
a7d5611c0b3b53da6cac61e0374d54d27e6e8a1af90ef66cd7e1b052f906c8b3f6087f4c6de0db3ae0b099df7689ecde6c815a954b728d36d9d3b5d002ccf18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-core-util-l1-1-0.dll

Filesize
21KB

MD5
f7fdc91ac711a9bb3391901957a25cea

SHA1
1cebc5497e15051249c951677b5b550a1770c24f

SHA256
de47c1f924dc12e41d3a123b7dcce0260e7758b90fb95ec95c270fc116fc7599

SHA512
0e03c998622d6bf113e8d3b4dab728974391efecf59df89f938bd22240488e71885c05fb0fa805948b3d9645758409a0966299b26625aa36e3fd6e519ee22769

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-conio-l1-1-0.dll

Filesize
21KB

MD5
9eb2c06decaae1a109a94886a26eec25

SHA1
307ce096bee44f54a6d37aab1ef123fb423ed028

SHA256
da8fd2fe08a531d2331c1fbee9f4ae9015b64f24a2654a7f82418c86b4ab6909

SHA512
7e701cb00a4cab8d5b3ecf55a16fef0103f9be1aa3fd7b53c7bab968708c21e8d1c763ad80a7a8d6c76dd45ddd244c9c9e8944455c2025b4195660b61ac1e8b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
87e2934e49d7d111f383673f97d5029e

SHA1
267603d5510b775de3667f7d92bfaa3bd60e6533

SHA256
fb9dd774b25ab8e661c922caffb976c37a4d10a631ab65665da60016ef0c4d7c

SHA512
e6025ad419359ad3e06cc7a3b3b7436464dbbc71b91653833575264a5f8b0d781844a411bcd915d404b9a8c0a056eaf6d4d412723936845b53bfb5368bf5f7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-environment-l1-1-0.dll

Filesize
21KB

MD5
e41612752a7dfbbe756322cf48e106b9

SHA1
0ec106e926c9837a43e1d7ec8d1a5f03edd5ec3d

SHA256
4bb9d36e0e034652f2331ddb43ee061608f436cbc9e5771b4d27b28fa10f5248

SHA512
9bed9399e896d1cc58cc06e8d7ec6cc3345be6d15ca307c670e0f282c9ebe48a6cc1b145c2ecf94d84214cddff8f0d0d720ea984478c74c98e2499c2184638c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
21KB

MD5
102a8c01049ef18cc6e8798a9e5d57f4

SHA1
9adef547e03032d8c5525cc9c7d4512fbeb53948

SHA256
e13edab280e7b3410d7f4ce30a8e8cae64f38652d770fc3bf223206f0c57aaa5

SHA512
a9fbc726f33399f55f70967f3f1bf374589eaad9581d9e94228d39afa06cdce31ed25bdc04805aad361c7cafbeb56ca39f6693259d67457199d4423a61b32263

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
4b038cdc70357d2dec440717ac344a52

SHA1
f67ba87f6830858845a5763381a47893af061bf8

SHA256
6a24e9cfb0efd9e1b90053d4ebd87fc35144e61ae3f6555c7d400542d648e2b5

SHA512
9557f15fa3c06de89ea8be0c959b94575a1c4587151687730f9e66fed095feb882d43ea32262000f871e6d860ce0c6c341cf5509a6ce81866f6d0efacb8526fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-locale-l1-1-0.dll

Filesize
21KB

MD5
75f1a5f65790560d9544f3fb70efba51

SHA1
f30a5751901cfffc250be76e13a8b711ebc06bcc

SHA256
e0e02ea6c17da186e25e352b78c80b1b3511b5c1590e5ba647b14a7b384af0f8

SHA512
b7e285ca35f6a8ae2ccbe21594d72152175301a02ad6b92fe130e1e226a0faad1bfad1bd49857401549c09b50feee2c42c23ca4c19b2845cad090f5b9e8e8f63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-math-l1-1-0.dll

Filesize
29KB

MD5
a592d1b2ecc42d1a083f0d34feae2444

SHA1
29718af390f832626fcdcc57c107333cdb5743e1

SHA256
18a827b01de7b1a3d5c8d17b79ad2462a90308124448a9b8c47eccda39c3a095

SHA512
44bed6d24f1fa35b10d2b2b1574e7baf10182e60fdcb6cba5dd9de5cd7a5183198925e4fa5a7e2896564a30f7b70de69691713118d59bf5162ce35aff5bcf7a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-process-l1-1-0.dll

Filesize
21KB

MD5
e3914d51afd864a6c6587aa9192c491b

SHA1
bae85701809bc259a8744aafa45cd7159e6c13f8

SHA256
28257cc063431f78284335ce3002ffb71b75c1e7ccabf5417bb42392c35564b4

SHA512
43b1445a80d309ec73d52d6cf68f4533a132fb55ab672e5e2a878bb42c1cb36d6e4c504d43fa4923e692c8be600f3f9d5a5edde80602636cb726eedfca23dfb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
25KB

MD5
364bc49cc7034f8a9981ade1ce565229

SHA1
fbd76c1842d1ccf563ece2db32fff4c71e7ca689

SHA256
6254fd07ace88685112e3a7b73676aabf13a1b1bc30c55dd976b34fea12b7f1d

SHA512
65e59e3358eb1bf26823c9538c74d343e7383591c021d2b340ef68aa9a274d65b15b30bbbe55f4b32e3a08fc79d4e179a6ce92eadb8c4be09a2c35c348ce10af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
25KB

MD5
8341f0371e25b8077fe61c89a9ef8144

SHA1
fc185203e33abed12e1398440cb2ee283ca9541a

SHA256
bd9a5d4554ef1a374257e8dd9436d89f686006ed1fd1cc44364b237bf5b795ff

SHA512
9c7e4e8d8e9e620f441ab5106820ec021d2b2323f44ed8cc8ec9673745dbc531347356f1ff195d63b62b09cc5c27e8f8641ce25be12ee9b700b5fc766337228b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-string-l1-1-0.dll

Filesize
25KB

MD5
f9297b9ff06295bc07b7e5281b1face0

SHA1
d0eb0fddbb3eb187df0f0e5f9ddffcfc2e05f9b7

SHA256
c56a2ee0cc6dc1e7283b9bda8b7b2dba957329cb4bc9aca4cd99f88e108f9c04

SHA512
bec6222776015996eba744698d3254945dfe4bb4dc0d85528ee59a0f3b5fc5bb054bbf496d562cfc7b4cc81b4d3df5c53761931162a0091a49386233afba4f9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-time-l1-1-0.dll

Filesize
21KB

MD5
816a8932759bdb478d4263cacbf972e3

SHA1
ac9f2bed41e340313501aa7d33dcd369748f0496

SHA256
ce9a8e18923d12e2f62ce2a20693113000fc361cc816773037c155c273b99e7c

SHA512
5144f01bee04455d5b9a7b07e62f4afb928605331213eb483265016640198c175dc08673903ed5bc16b385ee76657aa4303776233d04347d9d1daadce39525c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\api-ms-win-crt-utility-l1-1-0.dll

Filesize
21KB

MD5
57d3ee548db3a503ac391af798e0e2a2

SHA1
d686a96c5046d6d7a022c4266a5d0014745360a4

SHA256
2c80280e51c242466e10a36a0bf2a341607983b6f6648f93b0718b34ab5285c5

SHA512
f3ea9c8f2f230d23bc878e37044599b2c77f0bf6dd84b07c2f87a84263fb9ac7f44732f05e14781b6046afb2a39f27135c96d2da2ab9605bd00e55d9b0fffb0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\base_library.zip

Filesize
1.3MB

MD5
8dad91add129dca41dd17a332a64d593

SHA1
70a4ec5a17ed63caf2407bd76dc116aca7765c0d

SHA256
8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783

SHA512
2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\python3.dll

Filesize
66KB

MD5
79b02450d6ca4852165036c8d4eaed1f

SHA1
ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4

SHA256
d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123

SHA512
47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58402\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI59842\cryptography-42.0.8.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yodkkq00.xuu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 386246.crdownload

Filesize
11.9MB

MD5
9d4be46e4975f6337dc513f325752d70

SHA1
acd752a934a338aa427fd9dd0b3e9688eeba6d37

SHA256
55c2a0e161928486a5cccff9546754e4b49f4036a0a3aa3fd9ea46a83ecff62e

SHA512
96480f02894312130b6894e20f32e4512cfa6e0e07ee4c96c1408923a99361f35ad0d50d36f2347bc638e7364e8ea62fbbdb8c537a887f05e1bdd076ec938342

Download Submit
memory/808-339-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-346-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-337-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-338-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-345-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-351-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-350-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-349-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-348-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/808-347-0x00000235BFC80000-0x00000235BFC81000-memory.dmp

Filesize
4KB

Download
memory/1564-1096-0x00007FFF4C5D0000-0x00007FFF4C5F4000-memory.dmp

Filesize
144KB

Download
memory/1564-1105-0x00007FFF4B7C0000-0x00007FFF4B7EE000-memory.dmp

Filesize
184KB

Download
memory/1564-1095-0x00007FFF36E50000-0x00007FFF37438000-memory.dmp

Filesize
5.9MB

Download
memory/1564-1109-0x00007FFF33B90000-0x00007FFF33F05000-memory.dmp

Filesize
3.5MB

Download
memory/1564-1097-0x00007FFF4FFD0000-0x00007FFF4FFDF000-memory.dmp

Filesize
60KB

Download
memory/1564-1111-0x00007FFF4B7A0000-0x00007FFF4B7B4000-memory.dmp

Filesize
80KB

Download
memory/1564-1098-0x00007FFF4FEA0000-0x00007FFF4FEB9000-memory.dmp

Filesize
100KB

Download
memory/1564-1100-0x00007FFF4C230000-0x00007FFF4C249000-memory.dmp

Filesize
100KB

Download
memory/1564-1099-0x00007FFF4FFA0000-0x00007FFF4FFAD000-memory.dmp

Filesize
52KB

Download
memory/1564-1108-0x00000166CEB60000-0x00000166CEED5000-memory.dmp

Filesize
3.5MB

Download
memory/1564-1107-0x00007FFF36D90000-0x00007FFF36E48000-memory.dmp

Filesize
736KB

Download
memory/1564-1101-0x00007FFF4BF50000-0x00007FFF4BF7D000-memory.dmp

Filesize
180KB

Download
memory/1564-1104-0x00007FFF36460000-0x00007FFF365D3000-memory.dmp

Filesize
1.4MB

Download
memory/1564-1103-0x00007FFF4B7F0000-0x00007FFF4B813000-memory.dmp

Filesize
140KB

Download
memory/1564-1169-0x00007FFF36460000-0x00007FFF365D3000-memory.dmp

Filesize
1.4MB

Download
memory/1564-1106-0x00007FFF36E50000-0x00007FFF37438000-memory.dmp

Filesize
5.9MB

Download
memory/1564-1113-0x00007FFF4BFD0000-0x00007FFF4BFE4000-memory.dmp

Filesize
80KB

Download
memory/1564-1115-0x00007FFF4FEA0000-0x00007FFF4FEB9000-memory.dmp

Filesize
100KB

Download
memory/1564-1116-0x00007FFF466D0000-0x00007FFF466F2000-memory.dmp

Filesize
136KB

Download
memory/1564-1114-0x00007FFF352D0000-0x00007FFF353EC000-memory.dmp

Filesize
1.1MB

Download
memory/1564-1112-0x00007FFF4C040000-0x00007FFF4C052000-memory.dmp

Filesize
72KB

Download
memory/1564-1110-0x00007FFF4C0E0000-0x00007FFF4C0F5000-memory.dmp

Filesize
84KB

Download
memory/1564-1168-0x00007FFF4B710000-0x00007FFF4B727000-memory.dmp

Filesize
92KB

Download
memory/1564-1167-0x00007FFF4B7F0000-0x00007FFF4B813000-memory.dmp

Filesize
140KB

Download
memory/1564-1166-0x00007FFF4BF50000-0x00007FFF4BF7D000-memory.dmp

Filesize
180KB

Download
memory/1564-1170-0x00007FFF466B0000-0x00007FFF466C9000-memory.dmp

Filesize
100KB

Download
memory/1564-1180-0x00007FFF3D940000-0x00007FFF3D98D000-memory.dmp

Filesize
308KB

Download
memory/1564-1185-0x00007FFF4B7C0000-0x00007FFF4B7EE000-memory.dmp

Filesize
184KB

Download
memory/1564-1184-0x00007FFF3DF80000-0x00007FFF3DF91000-memory.dmp

Filesize
68KB

Download
memory/1564-1182-0x00007FFF54190000-0x00007FFF5419A000-memory.dmp

Filesize
40KB

Download
memory/4072-465-0x00000274C2AB0000-0x00000274C2AD2000-memory.dmp

Filesize
136KB

Download
memory/6064-356-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp

Filesize
5.9MB

Download
memory/6064-914-0x00007FFF363B0000-0x00007FFF36523000-memory.dmp

Filesize
1.4MB

Download
memory/6064-923-0x00007FFF35AC0000-0x00007FFF35AEE000-memory.dmp

Filesize
184KB

Download
memory/6064-922-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp

Filesize
5.9MB

Download
memory/6064-920-0x00007FFF36560000-0x00007FFF3658D000-memory.dmp

Filesize
180KB

Download
memory/6064-919-0x00007FFF36590000-0x00007FFF365A9000-memory.dmp

Filesize
100KB

Download
memory/6064-918-0x00007FFF368C0000-0x00007FFF368CD000-memory.dmp

Filesize
52KB

Download
memory/6064-917-0x00007FFF36630000-0x00007FFF36649000-memory.dmp

Filesize
100KB

Download
memory/6064-916-0x00007FFF4FFD0000-0x00007FFF4FFDF000-memory.dmp

Filesize
60KB

Download
memory/6064-937-0x00007FFF34960000-0x00007FFF3497E000-memory.dmp

Filesize
120KB

Download
memory/6064-936-0x00007FFF363A0000-0x00007FFF363AA000-memory.dmp

Filesize
40KB

Download
memory/6064-940-0x00007FFF52920000-0x00007FFF5292D000-memory.dmp

Filesize
52KB

Download
memory/6064-939-0x00007FFF3A390000-0x00007FFF3A3C8000-memory.dmp

Filesize
224KB

Download
memory/6064-938-0x00007FFF33180000-0x00007FFF334F5000-memory.dmp

Filesize
3.5MB

Download
memory/6064-935-0x00007FFF35000000-0x00007FFF35011000-memory.dmp

Filesize
68KB

Download
memory/6064-934-0x00007FFF34A90000-0x00007FFF34ADD000-memory.dmp

Filesize
308KB

Download
memory/6064-933-0x00007FFF35110000-0x00007FFF35129000-memory.dmp

Filesize
100KB

Download
memory/6064-932-0x00007FFF35130000-0x00007FFF35147000-memory.dmp

Filesize
92KB

Download
memory/6064-931-0x00007FFF35190000-0x00007FFF351B2000-memory.dmp

Filesize
136KB

Download
memory/6064-930-0x00007FFF34AE0000-0x00007FFF34BFC000-memory.dmp

Filesize
1.1MB

Download
memory/6064-929-0x00007FFF351C0000-0x00007FFF351D4000-memory.dmp

Filesize
80KB

Download
memory/6064-928-0x00007FFF351E0000-0x00007FFF351F4000-memory.dmp

Filesize
80KB

Download
memory/6064-927-0x00007FFF35A80000-0x00007FFF35A92000-memory.dmp

Filesize
72KB

Download
memory/6064-926-0x00007FFF35AA0000-0x00007FFF35AB5000-memory.dmp

Filesize
84KB

Download
memory/6064-925-0x00007FFF35200000-0x00007FFF352B8000-memory.dmp

Filesize
736KB

Download
memory/6064-924-0x00007FFF32A80000-0x00007FFF33175000-memory.dmp

Filesize
7.0MB

Download
memory/6064-915-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp

Filesize
144KB

Download
memory/6064-921-0x00007FFF36530000-0x00007FFF36553000-memory.dmp

Filesize
140KB

Download
memory/6064-475-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp

Filesize
144KB

Download
memory/6064-457-0x00007FFF52920000-0x00007FFF5292D000-memory.dmp

Filesize
52KB

Download
memory/6064-391-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp

Filesize
144KB

Download
memory/6064-402-0x00007FFF35AA0000-0x00007FFF35AB5000-memory.dmp

Filesize
84KB

Download
memory/6064-390-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp

Filesize
5.9MB

Download
memory/6064-357-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp

Filesize
144KB

Download
memory/6064-368-0x00007FFF35AA0000-0x00007FFF35AB5000-memory.dmp

Filesize
84KB

Download
memory/6064-369-0x00007FFF35A80000-0x00007FFF35A92000-memory.dmp

Filesize
72KB

Download
memory/6064-372-0x00007FFF34AE0000-0x00007FFF34BFC000-memory.dmp

Filesize
1.1MB

Download
memory/6064-373-0x00007FFF35190000-0x00007FFF351B2000-memory.dmp

Filesize
136KB

Download
memory/6064-374-0x00007FFF35130000-0x00007FFF35147000-memory.dmp

Filesize
92KB

Download
memory/6064-376-0x00007FFF34A90000-0x00007FFF34ADD000-memory.dmp

Filesize
308KB

Download
memory/6064-380-0x00007FFF32A80000-0x00007FFF33175000-memory.dmp

Filesize
7.0MB

Download
memory/6064-381-0x00007FFF3A390000-0x00007FFF3A3C8000-memory.dmp

Filesize
224KB

Download
memory/6064-333-0x00007FFF3A390000-0x00007FFF3A3C8000-memory.dmp

Filesize
224KB

Download
memory/6064-331-0x00007FFF32A80000-0x00007FFF33175000-memory.dmp

Filesize
7.0MB

Download
memory/6064-332-0x00007FFF35200000-0x00007FFF352B8000-memory.dmp

Filesize
736KB

Download
memory/6064-328-0x00007FFF35AC0000-0x00007FFF35AEE000-memory.dmp

Filesize
184KB

Download
memory/6064-329-0x00007FFF33180000-0x00007FFF334F5000-memory.dmp

Filesize
3.5MB

Download
memory/6064-330-0x00007FFF34960000-0x00007FFF3497E000-memory.dmp

Filesize
120KB

Download
memory/6064-1165-0x00007FFF37620000-0x00007FFF37C08000-memory.dmp

Filesize
5.9MB

Download
memory/6064-326-0x00007FFF363B0000-0x00007FFF36523000-memory.dmp

Filesize
1.4MB

Download
memory/6064-327-0x00007FFF363A0000-0x00007FFF363AA000-memory.dmp

Filesize
40KB

Download
memory/6064-324-0x00007FFF36530000-0x00007FFF36553000-memory.dmp

Filesize
140KB

Download
memory/6064-325-0x00007FFF35000000-0x00007FFF35011000-memory.dmp

Filesize
68KB

Download
memory/6064-323-0x00007FFF34A90000-0x00007FFF34ADD000-memory.dmp

Filesize
308KB

Download
memory/6064-321-0x00007FFF36630000-0x00007FFF36649000-memory.dmp

Filesize
100KB

Download
memory/6064-322-0x00007FFF35110000-0x00007FFF35129000-memory.dmp

Filesize
100KB

Download
memory/6064-320-0x00007FFF35130000-0x00007FFF35147000-memory.dmp

Filesize
92KB

Download
memory/6064-1183-0x00007FFF529E0000-0x00007FFF529EF000-memory.dmp

Filesize
60KB

Download
memory/6064-312-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp

Filesize
5.9MB

Download
memory/6064-1181-0x00007FFF3AEF0000-0x00007FFF3AF14000-memory.dmp

Filesize
144KB

Download
memory/6064-313-0x00007FFF35AA0000-0x00007FFF35AB5000-memory.dmp

Filesize
84KB

Download
memory/6064-314-0x00007FFF35A80000-0x00007FFF35A92000-memory.dmp

Filesize
72KB

Download
memory/6064-317-0x00007FFF34AE0000-0x00007FFF34BFC000-memory.dmp

Filesize
1.1MB

Download
memory/6064-319-0x00007FFF35190000-0x00007FFF351B2000-memory.dmp

Filesize
136KB

Download
memory/6064-318-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp

Filesize
144KB

Download
memory/6064-315-0x00007FFF351E0000-0x00007FFF351F4000-memory.dmp

Filesize
80KB

Download
memory/6064-316-0x00007FFF351C0000-0x00007FFF351D4000-memory.dmp

Filesize
80KB

Download
memory/6064-311-0x00007FFF35200000-0x00007FFF352B8000-memory.dmp

Filesize
736KB

Download
memory/6064-309-0x00007FFF35AC0000-0x00007FFF35AEE000-memory.dmp

Filesize
184KB

Download
memory/6064-310-0x00007FFF33180000-0x00007FFF334F5000-memory.dmp

Filesize
3.5MB

Download
memory/6064-308-0x00007FFF363B0000-0x00007FFF36523000-memory.dmp

Filesize
1.4MB

Download
memory/6064-306-0x00007FFF36560000-0x00007FFF3658D000-memory.dmp

Filesize
180KB

Download
memory/6064-307-0x00007FFF36530000-0x00007FFF36553000-memory.dmp

Filesize
140KB

Download
memory/6064-305-0x00007FFF36590000-0x00007FFF365A9000-memory.dmp

Filesize
100KB

Download
memory/6064-303-0x00007FFF36630000-0x00007FFF36649000-memory.dmp

Filesize
100KB

Download
memory/6064-304-0x00007FFF368C0000-0x00007FFF368CD000-memory.dmp

Filesize
52KB

Download
memory/6064-302-0x00007FFF4FFD0000-0x00007FFF4FFDF000-memory.dmp

Filesize
60KB

Download
memory/6064-301-0x00007FFF365B0000-0x00007FFF365D4000-memory.dmp

Filesize
144KB

Download
memory/6064-300-0x00007FFF33500000-0x00007FFF33AE8000-memory.dmp

Filesize
5.9MB

Download