exelastealer | 35155e8468c1287a21e03699a55325378001fa060ee79a1db8f5b02e82adc33d

Analysis

max time kernel
1735s
max time network
1742s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libavresample-4.zip
Size

4.4MB
MD5

095b59d6465bf6491daccd0d4cf9baf0
SHA1

b5d488cf23c1a6e6e7cfaa777657f8ad9a87ec32
SHA256

35155e8468c1287a21e03699a55325378001fa060ee79a1db8f5b02e82adc33d
SHA512

8aa151f915a6d2190246d0000ab5d2a27646fd925522cb334fb7273e93135c1becf4fd19980afccaf5730d5d178889a1b52acb012814ac6fc16dcb4dd781ef29
SSDEEP

98304:c8luglqUM5DjX1SUeQAbWSFhMDC//X3yV8:/l4ZjFSpQAb1hK6c8

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5748	netsh.exe
3372	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1556	cmd.exe
1928	powershell.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5792-625-0x00007FF9C5FA0000-0x00007FF9C6405000-memory.dmp	upx
behavioral1/memory/5792-626-0x00007FF9DF050000-0x00007FF9DF074000-memory.dmp	upx
behavioral1/memory/5792-627-0x00007FF9E2A00000-0x00007FF9E2A0F000-memory.dmp	upx
behavioral1/memory/5792-628-0x00007FF9DE710000-0x00007FF9DE729000-memory.dmp	upx
behavioral1/memory/5792-629-0x00007FF9E29D0000-0x00007FF9E29DD000-memory.dmp	upx
behavioral1/memory/5792-630-0x00007FF9DE660000-0x00007FF9DE679000-memory.dmp	upx
behavioral1/memory/5792-631-0x00007FF9D9C00000-0x00007FF9D9C2C000-memory.dmp	upx
behavioral1/memory/5792-632-0x00007FF9DC560000-0x00007FF9DC57E000-memory.dmp	upx
behavioral1/memory/5792-633-0x00007FF9C8590000-0x00007FF9C86FD000-memory.dmp	upx
behavioral1/memory/5792-634-0x00007FF9D5B10000-0x00007FF9D5B3E000-memory.dmp	upx
behavioral1/memory/5792-635-0x00007FF9C5FA0000-0x00007FF9C6405000-memory.dmp	upx
behavioral1/memory/5792-638-0x00007FF9DF050000-0x00007FF9DF074000-memory.dmp	upx
behavioral1/memory/5792-637-0x00007FF9C9330000-0x00007FF9C93E6000-memory.dmp	upx
behavioral1/memory/5792-636-0x00007FF9C6990000-0x00007FF9C6D04000-memory.dmp	upx
behavioral1/memory/5792-639-0x00007FF9DA9D0000-0x00007FF9DA9E4000-memory.dmp	upx
behavioral1/memory/5792-640-0x00007FF9DE710000-0x00007FF9DE729000-memory.dmp	upx
behavioral1/memory/5792-641-0x00007FF9DF770000-0x00007FF9DF780000-memory.dmp	upx
behavioral1/memory/5792-644-0x00007FF9D07A0000-0x00007FF9D07B5000-memory.dmp	upx
behavioral1/memory/5792-643-0x00007FF9DE660000-0x00007FF9DE679000-memory.dmp	upx
behavioral1/memory/5792-642-0x00007FF9D5AF0000-0x00007FF9D5B04000-memory.dmp	upx
behavioral1/memory/5792-646-0x00007FF9C8470000-0x00007FF9C8588000-memory.dmp	upx
behavioral1/memory/5792-645-0x00007FF9D9C00000-0x00007FF9D9C2C000-memory.dmp	upx
behavioral1/memory/5792-648-0x00007FF9D0780000-0x00007FF9D079C000-memory.dmp	upx
behavioral1/memory/5792-647-0x00007FF9DC560000-0x00007FF9DC57E000-memory.dmp	upx
behavioral1/memory/5792-650-0x00007FF9CFA90000-0x00007FF9CFAA3000-memory.dmp	upx
behavioral1/memory/5792-649-0x00007FF9C8590000-0x00007FF9C86FD000-memory.dmp	upx
behavioral1/memory/5792-651-0x00007FF9D5B10000-0x00007FF9D5B3E000-memory.dmp	upx
behavioral1/memory/5792-657-0x00007FF9DF600000-0x00007FF9DF60E000-memory.dmp	upx
behavioral1/memory/5792-656-0x00007FF9DF3A0000-0x00007FF9DF3AA000-memory.dmp	upx
behavioral1/memory/5792-655-0x00007FF9C89A0000-0x00007FF9C89E1000-memory.dmp	upx
behavioral1/memory/5792-654-0x00007FF9C6990000-0x00007FF9C6D04000-memory.dmp	upx
behavioral1/memory/5792-653-0x00007FF9C9330000-0x00007FF9C93E6000-memory.dmp	upx
behavioral1/memory/5792-652-0x00007FF9CF820000-0x00007FF9CF835000-memory.dmp	upx
behavioral1/memory/5792-658-0x00007FF9DA9D0000-0x00007FF9DA9E4000-memory.dmp	upx
behavioral1/memory/5792-659-0x00007FF9CBD70000-0x00007FF9CBD8C000-memory.dmp	upx
behavioral1/memory/5792-660-0x00007FF9DF770000-0x00007FF9DF780000-memory.dmp	upx
behavioral1/memory/5792-661-0x00007FF9DE6C0000-0x00007FF9DE6CB000-memory.dmp	upx
behavioral1/memory/5792-662-0x00007FF9C8970000-0x00007FF9C8994000-memory.dmp	upx
behavioral1/memory/5792-664-0x00007FF9C5930000-0x00007FF9C5F98000-memory.dmp	upx
behavioral1/memory/5792-663-0x00007FF9D07A0000-0x00007FF9D07B5000-memory.dmp	upx
behavioral1/memory/5792-666-0x00007FF9C8930000-0x00007FF9C8968000-memory.dmp	upx
behavioral1/memory/5792-665-0x00007FF9C8470000-0x00007FF9C8588000-memory.dmp	upx
behavioral1/memory/5792-677-0x00007FF9D0780000-0x00007FF9D079C000-memory.dmp	upx
behavioral1/memory/5792-681-0x00007FF9CFA90000-0x00007FF9CFAA3000-memory.dmp	upx
behavioral1/memory/5792-725-0x00007FF9DE6E0000-0x00007FF9DE6ED000-memory.dmp	upx
behavioral1/memory/5792-742-0x00007FF9C89A0000-0x00007FF9C89E1000-memory.dmp	upx
behavioral1/memory/5792-743-0x00007FF9CBD70000-0x00007FF9CBD8C000-memory.dmp	upx
behavioral1/memory/5792-745-0x00007FF9DE6C0000-0x00007FF9DE6CB000-memory.dmp	upx
behavioral1/memory/5792-746-0x00007FF9C8970000-0x00007FF9C8994000-memory.dmp	upx
behavioral1/memory/5792-783-0x00007FF9DE6E0000-0x00007FF9DE6ED000-memory.dmp	upx
behavioral1/memory/5792-782-0x00007FF9C8930000-0x00007FF9C8968000-memory.dmp	upx
behavioral1/memory/5792-772-0x00007FF9D0780000-0x00007FF9D079C000-memory.dmp	upx
behavioral1/memory/5792-767-0x00007FF9DA9D0000-0x00007FF9DA9E4000-memory.dmp	upx
behavioral1/memory/5792-763-0x00007FF9C8590000-0x00007FF9C86FD000-memory.dmp	upx
behavioral1/memory/5792-762-0x00007FF9DC560000-0x00007FF9DC57E000-memory.dmp	upx
behavioral1/memory/5792-755-0x00007FF9C5FA0000-0x00007FF9C6405000-memory.dmp	upx
behavioral1/memory/5792-775-0x00007FF9C89A0000-0x00007FF9C89E1000-memory.dmp	upx
behavioral1/memory/5792-774-0x00007FF9CF820000-0x00007FF9CF835000-memory.dmp	upx
behavioral1/memory/5792-773-0x00007FF9CFA90000-0x00007FF9CFAA3000-memory.dmp	upx
behavioral1/memory/5792-768-0x00007FF9DF770000-0x00007FF9DF780000-memory.dmp	upx
behavioral1/memory/5792-756-0x00007FF9DF050000-0x00007FF9DF074000-memory.dmp	upx
behavioral1/memory/5792-784-0x00007FF9C5930000-0x00007FF9C5F98000-memory.dmp	upx
behavioral1/memory/5792-812-0x00007FF9C8930000-0x00007FF9C8968000-memory.dmp	upx
behavioral1/memory/5792-796-0x00007FF9C9330000-0x00007FF9C93E6000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
156	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
512	cmd.exe
1524	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5196	tasklist.exe
5576	tasklist.exe
5148	tasklist.exe
3172	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5604	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1688	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
972	cmd.exe
4576	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5760	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5608	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4584	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3672	ipconfig.exe
5760	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5900	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5672	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133706306522048147"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4182098368-2521458979-3782681353-1000\{AC5AD1C2-A989-460F-8C28-C8A8E21E86CC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
1892	msedge.exe
1892	msedge.exe
5092	msedge.exe
5092	msedge.exe
4824	identity_helper.exe
4824	identity_helper.exe
2712	msedge.exe
2712	msedge.exe
6084	msedge.exe
6084	msedge.exe
5160	chrome.exe
5160	chrome.exe
5160	chrome.exe
5160	chrome.exe
1928	powershell.exe
1928	powershell.exe
1928	powershell.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe
Token: SeShutdownPrivilege	3340	chrome.exe
Token: SeCreatePagefilePrivilege	3340	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3932	3340	chrome.exe	100
PID 3340 wrote to memory of 3932	3340	chrome.exe	100
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1672	3340	chrome.exe	101
PID 3340 wrote to memory of 1912	3340	chrome.exe	102
PID 3340 wrote to memory of 1912	3340	chrome.exe	102
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103
PID 3340 wrote to memory of 3588	3340	chrome.exe	103

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
752	attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\libavresample-4.zip
1⤵
PID:1308

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:876

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9cf40cc40,0x7ff9cf40cc4c,0x7ff9cf40cc58
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2204,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3360,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3184,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5104,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3420,i,7003958142570308497,1213428440280130837,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5160

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9cf9e46f8,0x7ff9cf9e4708,0x7ff9cf9e4718
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6283832618676152518,15084732155536349884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x2d4
1⤵
PID:5368

C:\Users\Admin\Documents\OrionCheckerPTOV2\OrionCheckerPTO.exe
"C:\Users\Admin\Documents\OrionCheckerPTOV2\OrionCheckerPTO.exe"
1⤵
PID:3728
- C:\Users\Admin\Documents\OrionCheckerPTOV2\OrionCheckerPTO.exe
  "C:\Users\Admin\Documents\OrionCheckerPTOV2\OrionCheckerPTO.exe"
  2⤵
  PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:5744
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:3692
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:1692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:3544
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:5316
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5532
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5604
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
    3⤵
    PID:5200
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
      4⤵
      Adds Run key to start application
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    PID:2864
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:5672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:3128
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "chcp"
    3⤵
    PID:6076
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "chcp"
    3⤵
    PID:3496
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:972
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:512
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5900
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4848
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:5608
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:1476
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:5660
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:5112
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:5592
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:5656
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:4972
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:5624
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:5832
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:4040
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:2692
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:4392
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3172
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3672
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2728
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:1524
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:5760
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:1688
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5748
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2184
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:980
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
e46f208d833ec2a1b82b3db8b484c5c3

SHA1
4c654121910a284f25c94b5b0de4127190305007

SHA256
6651b84684c2432840cfe7a89d7aa51083921072dae48164614bb4116fb532cd

SHA512
8b6b3b8ad632c2f88dec3335a5d1cd9272ac695445f0516f68323fd62757ce1c2273a989d6b55fa924924f0dd63a8cc4511e56bd1b73b8a8299471558c7294eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
1afc7460af54339377193184fe007744

SHA1
891f42c41f62c6c868f6819302823cd5d43e454a

SHA256
df0a2ff8a0a371ff5e31f8006208dfd7085cf5aa0154353e031594a807e056c5

SHA512
47707607444698a379621dfb760c713cad8998d51c662a77669f66d9348774957f907b68880f8d1ea6574b865ad3044e19a41aa0f058024a88e8e815cc3127af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
160KB

MD5
2e5c1154837eaa2ccccec54ba9904537

SHA1
8b75a40113e3bf47c45af2c607217214d939d95c

SHA256
22708ec5b2437924f7be445fafe848db56a04742e3ccbe99933547bcdeddbc4b

SHA512
cdea1c18fdddfd97a9c8c58c6abf106d55f989aaaeb85658b8e7db961924a888d5cc5fff1cd3125ae1868ebaf625f46d16aff8128e9ffc8e704f699a24667241

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Filesize
278B

MD5
c16db502dba177a155d04beebcd20962

SHA1
414f2445d8167468ca0c1eb52bef5a51786464c5

SHA256
92e95cb4f0a417ffc6282cc344bde9325dd6fa9eb194f42f76d6458db0bf0739

SHA512
fc582120806c182aa2ad6d5ea36dc00cd641dae06c169acfc444b75a4c7ab9205344c49f6f6eb8e476599800956942caf34460d5b795dcbef43de9df884c22f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
96d8ab53931efd82f7a8d69116f2369b

SHA1
94ec7d91e8fe9c539e6e2449a9b19b75155b9f1d

SHA256
df95ad37618404105166176cbcff420ae8e1f8c28c195f7dc0de6617810dd96a

SHA512
1a288f0cdf09a9654ca7209a9b761887bc3aac8d55ce5df63c234dc4c665758af175fbd0dda86feb197d750b838c66ceccdffa3306062769adadad017dd4811c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
0247c9729c29b520f03e336b8be310bf

SHA1
c76b433fd5bead4bb401f243d9b379fea70a115c

SHA256
1057ad268828c92398e3f0d3ed8bb91308ec9a853371bd65aa9b31a4ed2e08ed

SHA512
f747a1cbcc92251e6b6c8add733e9dbec1d22014a890086dd7a4641926f3a73806f6d879483dec9eda0efd75b157eb5494d694896716cef18e1c82dfd49798da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
0e311e962d72c967a57f3c5825350bb7

SHA1
b3aedcc2687647e5096b15173808848421e0da22

SHA256
14ee886155f6fa55afc8e1895eea7ad892dfaeadafc88f4ebfbfcc06c076736b

SHA512
457f2a77407addc4743b1bb336d7283d218134c8df3014628ad416907420850e91101e7a1e5c5419521992ae78a0ee2f52c458696ed5e58a9b434619fa7e0de2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
e538d51e6d48925f5f728f36185b732d

SHA1
03a433700c9f4e06b88b4a2a270a9d194a063617

SHA256
30358987ef6da33231e9f0840bd7a78033c69b3c7a9ac810bf2504581b80fd1c

SHA512
241d7b4787e44edaab70397fb718c580226e1efeb20ee7c55478c72c6d950e27ef7e204ad031ee3e5c00624990edbb7f4c71364f2aa8a5dd4bd4c271eab28d1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
704ef0d38a221e0f1e8db79726ed8272

SHA1
07bf23321a53573a38b3df7fbc2faf69543c4533

SHA256
d2b5b416a9d9f12272109d248ba329c2c4574b735b6ce13d4c71d71c25e52511

SHA512
a438059eb2b8ae3d03f9463b1aa49f0a5f8ed1b0239e58caebcbe196c0875cacfd66ae8a0580cd8035efe3505d229b2d1a4d5b9e4213252c6e7bfb022db52024

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8d675c6db678a0cdc84f269d3f6475cb

SHA1
304a61529eb088d39e51af9edb5213accbad5f0d

SHA256
29de77a3899887b72cf7515b240a8f9263311899c3fecb521add6960c47d4359

SHA512
b65bce78c71b4a55f972c9c6c4a61a3558fd2436c49d0e85ecad78272873fce46b0836ebeb62a126b61c790ca2f5c835166461dfc8176cb536f679a464ce25fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c64189ed6036433ecd94656e1852e85c

SHA1
ad3627223fa29efd410f5e947dd177c040e8da1e

SHA256
e239e152de2cbb57bbf4a06bfe286c4116b5b9b18b925231b947816eca20c938

SHA512
0969a9b84422fac5ac3405a833b0b53dc3c6b8b62ee9c6e646b06728f66dd7c9e8208df310cb5b3e943aa1db7fc5bc9cab8569fe1525ca845209c14aa252c69b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5701a85d8145c5557959d3dde962856d

SHA1
414d4cf9a73252295e6a70a5821f479fd0d6c6ea

SHA256
aec6d00c139c0d680f16d70455d89499c8168a3f82588ef891ae2584d3ea64f0

SHA512
6cf3b66184d2ffbaa105fd8de04a55d04e1e539d1906ed4ad55163019ce60d45a4956c01e505571e86cf529315ca4ee4f872144f4adeafc651c23f75c7092ee1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3163a7cf2acbbd7cedebb96fdfa4c2de

SHA1
f142f140914d4178216b23416a81683479a44b46

SHA256
f677f4d492e51e2d53164904a14e5478b793b0130bd8bd4b7b1de3ed7614f478

SHA512
5b4d89eb2b985b6345d76db2fbca2b06a0b68f25dffe45c962af62c20437ca70d0c0018100586e90f9ebbfe0a36cc7f4e6bd610e4bd59ebaebd03ec2f063ddaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
10cfd113742f9bcfbbdc6cb24ca2bc53

SHA1
0a1d16675c79122650e530d03d0cbe2e792a1c9b

SHA256
8022e8d21221352a3b1cafa373c118ce22f51cf9c1e1c47ca5da90d58c14b48f

SHA512
5548c0e026fd22aecf85d611defc7017bb501436dd88ee785e347fa36209635d442d70051e956c762dbc85f187bd31fa8e3de046ce00ea30ff514b867e1d6bf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1dad7806d96379e18ff7303c7671e6c7

SHA1
326235f5dfc26484413d82148fa05ad887561081

SHA256
8bde4b0689ad366fa64ffbe2d2d63fda7b09b8f8044748cb601af94dab551e1b

SHA512
595919d5768a1e89a7ae4efab37d52b0a9ff58e5ba48a2577f2e0c5d5412b339af1538f933157c4495b362faa9e4636f9d36da56388ac0d3a741e8fdf2f52fcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b66000b55159e5f110461dcb2a5637dd

SHA1
39b7de8a8ed22e603d11c4bc9e5c5b7a6c23919e

SHA256
542e353700146a3bc2e41fa9a4233172b683bbf847806aba1bed4134fd52137c

SHA512
8b70f202aa46124d12cd0893cce7a32d80b8b57a968ec8db061cc521c06a1e79dfcac737f22480c626f330b58e09ab9e812b8e8e1f34e03571f14add382017f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
06c3b1deac47bbf01589d5d66bf35e3a

SHA1
174175216866128b518a86b25909f70d591d5a5a

SHA256
9aa1470f6738cd8807ba314e5cf3ed46c378898a0a9e56a34b9fb59b5c65771e

SHA512
426aec5f7f2dd0cefb16ca5639815270dad5a9dffd20c36b4defbcd0381445c5e41f5fa1bdd85056d054777605fdbcba524772d4c7eb441ece779d110800369a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ef13d321d1598f299d2a102dcf5ca6df

SHA1
b50ea88d3a6e6a356bd626548d597c7acd0b7a20

SHA256
a6cd6227095b22629f47a305105dcf6ad83d69a9284cb79dd10192ad5f757602

SHA512
c824821d867b42c5809d92b84e891a37decbbdaa37b4de174e1f616f2769449b5bf174251ae5f237c0210c8026b01f0bdb38ea1563820c9bcd6db874708ff3c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d423e99984cdfac123673f52147908c5

SHA1
a249cd774ea1a67b6af2773930c8efa4a549364c

SHA256
8820e2333ee82bcc55c8c0dc2220671312a5941c5dd1f5bfa8bf8d7026f90a93

SHA512
8f3e38c97c0fdfc2a161d95ebee442b7bb49274bb1a8392be3e2c52bf87382461d9d53e5e9973aa72ee27d7eca430052afd8fdc9b72ae4e2f709cff74ab0c9a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
b7707ded612f0a447680d844011ffa6c

SHA1
7e63b9ecc9e32bc774dc57ce348ea220f474b09b

SHA256
53daf5a8395533d05a518b396a7ce034a3c157a3feeb380d186eff304410047e

SHA512
23908514355b960dd42393e6b74e8dd8a4fe840aa3c4cdac1bdc4841e1cd58758124a081760286ce932e8057fd4515b9953b3e3d16e23b29379f6e6b8150475a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
114KB

MD5
5f918cec3fe54599efa6c11eaf052dfa

SHA1
570fb85f2fd3715703a0bd53fb54d241ed4ae1a6

SHA256
a29ac354ac6fe57562623e5d625d1d6369e96436c050eee706cad1ba8f2c4742

SHA512
7f40c89bee789598ebc437436833b6597570b700a9814e7a694ec7c454e6c763b52d98157e730ca96f66b38de1d9e4a34f3876590dfa2c9e7741629b938030ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
207KB

MD5
4a7b924aa834dacfd33cc0a1dc0e8a67

SHA1
03a469788539e33528d68a6be4f914402751a2b9

SHA256
4f491b47aeaae71da4e2e7d5def6ac0dceac1e46c09f8b340276383874d95c0c

SHA512
0e38fd1ab0a344639d98ade6e257c43354f35bb64892800b9dfb9e16723d532f9bd43ef76dbb1af70f42080d16a3a93b3037e2f35d3ff79a5506578b3b13f9c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
207KB

MD5
dbf49792bce0dbd8ea64deb17cdf7ae3

SHA1
aa6706ab209c0a5196809c6fbd5b48354a978c4d

SHA256
2b0c428cb03227c117bcf7d5d6ca90ade21701f7b4df3a01cc65df62da60acd8

SHA512
87db155f8bfae18bca131428f2aa10e25b536baf9ce4595d5143de834ebe1af46db8a705687956a1c36ab3d626b5b9039928d854514d88b9fb4b821e3ca15d64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b4797d25572b2c020014872deef98c6c

SHA1
8cc72a93ec80287488f81e198342068cb529d078

SHA256
e4d3fe1a8716f4dd76fb514c51a7328c9222020508da1336fe874966db0f9ba1

SHA512
ec52d51fb5ef75e3e499f129aefe41efecedecd0cc866eefe49cf2057ec51617b13af246128e0b4809e9996904f57bf1a8b78687b7efa4efd51a31e467967c79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0a2d1c3ae953ac9c60b3d3d13077a6a8

SHA1
359f0b5cb6dbf3ebe02b727ff2ce9af601f84e6c

SHA256
f84bfc81fb9c1a095e59e8fe97c1db992a7d5722552300f9fabb3657c5a41b2b

SHA512
3f2bfb77bd065cd1f02620c39b66f861fe412af0ef0282887b193d349b8f54bfbd099b888b9db229bc3ef86d83e3da364c27d99003ec70a235fb7a5e7720ea1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
51dbb52e35813c304ab416547be2856f

SHA1
9e35c28cb32a8912c749d2212cc6b39dafe02e82

SHA256
a57e1ea657fb33c6252c2590949a5e11a2ea7dbc1722cda91d37554c9807258f

SHA512
9a355837bcbaa56b1de1c704122f0d0a6b0e0648884ee7fa737f262ff7f8935259588fd4fff95d3fa1ca083e2a8fcdf75af48e7774b0286fb3e260b805550986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
12KB

MD5
cfd89a74b4080b5f7620ab1f7271bc64

SHA1
f562b0a544a9d35458ff522c844f014bd044d28a

SHA256
b42b2f01586e38b52dde0fbe48df5f9974e37656a14d039cbf67acff5a526e04

SHA512
0eab58893d71e60da4f91c5104abec6743af7da6f20b34d2a3db49e3fd6672a4255c5285e43cd88559c49f3391e7d2c526fd1f30dee822422f2fc56187ca162d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aed730d1a06d4b3ecdc800185b0bfdda

SHA1
82f37186c71522d93bc1ad1cdf3820c76768a044

SHA256
4a5064142cf2ab4801eaa470753c68a4691639753dc67090cd80263c8bed7236

SHA512
5e36ece2dfdc44be2beffe4d7aaee7f89982cb3d624310adc6e900dc505cb89f1651ceda3ff706d1845880ee0d4bf9aaf06e0e268174da8bd4148fca8740f343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
64c374bc82c7bc55b77800aaa1996410

SHA1
4f09bae6f139d3678c6cffd6e69983295249a714

SHA256
316c92edec78d051236507873d15d7fbadff8754c1473d98c451a17af1711212

SHA512
80cf94ffd63a0498fd4438d51b86d499d1778ce6a49cb781c2f6e6186421661e461d3efcb0bccb7263e8fa6146d74d5cfcbf53f83e5f4f279b110e60de839326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a3c6fef8963e00d9638551b0bc0528c8

SHA1
b6761894d9d563d8e96c1c5a2751df7ab8c4ad14

SHA256
69fc91ba5ae3b129f9a75c401129ceb0d0e78b901ee26f1797e0b4f96de72a9b

SHA512
3657e7c463ce11cd0d0c4ddb75a72645c548021ee5918a7925975bbdb15c1d090fbe80e0c3528d58f41abc9c16dd77e229ed059e68cb9447b6652c9d278241b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8a7686146318de5ef83d404665fd9c9d

SHA1
068969e0bb4a58f7bd33d0f69989b3c1c8155526

SHA256
0dafb91d746b308742e22758abded9eb6a9453b8843734f908de6e10577653b8

SHA512
be85e3cf9fe71a0c53fdc880e1a9e76932d2dee688f30adb1b3e4f57773a7caab4996fd25e98b68083424f7cb08f83f51072243cc6787b1b7025499ac175273c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
927B

MD5
d4e884f70373fb16b5378a213f3a7962

SHA1
d0d24d0dee81c68c70c002523b1d1b4a65242a5a

SHA256
89ba639764fb3aea90381e7e62c87b3eff65e9520f76b343654034c67ad6170e

SHA512
ea84fd8462306662ea3ff11859544584cd5b3af352f2fcd3390cde933d339cc4870165804f3c6b7e51cf7a2619d605553604a158dac0c835a220829ecf9277b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ab340d4ce832f9f32fc9025038f928d5

SHA1
a2867c97ad7a78ef3038d31d6e7ef1f5fb7758be

SHA256
01c863bbb7d59d0769e932ce4b2f041ceb4fab58d87a065c728a8bf75cda59b8

SHA512
41a1c236b0ca00fb443c06d607cd307e3e59938f5e3cc93445bb9a48ea1108b402ae5bb78e1e2c2e83e97a3ebe776b115089d213b681c07e2e5aa3d851a6fd86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49b3b9c277e95d777c1a4051ac6d23c0

SHA1
02c696482379c30316d2233c677ce448d41050f3

SHA256
9aca2fdfb363b304965d99ad831d7ab3fb17e45c1c3cd1181be4db2199c8da43

SHA512
88c7bbe286bda7c8b6a1cca4350943cc4ae0c9a2e53b384103764d19023950a0c9336b51167bbbe72a851d440ddb39096a14f63c9a1d98e4e8addd1bdbe3657f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4688c3506264a68df7e12527d3d6f4e9

SHA1
be1cf43fe3d9cc9b54a8b1f8734bf1ad247c2379

SHA256
c9a3d12aeb2931055906f3102ff970c0634e0b74ed2de853dd2bf2a85bf9db21

SHA512
8e60ca270dbd127b1446bfa51307120ecc36d9cb85e01e0a1c9ab33181ebec037a4b7fec8bd170132f079ac778f0a31dac537a3b17a4bce2adf089537abc5b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c898a44577eec44dbf6fee70f4a4319c

SHA1
6b419491b476067f944ddce4a0e74ede61e531dc

SHA256
9b3acdb02c7aa98a9eafc273f38d1a00bfd47fe1512a4d7c079f394d287f77d5

SHA512
e0942abb171258a92a51a342fd1f4907c85c26c1f3df6ed00ea15d32789468f30707a790cc3c87de282a9c8b12e9a91e17395daddaa6bf0bb519ffb1db87a05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb41f24373dfb9158505728562373096

SHA1
2b448aeed3df47e7daeaf47e12dd98decf969b6e

SHA256
9200a02d1fa95a48f2254d458832acc2aee76d9fc98f47b6e5e88a3c988589f7

SHA512
06ba6e255054e10f49625728541e6a7958d82d0f913a62ffb7df219749ea3563bebe3d766acb9d518c21459f35b3c9f964b4c99471904f9ad458ed07bb2b4f1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44338c48715d4e088101e50b829d3b83

SHA1
87aa9521fd13c89131263b60917db9d0be4abceb

SHA256
6cb4cbc90bf5361eab84817bd358295782b2970266faaa769db7bccff995453f

SHA512
c3e150d3b4fb269a28a529257222da47fa3d2d369ab97200821cc34646f6d57226fa34f126b13ac8e9a7f1bbb0a1ecc189d5b9ff3beb77c8a379e55e4ebcdd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d54d00dfac2c08a8239bb360c6eba94a

SHA1
2790083c7e5c2eb70fb0c040a887e11ab00d63d7

SHA256
3cc8569135d5ebb5cae3a88157c583e2a64871f9c226b7da4498f512b60950d3

SHA512
d31a6845532976fbebc6f609339ac0f884846638c5ae1c469219744d23531193c09d032207498ab2ecbc90b5ec1624fab428a8a5188085cb9a2011269398a01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5cd559.TMP

Filesize
538B

MD5
2bcc93d3c89af68e35578132b7ca37c0

SHA1
28b9c10edf1a02f519273b6f066131010310b92d

SHA256
053c5bdddb2a648e660f49504f5ef5b8757a32b54d5929c90ee9bf5f87af2ed2

SHA512
6e0827d1fa85233eac55538929f8b03e1bbd3a45f78b1e0e5490fcded5326808bc8fc4079f64d508458d9b480362dc3d89d338c03ee2442d550c456bf2782995

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
c465e6b3b932ea069e16b4841fd19ac5

SHA1
477738e6f7e93131347e7e03d8b7e18a7b6e9df6

SHA256
5df50eba90a8561be9aad6bd21408daac608bd7de252f4b804bd8ced5c23d4e2

SHA512
59f32daafe589d54192aa18565e6c219231b1d631ff526513a0f7bda766dabddbec4125374ec0972b08210b63a39ba8fd4cf7f7c1a4f8b30d010feda4daf4975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1bf0904b5f5dfd3efc88fe7041cd91d0

SHA1
bc78002f31edb05c79bada72bea660291ea407d8

SHA256
50693b0657c6192ce3ff436af8b9335a82302f4aceb1290c406f53df62741cc9

SHA512
de80ca1ff692cf88d1840dfeb696c2858a8aec4c000cfbf81faba4507e7733bdfae11ca83a12917c90892729d88e7374a0ab7ea6a8bebbf4fee199b5802a5532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98fa569b14895aeb8c19968897be55c8

SHA1
6e2f78f0f2cb0c6eaca791cf52286bedcfa5bcb0

SHA256
3b1b19a6f6bd8a47039555285994a5f133e1954f6c4d4db26d6a68e9b62b997c

SHA512
06c5679bd45558eb6b0ff48e2a97fa61d66b78b4ccdec8940958704607f4ccfcb1a3b58316c2d9813b348f838eda2ba1d9439308f6cce7519a45ee11a7f61e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
53B

MD5
f7673b5cba644b85313885f652225992

SHA1
e687daed02e460f46b559718e9eaa2e2acb2f881

SHA256
8f416339715d6fd06066a2d03451bb79451a89a5936fd692763c552320cbc4ca

SHA512
404888e3c9b3dd9bbd57ca108f017186d7bb7627383a91f66fe1644378543e95e77bbc4b23edc82b31f62d888125e67f10ed8df07a194e2809139fd0244d60c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3cf67d4b-c2fe-4a26-927a-72268509671e.tmp

Filesize
735KB

MD5
ef98e62217c3c6d91fb500e1ef7de199

SHA1
bf5374ef1c82910861907041aefb656ace681f25

SHA256
24ec5aaef88ac6df673f38be84d9a5ed256a2d52252d559195f1e2726329b61d

SHA512
4142b4b08364c75b9f9b3750844652c965c941809bea9f217d85e268ec2026aafb1c773bdb9a1f704b5e6d5055b446ca1ec8f3d861601b9d1d7bf9de6a3e7ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_glya0kfa.uu2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\OrionCheckerPTOV2.zip

Filesize
36.2MB

MD5
5efb2675d3b4a4f3b8621c2e7b2b8a98

SHA1
45894c2debc8cc219ebd14616e25f04a256772a1

SHA256
d8ed4a8e561b6ba347b87fba4bd13b4c7801255cb3502ad5af14a04d5c8f6205

SHA512
2b44a6d1f17b2a2917370bdd901ef974be5e21c848c57979c51db3d6852601286d8ed9214c09fb18ad31770a498fd0be59e19a93fb8c9816301b5faae859cc80

Download Submit
memory/1928-729-0x000001B205850000-0x000001B205872000-memory.dmp

Filesize
136KB

Download
memory/5792-663-0x00007FF9D07A0000-0x00007FF9D07B5000-memory.dmp

Filesize
84KB

Download
memory/5792-762-0x00007FF9DC560000-0x00007FF9DC57E000-memory.dmp

Filesize
120KB

Download
memory/5792-646-0x00007FF9C8470000-0x00007FF9C8588000-memory.dmp

Filesize
1.1MB

Download
memory/5792-645-0x00007FF9D9C00000-0x00007FF9D9C2C000-memory.dmp

Filesize
176KB

Download
memory/5792-648-0x00007FF9D0780000-0x00007FF9D079C000-memory.dmp

Filesize
112KB

Download
memory/5792-647-0x00007FF9DC560000-0x00007FF9DC57E000-memory.dmp

Filesize
120KB

Download
memory/5792-650-0x00007FF9CFA90000-0x00007FF9CFAA3000-memory.dmp

Filesize
76KB

Download
memory/5792-649-0x00007FF9C8590000-0x00007FF9C86FD000-memory.dmp

Filesize
1.4MB

Download
memory/5792-651-0x00007FF9D5B10000-0x00007FF9D5B3E000-memory.dmp

Filesize
184KB

Download
memory/5792-657-0x00007FF9DF600000-0x00007FF9DF60E000-memory.dmp

Filesize
56KB

Download
memory/5792-656-0x00007FF9DF3A0000-0x00007FF9DF3AA000-memory.dmp

Filesize
40KB

Download
memory/5792-655-0x00007FF9C89A0000-0x00007FF9C89E1000-memory.dmp

Filesize
260KB

Download
memory/5792-654-0x00007FF9C6990000-0x00007FF9C6D04000-memory.dmp

Filesize
3.5MB

Download
memory/5792-653-0x00007FF9C9330000-0x00007FF9C93E6000-memory.dmp

Filesize
728KB

Download
memory/5792-652-0x00007FF9CF820000-0x00007FF9CF835000-memory.dmp

Filesize
84KB

Download
memory/5792-658-0x00007FF9DA9D0000-0x00007FF9DA9E4000-memory.dmp

Filesize
80KB

Download
memory/5792-659-0x00007FF9CBD70000-0x00007FF9CBD8C000-memory.dmp

Filesize
112KB

Download
memory/5792-660-0x00007FF9DF770000-0x00007FF9DF780000-memory.dmp

Filesize
64KB

Download
memory/5792-661-0x00007FF9DE6C0000-0x00007FF9DE6CB000-memory.dmp

Filesize
44KB

Download
memory/5792-662-0x00007FF9C8970000-0x00007FF9C8994000-memory.dmp

Filesize
144KB

Download
memory/5792-664-0x00007FF9C5930000-0x00007FF9C5F98000-memory.dmp

Filesize
6.4MB

Download
memory/5792-643-0x00007FF9DE660000-0x00007FF9DE679000-memory.dmp

Filesize
100KB

Download
memory/5792-666-0x00007FF9C8930000-0x00007FF9C8968000-memory.dmp

Filesize
224KB

Download
memory/5792-665-0x00007FF9C8470000-0x00007FF9C8588000-memory.dmp

Filesize
1.1MB

Download
memory/5792-677-0x00007FF9D0780000-0x00007FF9D079C000-memory.dmp

Filesize
112KB

Download
memory/5792-681-0x00007FF9CFA90000-0x00007FF9CFAA3000-memory.dmp

Filesize
76KB

Download
memory/5792-644-0x00007FF9D07A0000-0x00007FF9D07B5000-memory.dmp

Filesize
84KB

Download
memory/5792-641-0x00007FF9DF770000-0x00007FF9DF780000-memory.dmp

Filesize
64KB

Download
memory/5792-640-0x00007FF9DE710000-0x00007FF9DE729000-memory.dmp

Filesize
100KB

Download
memory/5792-639-0x00007FF9DA9D0000-0x00007FF9DA9E4000-memory.dmp

Filesize
80KB

Download
memory/5792-636-0x00007FF9C6990000-0x00007FF9C6D04000-memory.dmp

Filesize
3.5MB

Download
memory/5792-637-0x00007FF9C9330000-0x00007FF9C93E6000-memory.dmp

Filesize
728KB

Download
memory/5792-638-0x00007FF9DF050000-0x00007FF9DF074000-memory.dmp

Filesize
144KB

Download
memory/5792-725-0x00007FF9DE6E0000-0x00007FF9DE6ED000-memory.dmp

Filesize
52KB

Download
memory/5792-635-0x00007FF9C5FA0000-0x00007FF9C6405000-memory.dmp

Filesize
4.4MB

Download
memory/5792-634-0x00007FF9D5B10000-0x00007FF9D5B3E000-memory.dmp

Filesize
184KB

Download
memory/5792-742-0x00007FF9C89A0000-0x00007FF9C89E1000-memory.dmp

Filesize
260KB

Download
memory/5792-743-0x00007FF9CBD70000-0x00007FF9CBD8C000-memory.dmp

Filesize
112KB

Download
memory/5792-745-0x00007FF9DE6C0000-0x00007FF9DE6CB000-memory.dmp

Filesize
44KB

Download
memory/5792-746-0x00007FF9C8970000-0x00007FF9C8994000-memory.dmp

Filesize
144KB

Download
memory/5792-633-0x00007FF9C8590000-0x00007FF9C86FD000-memory.dmp

Filesize
1.4MB

Download
memory/5792-632-0x00007FF9DC560000-0x00007FF9DC57E000-memory.dmp

Filesize
120KB

Download
memory/5792-783-0x00007FF9DE6E0000-0x00007FF9DE6ED000-memory.dmp

Filesize
52KB

Download
memory/5792-782-0x00007FF9C8930000-0x00007FF9C8968000-memory.dmp

Filesize
224KB

Download
memory/5792-772-0x00007FF9D0780000-0x00007FF9D079C000-memory.dmp

Filesize
112KB

Download
memory/5792-767-0x00007FF9DA9D0000-0x00007FF9DA9E4000-memory.dmp

Filesize
80KB

Download
memory/5792-763-0x00007FF9C8590000-0x00007FF9C86FD000-memory.dmp

Filesize
1.4MB

Download
memory/5792-642-0x00007FF9D5AF0000-0x00007FF9D5B04000-memory.dmp

Filesize
80KB

Download
memory/5792-755-0x00007FF9C5FA0000-0x00007FF9C6405000-memory.dmp

Filesize
4.4MB

Download
memory/5792-775-0x00007FF9C89A0000-0x00007FF9C89E1000-memory.dmp

Filesize
260KB

Download
memory/5792-774-0x00007FF9CF820000-0x00007FF9CF835000-memory.dmp

Filesize
84KB

Download
memory/5792-773-0x00007FF9CFA90000-0x00007FF9CFAA3000-memory.dmp

Filesize
76KB

Download
memory/5792-768-0x00007FF9DF770000-0x00007FF9DF780000-memory.dmp

Filesize
64KB

Download
memory/5792-756-0x00007FF9DF050000-0x00007FF9DF074000-memory.dmp

Filesize
144KB

Download
memory/5792-784-0x00007FF9C5930000-0x00007FF9C5F98000-memory.dmp

Filesize
6.4MB

Download
memory/5792-812-0x00007FF9C8930000-0x00007FF9C8968000-memory.dmp

Filesize
224KB

Download
memory/5792-796-0x00007FF9C9330000-0x00007FF9C93E6000-memory.dmp

Filesize
728KB

Download
memory/5792-829-0x00007FF9D5AF0000-0x00007FF9D5B04000-memory.dmp

Filesize
80KB

Download
memory/5792-828-0x00007FF9D07A0000-0x00007FF9D07B5000-memory.dmp

Filesize
84KB

Download
memory/5792-827-0x00007FF9DF770000-0x00007FF9DF780000-memory.dmp

Filesize
64KB

Download
memory/5792-826-0x00007FF9DA9D0000-0x00007FF9DA9E4000-memory.dmp

Filesize
80KB

Download
memory/5792-825-0x00007FF9C89A0000-0x00007FF9C89E1000-memory.dmp

Filesize
260KB

Download
memory/5792-824-0x00007FF9DF600000-0x00007FF9DF60E000-memory.dmp

Filesize
56KB

Download
memory/5792-823-0x00007FF9D5B10000-0x00007FF9D5B3E000-memory.dmp

Filesize
184KB

Download
memory/5792-822-0x00007FF9C8590000-0x00007FF9C86FD000-memory.dmp

Filesize
1.4MB

Download
memory/5792-821-0x00007FF9DC560000-0x00007FF9DC57E000-memory.dmp

Filesize
120KB

Download
memory/5792-820-0x00007FF9D9C00000-0x00007FF9D9C2C000-memory.dmp

Filesize
176KB

Download
memory/5792-819-0x00007FF9DE660000-0x00007FF9DE679000-memory.dmp

Filesize
100KB

Download
memory/5792-818-0x00007FF9E29D0000-0x00007FF9E29DD000-memory.dmp

Filesize
52KB

Download
memory/5792-817-0x00007FF9DE710000-0x00007FF9DE729000-memory.dmp

Filesize
100KB

Download
memory/5792-816-0x00007FF9E2A00000-0x00007FF9E2A0F000-memory.dmp

Filesize
60KB

Download
memory/5792-815-0x00007FF9DF050000-0x00007FF9DF074000-memory.dmp

Filesize
144KB

Download
memory/5792-814-0x00007FF9C5FA0000-0x00007FF9C6405000-memory.dmp

Filesize
4.4MB

Download
memory/5792-813-0x00007FF9DE6E0000-0x00007FF9DE6ED000-memory.dmp

Filesize
52KB

Download
memory/5792-811-0x00007FF9C5930000-0x00007FF9C5F98000-memory.dmp

Filesize
6.4MB

Download
memory/5792-810-0x00007FF9C8970000-0x00007FF9C8994000-memory.dmp

Filesize
144KB

Download
memory/5792-809-0x00007FF9DE6C0000-0x00007FF9DE6CB000-memory.dmp

Filesize
44KB

Download
memory/5792-808-0x00007FF9CBD70000-0x00007FF9CBD8C000-memory.dmp

Filesize
112KB

Download
memory/5792-807-0x00007FF9DF3A0000-0x00007FF9DF3AA000-memory.dmp

Filesize
40KB

Download
memory/5792-804-0x00007FF9CF820000-0x00007FF9CF835000-memory.dmp

Filesize
84KB

Download
memory/5792-803-0x00007FF9CFA90000-0x00007FF9CFAA3000-memory.dmp

Filesize
76KB

Download
memory/5792-802-0x00007FF9D0780000-0x00007FF9D079C000-memory.dmp

Filesize
112KB

Download
memory/5792-801-0x00007FF9C8470000-0x00007FF9C8588000-memory.dmp

Filesize
1.1MB

Download
memory/5792-795-0x00007FF9C6990000-0x00007FF9C6D04000-memory.dmp

Filesize
3.5MB

Download
memory/5792-833-0x00007FF9EA560000-0x00007FF9EA578000-memory.dmp

Filesize
96KB

Download
memory/5792-835-0x00007FF9EAF70000-0x00007FF9EAF97000-memory.dmp

Filesize
156KB

Download
memory/5792-834-0x00007FF9E9CF0000-0x00007FF9E9D24000-memory.dmp

Filesize
208KB

Download
memory/5792-832-0x00007FF9DF780000-0x00007FF9DF79B000-memory.dmp

Filesize
108KB

Download
memory/5792-831-0x00007FF9DC3B0000-0x00007FF9DC3BA000-memory.dmp

Filesize
40KB

Download
memory/5792-631-0x00007FF9D9C00000-0x00007FF9D9C2C000-memory.dmp

Filesize
176KB

Download
memory/5792-630-0x00007FF9DE660000-0x00007FF9DE679000-memory.dmp

Filesize
100KB

Download
memory/5792-629-0x00007FF9E29D0000-0x00007FF9E29DD000-memory.dmp

Filesize
52KB

Download
memory/5792-628-0x00007FF9DE710000-0x00007FF9DE729000-memory.dmp

Filesize
100KB

Download
memory/5792-627-0x00007FF9E2A00000-0x00007FF9E2A0F000-memory.dmp

Filesize
60KB

Download
memory/5792-626-0x00007FF9DF050000-0x00007FF9DF074000-memory.dmp

Filesize
144KB

Download
memory/5792-625-0x00007FF9C5FA0000-0x00007FF9C6405000-memory.dmp

Filesize
4.4MB

Download