exelastealer | hxxps://cdn[.]discordapp[.]com/attachments/1278603645356605490/1279018071012409444/Exela[.]exe?ex=66d2e9e7&is=66d19867&hm=42eb73c7dadbb3261c9081049f1a74b231719328668f3e883cc8ba9268124530&

Resubmissions

30-08-2024 23:16

240830-29ahwa1hra 10

30-08-2024 10:01

240830-l2c12ayblc 10

Analysis

max time kernel
29s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-08-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1278603645356605490/1279018071012409444/Exela.exe?ex=66d2e9e7&is=66d19867&hm=42eb73c7dadbb3261c9081049f1a74b231719328668f3e883cc8ba9268124530&

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4356	netsh.exe
3184	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3212	powershell.exe
4424	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
5716	Exela.exe
5988	Exela.exe

Loads dropped DLL 31 IoCs

pid	Process
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe
5988	Exela.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023565-127.dat	upx
behavioral1/memory/5988-131-0x00007FFC884B0000-0x00007FFC88A99000-memory.dmp	upx
behavioral1/files/0x0007000000023536-133.dat	upx
behavioral1/memory/5988-139-0x00007FFC9BAE0000-0x00007FFC9BB04000-memory.dmp	upx
behavioral1/files/0x000700000002355f-138.dat	upx
behavioral1/memory/5988-141-0x00007FFC9C410000-0x00007FFC9C41F000-memory.dmp	upx
behavioral1/files/0x000700000002355e-142.dat	upx
behavioral1/files/0x0007000000023563-144.dat	upx
behavioral1/files/0x0007000000023540-160.dat	upx
behavioral1/files/0x000700000002353f-159.dat	upx
behavioral1/files/0x000700000002353e-158.dat	upx
behavioral1/files/0x000700000002353d-157.dat	upx
behavioral1/files/0x000700000002353c-156.dat	upx
behavioral1/files/0x000700000002353b-155.dat	upx
behavioral1/files/0x000700000002353a-154.dat	upx
behavioral1/files/0x0007000000023539-153.dat	upx
behavioral1/files/0x0007000000023538-152.dat	upx
behavioral1/files/0x0007000000023537-151.dat	upx
behavioral1/files/0x0007000000023535-150.dat	upx
behavioral1/files/0x0007000000023534-149.dat	upx
behavioral1/files/0x0007000000023533-148.dat	upx
behavioral1/files/0x0007000000023568-147.dat	upx
behavioral1/files/0x0007000000023567-146.dat	upx
behavioral1/files/0x0007000000023566-145.dat	upx
behavioral1/files/0x0007000000023560-143.dat	upx
behavioral1/memory/5988-162-0x00007FFC9BBB0000-0x00007FFC9BBC9000-memory.dmp	upx
behavioral1/memory/5988-164-0x00007FFC9BAD0000-0x00007FFC9BADD000-memory.dmp	upx
behavioral1/memory/5988-166-0x00007FFC9BAB0000-0x00007FFC9BAC9000-memory.dmp	upx
behavioral1/memory/5988-168-0x00007FFC8B680000-0x00007FFC8B6AD000-memory.dmp	upx
behavioral1/memory/5988-170-0x00007FFC8B650000-0x00007FFC8B673000-memory.dmp	upx
behavioral1/memory/5988-172-0x00007FFC8AFA0000-0x00007FFC8B110000-memory.dmp	upx
behavioral1/memory/5988-174-0x00007FFC8B620000-0x00007FFC8B64E000-memory.dmp	upx
behavioral1/memory/5988-179-0x00007FFC8B560000-0x00007FFC8B618000-memory.dmp	upx
behavioral1/memory/5988-178-0x00007FFC884B0000-0x00007FFC88A99000-memory.dmp	upx
behavioral1/memory/5988-182-0x00007FFC9BAE0000-0x00007FFC9BB04000-memory.dmp	upx
behavioral1/memory/5988-181-0x00007FFC8A1C0000-0x00007FFC8A535000-memory.dmp	upx
behavioral1/memory/5988-184-0x00007FFC8B540000-0x00007FFC8B555000-memory.dmp	upx
behavioral1/memory/5988-187-0x00007FFC8B330000-0x00007FFC8B342000-memory.dmp	upx
behavioral1/memory/5988-186-0x00007FFC9BBB0000-0x00007FFC9BBC9000-memory.dmp	upx
behavioral1/files/0x0007000000023562-188.dat	upx
behavioral1/memory/5988-193-0x00007FFC8AF80000-0x00007FFC8AF94000-memory.dmp	upx
behavioral1/memory/5988-192-0x00007FFC9BAB0000-0x00007FFC9BAC9000-memory.dmp	upx
behavioral1/memory/5988-191-0x00007FFC8B310000-0x00007FFC8B324000-memory.dmp	upx
behavioral1/memory/5988-196-0x00007FFC8AD80000-0x00007FFC8AE9C000-memory.dmp	upx
behavioral1/memory/5988-195-0x00007FFC8B680000-0x00007FFC8B6AD000-memory.dmp	upx
behavioral1/files/0x000700000002356a-197.dat	upx
behavioral1/memory/5988-200-0x00007FFC8AF50000-0x00007FFC8AF72000-memory.dmp	upx
behavioral1/memory/5988-199-0x00007FFC8B650000-0x00007FFC8B673000-memory.dmp	upx
behavioral1/files/0x0007000000023542-201.dat	upx
behavioral1/memory/5988-203-0x00007FFC8AD60000-0x00007FFC8AD77000-memory.dmp	upx
behavioral1/memory/5988-202-0x00007FFC8AFA0000-0x00007FFC8B110000-memory.dmp	upx
behavioral1/memory/5988-204-0x00007FFC8B620000-0x00007FFC8B64E000-memory.dmp	upx
behavioral1/memory/5988-209-0x00007FFC9BAA0000-0x00007FFC9BAAA000-memory.dmp	upx
behavioral1/memory/5988-211-0x00007FFC8B560000-0x00007FFC8B618000-memory.dmp	upx
behavioral1/memory/5988-213-0x00007FFC87D00000-0x00007FFC884A1000-memory.dmp	upx
behavioral1/memory/5988-212-0x00007FFC8A1C0000-0x00007FFC8A535000-memory.dmp	upx
behavioral1/memory/5988-210-0x00007FFC8ACB0000-0x00007FFC8ACCE000-memory.dmp	upx
behavioral1/memory/5988-208-0x00007FFC8ACD0000-0x00007FFC8ACE1000-memory.dmp	upx
behavioral1/memory/5988-207-0x00007FFC8ACF0000-0x00007FFC8AD3D000-memory.dmp	upx
behavioral1/memory/5988-206-0x00007FFC8AD40000-0x00007FFC8AD59000-memory.dmp	upx
behavioral1/memory/5988-215-0x00007FFC8A180000-0x00007FFC8A1B6000-memory.dmp	upx
behavioral1/memory/5988-214-0x00007FFC8B540000-0x00007FFC8B555000-memory.dmp	upx
behavioral1/memory/5988-224-0x00007FFC8B330000-0x00007FFC8B342000-memory.dmp	upx
behavioral1/memory/5988-267-0x00007FFCA5040000-0x00007FFCA504D000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1460	cmd.exe
4020	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5556	tasklist.exe
5704	tasklist.exe
4972	tasklist.exe
1052	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5616	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6032	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0002000000022d14-43.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1988	cmd.exe
3016	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
6060	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4344	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4812	ipconfig.exe
6060	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1948	systeminfo.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
3096	taskkill.exe
1332	taskkill.exe
5668	taskkill.exe
5860	taskkill.exe
6112	taskkill.exe
5160	taskkill.exe
5348	taskkill.exe
5300	taskkill.exe
5944	taskkill.exe
6040	taskkill.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 593551.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
556	msedge.exe
556	msedge.exe
5608	msedge.exe
5608	msedge.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5536	WMIC.exe
Token: SeSecurityPrivilege	5536	WMIC.exe
Token: SeTakeOwnershipPrivilege	5536	WMIC.exe
Token: SeLoadDriverPrivilege	5536	WMIC.exe
Token: SeSystemProfilePrivilege	5536	WMIC.exe
Token: SeSystemtimePrivilege	5536	WMIC.exe
Token: SeProfSingleProcessPrivilege	5536	WMIC.exe
Token: SeIncBasePriorityPrivilege	5536	WMIC.exe
Token: SeCreatePagefilePrivilege	5536	WMIC.exe
Token: SeBackupPrivilege	5536	WMIC.exe
Token: SeRestorePrivilege	5536	WMIC.exe
Token: SeShutdownPrivilege	5536	WMIC.exe
Token: SeDebugPrivilege	5536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5536	WMIC.exe
Token: SeRemoteShutdownPrivilege	5536	WMIC.exe
Token: SeUndockPrivilege	5536	WMIC.exe
Token: SeManageVolumePrivilege	5536	WMIC.exe
Token: 33	5536	WMIC.exe
Token: 34	5536	WMIC.exe
Token: 35	5536	WMIC.exe
Token: 36	5536	WMIC.exe
Token: SeDebugPrivilege	5556	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5536	WMIC.exe
Token: SeSecurityPrivilege	5536	WMIC.exe
Token: SeTakeOwnershipPrivilege	5536	WMIC.exe
Token: SeLoadDriverPrivilege	5536	WMIC.exe
Token: SeSystemProfilePrivilege	5536	WMIC.exe
Token: SeSystemtimePrivilege	5536	WMIC.exe
Token: SeProfSingleProcessPrivilege	5536	WMIC.exe
Token: SeIncBasePriorityPrivilege	5536	WMIC.exe
Token: SeCreatePagefilePrivilege	5536	WMIC.exe
Token: SeBackupPrivilege	5536	WMIC.exe
Token: SeRestorePrivilege	5536	WMIC.exe
Token: SeShutdownPrivilege	5536	WMIC.exe
Token: SeDebugPrivilege	5536	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5536	WMIC.exe
Token: SeRemoteShutdownPrivilege	5536	WMIC.exe
Token: SeUndockPrivilege	5536	WMIC.exe
Token: SeManageVolumePrivilege	5536	WMIC.exe
Token: 33	5536	WMIC.exe
Token: 34	5536	WMIC.exe
Token: 35	5536	WMIC.exe
Token: 36	5536	WMIC.exe
Token: SeDebugPrivilege	5704	tasklist.exe
Token: SeDebugPrivilege	5860	taskkill.exe
Token: SeDebugPrivilege	5944	taskkill.exe
Token: SeDebugPrivilege	6040	taskkill.exe
Token: SeDebugPrivilege	6112	taskkill.exe
Token: SeDebugPrivilege	5160	taskkill.exe
Token: SeDebugPrivilege	3096	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	5348	taskkill.exe
Token: SeDebugPrivilege	5300	taskkill.exe
Token: SeDebugPrivilege	5668	taskkill.exe
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeIncreaseQuotaPrivilege	4344	WMIC.exe
Token: SeSecurityPrivilege	4344	WMIC.exe
Token: SeTakeOwnershipPrivilege	4344	WMIC.exe
Token: SeLoadDriverPrivilege	4344	WMIC.exe
Token: SeSystemProfilePrivilege	4344	WMIC.exe
Token: SeSystemtimePrivilege	4344	WMIC.exe
Token: SeProfSingleProcessPrivilege	4344	WMIC.exe
Token: SeIncBasePriorityPrivilege	4344	WMIC.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe
556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4512	556	msedge.exe	84
PID 556 wrote to memory of 4512	556	msedge.exe	84
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1352	556	msedge.exe	85
PID 556 wrote to memory of 1948	556	msedge.exe	86
PID 556 wrote to memory of 1948	556	msedge.exe	86
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87
PID 556 wrote to memory of 4432	556	msedge.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5664	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1278603645356605490/1279018071012409444/Exela.exe?ex=66d2e9e7&is=66d19867&hm=42eb73c7dadbb3261c9081049f1a74b231719328668f3e883cc8ba9268124530&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1988,1034544549743855267,17950650407982211745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608
- C:\Users\Admin\Downloads\Exela.exe
  "C:\Users\Admin\Downloads\Exela.exe"
  2⤵
  - Executes dropped EXE
  PID:5716
- - C:\Users\Admin\Downloads\Exela.exe
    "C:\Users\Admin\Downloads\Exela.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5988
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:5284
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:5300
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      PID:5616
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:5676
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 556"
      4⤵
      PID:5816
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 556
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4512"
      4⤵
      PID:5896
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4512
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1352"
      4⤵
      PID:5980
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1352
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1948"
      4⤵
      PID:6092
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1948
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4432"
      4⤵
      PID:5128
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4432
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2028"
      4⤵
      PID:540
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2028
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2812"
      4⤵
      PID:5144
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2812
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2200"
      4⤵
      PID:1584
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2200
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4532"
      4⤵
      PID:772
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4532
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4020"
      4⤵
      PID:5672
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4020
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:5848
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:2196
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:2372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:5892
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:2280
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:1688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3392
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      PID:4424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1988
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      PID:1460
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:1948
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:1980
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:3116
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:6016
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:884
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:2676
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:1452
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:3832
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:4224
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:3932
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:2844
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:3660
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:2264
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:2704
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:4960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:1052
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:4812
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:5600
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:4020
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:6060
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:6032
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4356
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:6112
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:5200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:540
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53ce7c582a69360c0699596f6c2c8382

SHA1
4a64d4c186c78f2de0804d63840f15f78ebf7c9d

SHA256
54dfbe731caa39450382be42ec8079b76cee89d4772eb07970e49ee1e40b8cff

SHA512
6fa8705587aedf29060e4b14c989e607768b8d9f7c62b6364719573573444c7144b997d8737cd41aec6cd5d1be368eedaff4d70d56a1e890f31a2b68f289bb3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8449dc1041dbabb003a1a741c47eedec

SHA1
e097d34ec027bedb67db78ff4d831544988c5ea0

SHA256
a1476ff5eb02a3dd0437566f1f50fe51e09bc5e63db02f84d5aa92442dac855f

SHA512
02a029a43bf784eeb76c831e63b3e2ce91c2fad1d107b219cb7e83728012474011e59b345786efb648ae6494b6d91cac884c7ec723adf16f8ab23b8b1bef70f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
803831e41613b2d10185ff045cd0f638

SHA1
ebbb1199f6e1f7c74cb8b31b17062251c7b5b116

SHA256
479be972b3100472d4f1425f37f0bab5235fe858109dd7bcb72d5c692449fba8

SHA512
c8fed572710f66aaf72e1bd5abf8b4a6268921c55ed637ebb173d586c9409aa9f003bcf11d0b41246f7f41f170a5de1d69193eafae8ae174b078f57d6c1ca6a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_asyncio.pyd

Filesize
34KB

MD5
c2b19e94b07ae166fb0f31a50bde19ad

SHA1
c3069cc3d15c686e8e65059c3ea085de60f2c2b9

SHA256
95e5707a826bf8ea8945a3280541457a1e8807aa8016e17dacdbb4747d99cfde

SHA512
62ec9512c9ddbd950fb9349b9cc5a8ffccb21619866e7b39e994ca536e2eb24c490e07be5a04b9e5e51ee9004a361d52ee2859efb7e688bffa55f73c94f16155

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_bz2.pyd

Filesize
46KB

MD5
d27125865c38b479a309f5542b5f96f8

SHA1
2c758bfcd4ac123382e638c8587bd06906533c1e

SHA256
3c9b484114198e1b6db0a67f5ce5a6651de6150428a2a08f6bcb07c2ae780024

SHA512
1de3a2be14784104fa0a3be359ce5738e4ef9c7c77ccf63db5fe63d97ac7db50e3259f797582b116d19320d4627cfa1e30de6da1823c63d6a4633b5c3608e8a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_cffi_backend.cp311-win_amd64.pyd

Filesize
70KB

MD5
3ee19e638459380934a44073c184b5c0

SHA1
6849d2f9e0920564e7a82f365616d6b763b1386f

SHA256
d26943222b0645c4d00f29fb4e0fb234ab2b963d8d48f616f204d8ae644c7322

SHA512
a7985b0acc57b635ed88b4945e72919c48c203bdea2f85659f0169ad3778ffb405e579d4bfcd9fc8d9752d10bec2f1cc793ac4e0c2cb84f4ce5b2297cd468d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_ctypes.pyd

Filesize
56KB

MD5
bffbb0890861c80dd041193bb69f8e56

SHA1
271fcd086f61e9a4d2621e868186e72b9ea0ed00

SHA256
73e4fc00a9cccfae1470efddeb5686aa321298220b76cf8cea96595754e8d352

SHA512
d1267dac669c232162fea6106308de520a577477ce84db623807344a0d6c18e3003b8c1d9c3fd618fe05a83058aea497fa5363bb2fb0993afe36cfbdf2fc98bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_decimal.pyd

Filesize
104KB

MD5
32ecea89a75822d356deca51f6f69870

SHA1
26b7ecbf47ff7db3b8466b73216cb442e54adb65

SHA256
c497d78d4d78548dae0831f2fad18556e5311c70896374e29c2f47518c7c801d

SHA512
e5957430c2b357c2c829c52cdfe7d0c4bb558a9e2591e23574ac3c2f4d7c82fe9c8311dea7bf795f7a69ac15754e995942875917eb04e3d297e646dfe5241ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_hashlib.pyd

Filesize
33KB

MD5
441da330da321ed0be262688f77ab95b

SHA1
adb8e799d14fd4584cc88bd32602fc07fa7a9387

SHA256
acfa3f8ea1242e3d9d132e00103c82a210eab93120c0896ea83df4d4cdf84672

SHA512
44cb8f0f191c15b6fd3be80689bb952e8aa2c6a4809febb529ca006f300382f9f7329ec8afe163a88d2008475fe1b585f7219071ff47542b837683ffb8b8aa07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_lzma.pyd

Filesize
84KB

MD5
d988056b2f16aa7308124eda3c2d1f34

SHA1
e381574fbcab1f55e915646ff9d4aa7f52caf6ed

SHA256
38d63e70181a217707e77838a33e83c4d90e25a35bc03a5d1178b987f6c9bea7

SHA512
ffda202979b52ec350f6f2540aa5b5f00af921491effc3741a02c7a257caf66496e2800381cfdc1d4825f5c5845d015eeaea44f2949cc95463cfe0dac1ab0655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_multiprocessing.pyd

Filesize
25KB

MD5
1e1202b03df4eaba743c37c5d82d3090

SHA1
5f05a004c69465955223e3396247eccd6bf82eb7

SHA256
012eff73ab3c284d1c1d200ac15200ef390d03dfad611e8e31c41e1a83c8921a

SHA512
3bd4f1821061ba1178e30d6f0c1cc9d8199031db4cea5a81026094c6ee98f11a2afc62a35634ed9008bd9cc1079ea0eb126ec8ad3a89c98bdc2b656a885b2bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_overlapped.pyd

Filesize
30KB

MD5
8ce6466b61a93cb1cc5f743d76a43a60

SHA1
4756671b7ba4553e5e584622f8b389bf65b4b0ae

SHA256
3c329845173adb5da8356cd87fed8efb2ff44747af655761b3a81682f61a17fa

SHA512
abc0afa6c94022cd0358ec4bedbdedaf292581e95a0ffc3c626a78ba4f9ab197372696bc4193eae108ed5e668c6233e69854bdf301dd3af5834ef58d43f55a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_queue.pyd

Filesize
24KB

MD5
89cbc7b29616204cd4cd48dbc75f9c33

SHA1
998a81b828677031528f228d2fe7617069476d78

SHA256
88e3d5595ea4fc16165fd525fc07d08fb3b1b6dcf4e42406819dc586adb61a88

SHA512
f5e9855edcbe212695f074017fab6f303a049b7b91e84accd45b6ca87e83abaecaf7c20659e61d3b507e566d4e6bf239af63e2f2e2a426242895b484878247ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_socket.pyd

Filesize
41KB

MD5
9c2a981a689fca33ec72b6f3fd88d957

SHA1
d9bdcba4d4babf3a215b70566a3c1b501dfc6836

SHA256
181b6e8865874e305f34cc0330e8633bf56cad1c22c3f31578176149ae06672a

SHA512
6f496e2b958548da46d139cef99bb87210838dbf37d4f4971ec367218cedb2b95ddfa1f4f5c412e3b0d532667c7d39bdfdd2a64a270fb1dfae055b5f0667d988

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_sqlite3.pyd

Filesize
54KB

MD5
27e251bcf650e9f2388732b29481b34f

SHA1
5f1d2e061fecf8607400c3136b878260cc436f58

SHA256
2f44b6f01dee436495a2ef43787dcab77454169b1057e12a842cfaef9cebc392

SHA512
aa59146aebb88ba62c9467436a1566453fbfeaab9f4b2b64ec854fd64d8f55d0d4b4b959b7d1e980b354bba4230e1434b11629a60425caf3369ef6a6088d997b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_ssl.pyd

Filesize
60KB

MD5
aefe0663f422c1b3737d9611c1dbb33a

SHA1
3d50695e9eed826d9bb48fb9046b58e66668fea3

SHA256
87db568a4dd3bfc4beb2800c9d897af98d4e9683342d376729fa123274d2136a

SHA512
48402b649d50b3b5c5f526a68910dcecb6519f09ac397db32c7c17846c6d50d3b35673d208083e4c898b86811f32aa9fda712a22d799d1196ab58ca931787ab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\_uuid.pyd

Filesize
21KB

MD5
c846b63e96f59b64258c158a510d3c00

SHA1
cd070657b5c462ca3b6d5c0e162ac4050b16b467

SHA256
2e0b89a007dde5ab48375ed451a197909153d2e8c80d0b30752d135486caea7f

SHA512
a3dc39e4243dcd8ae06974c39c54374087fcfe53873b26d35a4f6234b85ae00042b51991a8d72dd28122e7feda369150daf0d0c315e3fb6fe4d98a47f3940a55

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\aiohttp\_helpers.cp311-win_amd64.pyd

Filesize
26KB

MD5
58787b396149044675bc7ba8980a0d82

SHA1
a3b183bb653af28a6a7b4149a80fd4fa517a7234

SHA256
442ad100f766ad751bf319dc41b38267e99244055bd901213169aed32d5be28d

SHA512
1b3669598dd1f09ef8748c7af4d137c12a966f2946d245d4c2d45e30889b49ce59935c60c6b69cc77799a9d0b7939da59ef23d5bd4f98b56e4d862691fdde9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\base_library.zip

Filesize
1.4MB

MD5
9dc12ea9f7821873da74c772abb280f0

SHA1
3f271c9f54bc7740b95eaa20debbd156ebd50760

SHA256
c5ec59385bfac2a0ac38abf1377360cd1fddd05c31f8a8b4e44252e0e63acb10

SHA512
a3175c170bbb28c199ab74ad3116e71f03f124d448bf0e9dd4afcacdc08a7a52284cf858cfd7e72d35bd1e68c6ba0c2a1a0025199aeb671777977ea53e1f2535

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\libffi-8.dll

Filesize
27KB

MD5
002d812bed903fe40ec41f869b21832f

SHA1
ee066916e6966f05457d490332f5e0d925e11766

SHA256
0d85141dab86cfe0f276dfc5f8503b297505f8246cabf7c8deba0ac31a52c3f7

SHA512
5cea498444aac18b43b45c7fc6f111446d4381e29ccaa5eac04338714c12f7d25b693b1f31bb670b61f242429e9a20b21db1cab6338ad503aee6f35af0032240

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
eeaded775eabfaaede5ca025f55fd273

SHA1
8eefb3b9d85b4d5ad4033308f8af2a24e8792e02

SHA256
db4d6a74a3301788d32905b2ccc525e9a8e2219f1a36924464871cf211f115a0

SHA512
a6055d5604cc53428d89b308c223634cd94082be0ba4081513974e1826775d6e9fc26180c816d9a38fead89b5e04c5e7cf729c056bfae0ed74d6885c921b70ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\pyexpat.pyd

Filesize
86KB

MD5
e75e48278afd2cfbc9fa503b74b99ade

SHA1
520f1e683f413d73ed5f7eafa353f18789713216

SHA256
a78835d19688ec1d081ff740938e27d55a3305fd135c48d9509b5a307222e097

SHA512
430e8227b555eca2c98834e10cb207085624906ec57800aff377bffd16f5ca01780927ff425a03f49516538b10d7524dea37e9bb5057dec27757ff44c6d105c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\python3.DLL

Filesize
64KB

MD5
7feb3da304a2fead0bb07d06c6c6a151

SHA1
ee4122563d9309926ba32be201895d4905d686ce

SHA256
ddd2c77222e2c693ef73d142422d6bf37d6a37deead17e70741b0ac5c9fe095b

SHA512
325568bcf1835dd3f454a74012f5d7c6877496068ad0c2421bf65e0640910ae43b06e920f4d0024277eee1683f0ce27959843526d0070683da0c02f1eac0e7d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\python311.dll

Filesize
1.6MB

MD5
3d24dbcb4227ce60ac44c48f8f48fe0b

SHA1
4df70ac4f13f25a1876e78bb76824839741012cc

SHA256
bd181df49efbc8233d8d18fd27b9b3118aef89e798d51d6836c7a38a99dee0d6

SHA512
6883294d95535ffc5341f12917298fd83302b78ca7badcaed439566540ddbca244b15426724d0127ebbed332085d1610396526cc173ba0c303d36995dd777727

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\select.pyd

Filesize
24KB

MD5
e266c75a45ad0848900ad2011146aed6

SHA1
f96747fc5dab0ca2e32f477fc00a06e554cc05a6

SHA256
a3549dfcc2f49d579f0eb015bc6c881393c4e85907116f2bfa66136ef9455522

SHA512
ed18b76c6da973f051fdfeacdf7caeea860a070f99ecd15085e2980506aad5393bbbbdd57ba07d71aa6f7ced67d3f62d283a87f915b702502b80043f3a426956

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\sqlite3.dll

Filesize
606KB

MD5
e0bc7f9c3dcd7f9014710095f824582c

SHA1
3869a965dd2cbf1b6ebcd62214222f85b87864f0

SHA256
71ad917747d674d4c7828ffeecdb4ebdf772a0c6a2def522a9216a46a4be052e

SHA512
55472a2f0c4f09d2def3df8edc1af8f85fd4c09e4cd164be5b7458ad721ef3da6d1cdf394bc7daae14ee99c50d7645d0a08d22051403146b4c5e3e003ee04fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\unicodedata.pyd

Filesize
294KB

MD5
8b5ab14b8d9e587f21924bef1e7b3c43

SHA1
c68dfc08b77ac09dde32b9c6bf352503095be410

SHA256
8625bccb914949256f1404cecc76496c2b8d40c9207d978dca117976e0a312bc

SHA512
892dccc03582739eccbdb7a839aa1911ab51961d26787a43249ff126fc2787fc651a0fe254e3d5081009f1dcaf6b67cd81da4bc3c12120e60c5195a9dcb619a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI57162\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
40KB

MD5
9a8f969ecdf0c15734c1d582d2ae35d8

SHA1
a40691e81982f610a062e49a5ad29cffb5a2f5a8

SHA256
874e52cceae9a3c967bac7b628f4144c32e51fc77f519542fc1bac19045ecde8

SHA512
e0deb59abef7440f30effb1aab6295b5a50c817f685be30b21a3c453e3099b97fd71984e6ca6a6c6e0021abb6e906838566f402b00a11813e67a4e00b119619f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ggk3xzv.qui.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 593551.crdownload

Filesize
10.8MB

MD5
7786ee9186e7a03af1caa6d7f65a2a84

SHA1
bf56fe17c6428017cc1955e5ef313adfe99db35f

SHA256
cafc8ebc6175cb522579dabd4619278722a0e2c0ac6be27af9fef7db402b4981

SHA512
0558b61c894517705c11721b4df76b8136e2859b339ae78a69303fea6742d2104925177620971094e3432ff62dd3d1d61271f52e8ea3b277af3ace104b1e2a35

Download Submit
memory/3212-270-0x000001F203D90000-0x000001F203DB2000-memory.dmp

Filesize
136KB

Download
memory/5988-178-0x00007FFC884B0000-0x00007FFC88A99000-memory.dmp

Filesize
5.9MB

Download
memory/5988-209-0x00007FFC9BAA0000-0x00007FFC9BAAA000-memory.dmp

Filesize
40KB

Download
memory/5988-170-0x00007FFC8B650000-0x00007FFC8B673000-memory.dmp

Filesize
140KB

Download
memory/5988-172-0x00007FFC8AFA0000-0x00007FFC8B110000-memory.dmp

Filesize
1.4MB

Download
memory/5988-174-0x00007FFC8B620000-0x00007FFC8B64E000-memory.dmp

Filesize
184KB

Download
memory/5988-179-0x00007FFC8B560000-0x00007FFC8B618000-memory.dmp

Filesize
736KB

Download
memory/5988-166-0x00007FFC9BAB0000-0x00007FFC9BAC9000-memory.dmp

Filesize
100KB

Download
memory/5988-180-0x000001C8A2400000-0x000001C8A2775000-memory.dmp

Filesize
3.5MB

Download
memory/5988-182-0x00007FFC9BAE0000-0x00007FFC9BB04000-memory.dmp

Filesize
144KB

Download
memory/5988-181-0x00007FFC8A1C0000-0x00007FFC8A535000-memory.dmp

Filesize
3.5MB

Download
memory/5988-184-0x00007FFC8B540000-0x00007FFC8B555000-memory.dmp

Filesize
84KB

Download
memory/5988-187-0x00007FFC8B330000-0x00007FFC8B342000-memory.dmp

Filesize
72KB

Download
memory/5988-186-0x00007FFC9BBB0000-0x00007FFC9BBC9000-memory.dmp

Filesize
100KB

Download
memory/5988-164-0x00007FFC9BAD0000-0x00007FFC9BADD000-memory.dmp

Filesize
52KB

Download
memory/5988-193-0x00007FFC8AF80000-0x00007FFC8AF94000-memory.dmp

Filesize
80KB

Download
memory/5988-192-0x00007FFC9BAB0000-0x00007FFC9BAC9000-memory.dmp

Filesize
100KB

Download
memory/5988-191-0x00007FFC8B310000-0x00007FFC8B324000-memory.dmp

Filesize
80KB

Download
memory/5988-196-0x00007FFC8AD80000-0x00007FFC8AE9C000-memory.dmp

Filesize
1.1MB

Download
memory/5988-195-0x00007FFC8B680000-0x00007FFC8B6AD000-memory.dmp

Filesize
180KB

Download
memory/5988-162-0x00007FFC9BBB0000-0x00007FFC9BBC9000-memory.dmp

Filesize
100KB

Download
memory/5988-200-0x00007FFC8AF50000-0x00007FFC8AF72000-memory.dmp

Filesize
136KB

Download
memory/5988-199-0x00007FFC8B650000-0x00007FFC8B673000-memory.dmp

Filesize
140KB

Download
memory/5988-141-0x00007FFC9C410000-0x00007FFC9C41F000-memory.dmp

Filesize
60KB

Download
memory/5988-203-0x00007FFC8AD60000-0x00007FFC8AD77000-memory.dmp

Filesize
92KB

Download
memory/5988-202-0x00007FFC8AFA0000-0x00007FFC8B110000-memory.dmp

Filesize
1.4MB

Download
memory/5988-204-0x00007FFC8B620000-0x00007FFC8B64E000-memory.dmp

Filesize
184KB

Download
memory/5988-205-0x000001C8A2400000-0x000001C8A2775000-memory.dmp

Filesize
3.5MB

Download
memory/5988-168-0x00007FFC8B680000-0x00007FFC8B6AD000-memory.dmp

Filesize
180KB

Download
memory/5988-211-0x00007FFC8B560000-0x00007FFC8B618000-memory.dmp

Filesize
736KB

Download
memory/5988-213-0x00007FFC87D00000-0x00007FFC884A1000-memory.dmp

Filesize
7.6MB

Download
memory/5988-212-0x00007FFC8A1C0000-0x00007FFC8A535000-memory.dmp

Filesize
3.5MB

Download
memory/5988-210-0x00007FFC8ACB0000-0x00007FFC8ACCE000-memory.dmp

Filesize
120KB

Download
memory/5988-208-0x00007FFC8ACD0000-0x00007FFC8ACE1000-memory.dmp

Filesize
68KB

Download
memory/5988-207-0x00007FFC8ACF0000-0x00007FFC8AD3D000-memory.dmp

Filesize
308KB

Download
memory/5988-206-0x00007FFC8AD40000-0x00007FFC8AD59000-memory.dmp

Filesize
100KB

Download
memory/5988-215-0x00007FFC8A180000-0x00007FFC8A1B6000-memory.dmp

Filesize
216KB

Download
memory/5988-214-0x00007FFC8B540000-0x00007FFC8B555000-memory.dmp

Filesize
84KB

Download
memory/5988-224-0x00007FFC8B330000-0x00007FFC8B342000-memory.dmp

Filesize
72KB

Download
memory/5988-267-0x00007FFCA5040000-0x00007FFCA504D000-memory.dmp

Filesize
52KB

Download
memory/5988-139-0x00007FFC9BAE0000-0x00007FFC9BB04000-memory.dmp

Filesize
144KB

Download
memory/5988-131-0x00007FFC884B0000-0x00007FFC88A99000-memory.dmp

Filesize
5.9MB

Download
memory/5988-284-0x00007FFC8AD80000-0x00007FFC8AE9C000-memory.dmp

Filesize
1.1MB

Download
memory/5988-285-0x00007FFC8AF50000-0x00007FFC8AF72000-memory.dmp

Filesize
136KB

Download
memory/5988-286-0x00007FFC8AD60000-0x00007FFC8AD77000-memory.dmp

Filesize
92KB

Download
memory/5988-288-0x00007FFC8ACF0000-0x00007FFC8AD3D000-memory.dmp

Filesize
308KB

Download
memory/5988-287-0x00007FFC8AD40000-0x00007FFC8AD59000-memory.dmp

Filesize
100KB

Download
memory/5988-290-0x00007FFC884B0000-0x00007FFC88A99000-memory.dmp

Filesize
5.9MB

Download
memory/5988-298-0x00007FFC8AFA0000-0x00007FFC8B110000-memory.dmp

Filesize
1.4MB

Download
memory/5988-315-0x00007FFC8A180000-0x00007FFC8A1B6000-memory.dmp

Filesize
216KB

Download
memory/5988-314-0x00007FFC87D00000-0x00007FFC884A1000-memory.dmp

Filesize
7.6MB

Download
memory/5988-303-0x00007FFC8B330000-0x00007FFC8B342000-memory.dmp

Filesize
72KB

Download
memory/5988-302-0x00007FFC8B540000-0x00007FFC8B555000-memory.dmp

Filesize
84KB

Download
memory/5988-291-0x00007FFC9BAE0000-0x00007FFC9BB04000-memory.dmp

Filesize
144KB

Download