exelastealer | d20fc374d874a6ee0191abee824a69bffd472d4419875ddac5346d16cc82e725

Analysis

max time kernel
287s
max time network
289s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07/10/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vendcord Installer.exe
Size

10.9MB
MD5

dc4042b46991cb73c1553b09092e17f1
SHA1

ee7ab82432a0f570d2589af29c228413c4afcbe4
SHA256

d20fc374d874a6ee0191abee824a69bffd472d4419875ddac5346d16cc82e725
SHA512

3a0546b48476a1d196f81e150d72d22381bcb35981d41013878fbda526b4cfc6350fd75603fc1f0bbc979bb8c50a4a3ea984054e251278faf96c8274f081b4ea
SSDEEP

196608:Z+RPANDJb3tQk5tOeNvX+wfm/pf+xfdkR+zLWKsnwrIWOzW0DaqkH:9ND7v5tRvX+9/pWFGRoLBsnwrIWeRaDH

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4044	netsh.exe
4508	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3276	cmd.exe
2480	powershell.exe

Loads dropped DLL 31 IoCs

pid	Process
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe
1448	Vendcord Installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3048	cmd.exe
3788	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
2520	tasklist.exe
3740	tasklist.exe
2600	tasklist.exe
768	tasklist.exe
3880	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1820	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002ab5f-45.dat	upx
behavioral1/memory/1448-49-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp	upx
behavioral1/memory/1448-57-0x00007FF986A80000-0x00007FF986AA4000-memory.dmp	upx
behavioral1/files/0x001a00000002ab15-67.dat	upx
behavioral1/files/0x001a00000002ab1b-68.dat	upx
behavioral1/files/0x001c00000002ab60-81.dat	upx
behavioral1/memory/1448-82-0x00007FF9878A0000-0x00007FF9878AD000-memory.dmp	upx
behavioral1/memory/1448-80-0x00007FF986A60000-0x00007FF986A79000-memory.dmp	upx
behavioral1/files/0x001900000002ab23-79.dat	upx
behavioral1/memory/1448-84-0x00007FF986A40000-0x00007FF986A59000-memory.dmp	upx
behavioral1/files/0x001900000002ab1f-85.dat	upx
behavioral1/files/0x001900000002ab24-87.dat	upx
behavioral1/memory/1448-88-0x00007FF983D00000-0x00007FF983D23000-memory.dmp	upx
behavioral1/memory/1448-90-0x00007FF9839B0000-0x00007FF983B23000-memory.dmp	upx
behavioral1/files/0x001900000002ab25-91.dat	upx
behavioral1/files/0x001900000002ab62-89.dat	upx
behavioral1/memory/1448-92-0x00007FF983BD0000-0x00007FF983BFE000-memory.dmp	upx
behavioral1/files/0x001900000002ab56-93.dat	upx
behavioral1/files/0x001c00000002ab54-95.dat	upx
behavioral1/memory/1448-100-0x00007FF986A80000-0x00007FF986AA4000-memory.dmp	upx
behavioral1/memory/1448-99-0x00007FF971050000-0x00007FF9713C5000-memory.dmp	upx
behavioral1/memory/1448-97-0x00007FF9821E0000-0x00007FF982298000-memory.dmp	upx
behavioral1/memory/1448-96-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp	upx
behavioral1/memory/1448-86-0x00007FF986A10000-0x00007FF986A3D000-memory.dmp	upx
behavioral1/files/0x001900000002ab26-78.dat	upx
behavioral1/memory/1448-105-0x00007FF983990000-0x00007FF9839A2000-memory.dmp	upx
behavioral1/memory/1448-104-0x00007FF986A60000-0x00007FF986A79000-memory.dmp	upx
behavioral1/files/0x001900000002ab21-103.dat	upx
behavioral1/memory/1448-102-0x00007FF986890000-0x00007FF9868A5000-memory.dmp	upx
behavioral1/files/0x001c00000002ab0a-101.dat	upx
behavioral1/files/0x001900000002ab22-74.dat	upx
behavioral1/files/0x001900000002ab20-72.dat	upx
behavioral1/files/0x001900000002ab1e-109.dat	upx
behavioral1/memory/1448-115-0x00007FF983D00000-0x00007FF983D23000-memory.dmp	upx
behavioral1/memory/1448-128-0x00007FF9821E0000-0x00007FF982298000-memory.dmp	upx
behavioral1/files/0x001900000002ab4f-141.dat	upx
behavioral1/memory/1448-142-0x00007FF970780000-0x00007FF970F21000-memory.dmp	upx
behavioral1/memory/1448-139-0x00007FF982FF0000-0x00007FF98300E000-memory.dmp	upx
behavioral1/memory/1448-138-0x00007FF986890000-0x00007FF9868A5000-memory.dmp	upx
behavioral1/memory/1448-136-0x00007FF983010000-0x00007FF983021000-memory.dmp	upx
behavioral1/memory/1448-135-0x00007FF971050000-0x00007FF9713C5000-memory.dmp	upx
behavioral1/files/0x001900000002ab53-134.dat	upx
behavioral1/memory/1448-133-0x00007FF983CF0000-0x00007FF983CFA000-memory.dmp	upx
behavioral1/memory/1448-132-0x00007FF983030000-0x00007FF98307D000-memory.dmp	upx
behavioral1/files/0x001900000002ab30-129.dat	upx
behavioral1/files/0x001900000002ab29-126.dat	upx
behavioral1/memory/1448-125-0x00007FF9836B0000-0x00007FF9836C9000-memory.dmp	upx
behavioral1/memory/1448-124-0x00007FF983BD0000-0x00007FF983BFE000-memory.dmp	upx
behavioral1/files/0x001900000002ab2a-122.dat	upx
behavioral1/memory/1448-144-0x00007FF982900000-0x00007FF982938000-memory.dmp	upx
behavioral1/memory/1448-121-0x00007FF9836D0000-0x00007FF9836E7000-memory.dmp	upx
behavioral1/memory/1448-119-0x00007FF9839B0000-0x00007FF983B23000-memory.dmp	upx
behavioral1/files/0x001900000002ab28-118.dat	upx
behavioral1/memory/1448-116-0x00007FF9836F0000-0x00007FF983712000-memory.dmp	upx
behavioral1/files/0x001900000002ab67-114.dat	upx
behavioral1/memory/1448-112-0x00007FF970F30000-0x00007FF97104C000-memory.dmp	upx
behavioral1/memory/1448-193-0x00007FF983940000-0x00007FF98394D000-memory.dmp	upx
behavioral1/memory/1448-192-0x00007FF970F30000-0x00007FF97104C000-memory.dmp	upx
behavioral1/files/0x001900000002ab65-111.dat	upx
behavioral1/memory/1448-110-0x00007FF983950000-0x00007FF983964000-memory.dmp	upx
behavioral1/memory/1448-108-0x00007FF983970000-0x00007FF983984000-memory.dmp	upx
behavioral1/files/0x001c00000002ab5a-107.dat	upx
behavioral1/files/0x001900000002ab1d-69.dat	upx
behavioral1/files/0x001900000002ab5b-62.dat	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
880	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001a00000002ab6b-156.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4144	cmd.exe
756	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3292	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3264	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3264	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3292	NETSTAT.EXE
1120	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4724	systeminfo.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\api-ms-win-crt-runtime-l1-1-0.zip:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2480	powershell.exe
2480	powershell.exe
4168	msedge.exe
4168	msedge.exe
1788	msedge.exe
1788	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
3912	msedge.exe
3912	msedge.exe
3776	msedge.exe
3776	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2500	OpenWith.exe
4576	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3436	WMIC.exe
Token: SeSecurityPrivilege	3436	WMIC.exe
Token: SeTakeOwnershipPrivilege	3436	WMIC.exe
Token: SeLoadDriverPrivilege	3436	WMIC.exe
Token: SeSystemProfilePrivilege	3436	WMIC.exe
Token: SeSystemtimePrivilege	3436	WMIC.exe
Token: SeProfSingleProcessPrivilege	3436	WMIC.exe
Token: SeIncBasePriorityPrivilege	3436	WMIC.exe
Token: SeCreatePagefilePrivilege	3436	WMIC.exe
Token: SeBackupPrivilege	3436	WMIC.exe
Token: SeRestorePrivilege	3436	WMIC.exe
Token: SeShutdownPrivilege	3436	WMIC.exe
Token: SeDebugPrivilege	3436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3436	WMIC.exe
Token: SeRemoteShutdownPrivilege	3436	WMIC.exe
Token: SeUndockPrivilege	3436	WMIC.exe
Token: SeManageVolumePrivilege	3436	WMIC.exe
Token: 33	3436	WMIC.exe
Token: 34	3436	WMIC.exe
Token: 35	3436	WMIC.exe
Token: 36	3436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3264	WMIC.exe
Token: SeSecurityPrivilege	3264	WMIC.exe
Token: SeTakeOwnershipPrivilege	3264	WMIC.exe
Token: SeLoadDriverPrivilege	3264	WMIC.exe
Token: SeSystemProfilePrivilege	3264	WMIC.exe
Token: SeSystemtimePrivilege	3264	WMIC.exe
Token: SeProfSingleProcessPrivilege	3264	WMIC.exe
Token: SeIncBasePriorityPrivilege	3264	WMIC.exe
Token: SeCreatePagefilePrivilege	3264	WMIC.exe
Token: SeBackupPrivilege	3264	WMIC.exe
Token: SeRestorePrivilege	3264	WMIC.exe
Token: SeShutdownPrivilege	3264	WMIC.exe
Token: SeDebugPrivilege	3264	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3264	WMIC.exe
Token: SeRemoteShutdownPrivilege	3264	WMIC.exe
Token: SeUndockPrivilege	3264	WMIC.exe
Token: SeManageVolumePrivilege	3264	WMIC.exe
Token: 33	3264	WMIC.exe
Token: 34	3264	WMIC.exe
Token: 35	3264	WMIC.exe
Token: 36	3264	WMIC.exe
Token: SeDebugPrivilege	2520	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3264	WMIC.exe
Token: SeSecurityPrivilege	3264	WMIC.exe
Token: SeTakeOwnershipPrivilege	3264	WMIC.exe
Token: SeLoadDriverPrivilege	3264	WMIC.exe
Token: SeSystemProfilePrivilege	3264	WMIC.exe
Token: SeSystemtimePrivilege	3264	WMIC.exe
Token: SeProfSingleProcessPrivilege	3264	WMIC.exe
Token: SeIncBasePriorityPrivilege	3264	WMIC.exe
Token: SeCreatePagefilePrivilege	3264	WMIC.exe
Token: SeBackupPrivilege	3264	WMIC.exe
Token: SeRestorePrivilege	3264	WMIC.exe
Token: SeShutdownPrivilege	3264	WMIC.exe
Token: SeDebugPrivilege	3264	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3264	WMIC.exe
Token: SeRemoteShutdownPrivilege	3264	WMIC.exe
Token: SeUndockPrivilege	3264	WMIC.exe
Token: SeManageVolumePrivilege	3264	WMIC.exe
Token: 33	3264	WMIC.exe
Token: 34	3264	WMIC.exe
Token: 35	3264	WMIC.exe
Token: 36	3264	WMIC.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2500	OpenWith.exe
2500	OpenWith.exe
2500	OpenWith.exe
2500	OpenWith.exe
2500	OpenWith.exe
2500	OpenWith.exe
2500	OpenWith.exe
2500	OpenWith.exe
2500	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe
4576	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1448	3448	Vendcord Installer.exe	78
PID 3448 wrote to memory of 1448	3448	Vendcord Installer.exe	78
PID 1448 wrote to memory of 4728	1448	Vendcord Installer.exe	79
PID 1448 wrote to memory of 4728	1448	Vendcord Installer.exe	79
PID 1448 wrote to memory of 1124	1448	Vendcord Installer.exe	81
PID 1448 wrote to memory of 1124	1448	Vendcord Installer.exe	81
PID 1448 wrote to memory of 1736	1448	Vendcord Installer.exe	82
PID 1448 wrote to memory of 1736	1448	Vendcord Installer.exe	82
PID 1448 wrote to memory of 2296	1448	Vendcord Installer.exe	84
PID 1448 wrote to memory of 2296	1448	Vendcord Installer.exe	84
PID 1448 wrote to memory of 4964	1448	Vendcord Installer.exe	86
PID 1448 wrote to memory of 4964	1448	Vendcord Installer.exe	86
PID 1124 wrote to memory of 3264	1124	cmd.exe	133
PID 1124 wrote to memory of 3264	1124	cmd.exe	133
PID 1736 wrote to memory of 3436	1736	cmd.exe	90
PID 1736 wrote to memory of 3436	1736	cmd.exe	90
PID 4964 wrote to memory of 2520	4964	cmd.exe	91
PID 4964 wrote to memory of 2520	4964	cmd.exe	91
PID 1448 wrote to memory of 2244	1448	Vendcord Installer.exe	142
PID 1448 wrote to memory of 2244	1448	Vendcord Installer.exe	142
PID 2244 wrote to memory of 1604	2244	cmd.exe	95
PID 2244 wrote to memory of 1604	2244	cmd.exe	95
PID 1448 wrote to memory of 4384	1448	Vendcord Installer.exe	96
PID 1448 wrote to memory of 4384	1448	Vendcord Installer.exe	96
PID 1448 wrote to memory of 4700	1448	Vendcord Installer.exe	97
PID 1448 wrote to memory of 4700	1448	Vendcord Installer.exe	97
PID 4700 wrote to memory of 3740	4700	cmd.exe	100
PID 4700 wrote to memory of 3740	4700	cmd.exe	100
PID 4384 wrote to memory of 1120	4384	cmd.exe	148
PID 4384 wrote to memory of 1120	4384	cmd.exe	148
PID 1448 wrote to memory of 1820	1448	Vendcord Installer.exe	102
PID 1448 wrote to memory of 1820	1448	Vendcord Installer.exe	102
PID 1820 wrote to memory of 1528	1820	cmd.exe	104
PID 1820 wrote to memory of 1528	1820	cmd.exe	104
PID 1448 wrote to memory of 2160	1448	Vendcord Installer.exe	105
PID 1448 wrote to memory of 2160	1448	Vendcord Installer.exe	105
PID 1448 wrote to memory of 3852	1448	Vendcord Installer.exe	107
PID 1448 wrote to memory of 3852	1448	Vendcord Installer.exe	107
PID 2160 wrote to memory of 4588	2160	cmd.exe	109
PID 2160 wrote to memory of 4588	2160	cmd.exe	109
PID 3852 wrote to memory of 2600	3852	cmd.exe	110
PID 3852 wrote to memory of 2600	3852	cmd.exe	110
PID 1448 wrote to memory of 4088	1448	Vendcord Installer.exe	111
PID 1448 wrote to memory of 4088	1448	Vendcord Installer.exe	111
PID 1448 wrote to memory of 4584	1448	Vendcord Installer.exe	112
PID 1448 wrote to memory of 4584	1448	Vendcord Installer.exe	112
PID 1448 wrote to memory of 3392	1448	Vendcord Installer.exe	113
PID 1448 wrote to memory of 3392	1448	Vendcord Installer.exe	113
PID 1448 wrote to memory of 3276	1448	Vendcord Installer.exe	115
PID 1448 wrote to memory of 3276	1448	Vendcord Installer.exe	115
PID 4088 wrote to memory of 4204	4088	cmd.exe	119
PID 4088 wrote to memory of 4204	4088	cmd.exe	119
PID 4584 wrote to memory of 3956	4584	cmd.exe	164
PID 4584 wrote to memory of 3956	4584	cmd.exe	164
PID 3392 wrote to memory of 768	3392	cmd.exe	121
PID 3392 wrote to memory of 768	3392	cmd.exe	121
PID 4204 wrote to memory of 4836	4204	cmd.exe	122
PID 4204 wrote to memory of 4836	4204	cmd.exe	122
PID 3956 wrote to memory of 4212	3956	cmd.exe	123
PID 3956 wrote to memory of 4212	3956	cmd.exe	123
PID 3276 wrote to memory of 2480	3276	cmd.exe	124
PID 3276 wrote to memory of 2480	3276	cmd.exe	124
PID 1448 wrote to memory of 4144	1448	Vendcord Installer.exe	125
PID 1448 wrote to memory of 4144	1448	Vendcord Installer.exe	125

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1528	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Vendcord Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Vendcord Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\Vendcord Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Vendcord Installer.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:2296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4144
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:3048
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4724
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:3564
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:3264
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:4252
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:1172
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:2668
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:2460
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:5028
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:1888
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:3404
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:2764
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:2244
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:4944
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:3464
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:1500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:1572
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3880
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1120
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3540
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:3788
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:3292
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:880
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4044
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4892
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96e4e3cb8,0x7ff96e4e3cc8,0x7ff96e4e3cd8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1020 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,11238058028758154140,9846293593110399996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
PID:4456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_api-ms-win-crt-runtime-l1-1-0.zip\README.txt
1⤵
PID:972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4576

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5060

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4828

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe

Filesize
10.9MB

MD5
dc4042b46991cb73c1553b09092e17f1

SHA1
ee7ab82432a0f570d2589af29c228413c4afcbe4

SHA256
d20fc374d874a6ee0191abee824a69bffd472d4419875ddac5346d16cc82e725

SHA512
3a0546b48476a1d196f81e150d72d22381bcb35981d41013878fbda526b4cfc6350fd75603fc1f0bbc979bb8c50a4a3ea984054e251278faf96c8274f081b4ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
27KB

MD5
17b6743977bcc7a7bb29fafc37f142d5

SHA1
a06d514d3d380b8c28696bba059c62cfc54deaa2

SHA256
7475e9358cc8ec5ae95b1b485ae0f5dfea9f22c375f9ccd1107b53025f71e3e3

SHA512
1696cb3834251d9f4c1a2bd5d884d06a5efe2b53e15834f9f78d60bfb186977abedb007a37eedf3a23b9347ee44853c1c715fa50faee04b9bc8cf0d3e712b5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
119KB

MD5
c8b177b0935bd6511c4fa31b9fe07db3

SHA1
2c76bcf103bc4c1f9a55a400868a7178bf07ecd4

SHA256
a0d27daeffaf87b6a7ddd838a6d202331267e4ed9ead17ec02d07aadaddf029d

SHA512
88ecef815299754dbf8051113f8989db84a17a8740749a085486326e0a73ae96eebcee4e0027152f58e2157ee3d18c460f4494911f8a0947712b62f3e5a2452c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
51KB

MD5
017f7f9fb490b5f572403dc2fd6b81e6

SHA1
440c96764e006924a57b7f5a32e5dcdb769118b9

SHA256
290ae0cc8ca3886534b051c0151e79c24769cd94dfc118d3b1c1dfd64fbf4d27

SHA512
6fed2a9b27e92330304c24e497993b92a5a1d261c707b6f2914227d75a23f092827de6e705a555d8292a4e36bd0f14545c0646b84a9ade7e1efc924bfe3055dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
20KB

MD5
4bb71581a47e597283a0da0f6bef0eaf

SHA1
536ece5dad210a9ad160eb1243f836ab18482410

SHA256
045771bfcf6c64cb008723fac614aee762de1c3b0f8f2e9895a37c788cd33966

SHA512
e481ebc6878a88a0cadc0123e5fc56ebfd549cfd76df69ef6d976c9015605b7d75092321f7f49d8c61cf611f3f9a39c96bfee995b7f9be3461f44e5379b79d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
16KB

MD5
2e5b9fd9c18832c650b823e5653ecd4c

SHA1
fdf5ee6635fad1ca2d832a4d01e4831a3bd13b83

SHA256
1f59ce371cab05ac58eb03313b49912573480357e306436c968da74301ed3152

SHA512
390ae86b73358c775b82dac65fe51da0083ce16ba8696ca4a2c204bde163471f25a9e681e93a38acead5a357e0e483ce9cefab2ee4d38025196dc2e074debb1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
79KB

MD5
e51f388b62281af5b4a9193cce419941

SHA1
364f3d737462b7fd063107fe2c580fdb9781a45a

SHA256
348404a68791474349e35bd7d1980abcbf06db85132286e45ad4f204d10b5f2c

SHA512
1755816c26d013d7b610bab515200b0f1f2bd2be0c4a8a099c3f8aff2d898882fd3bcf1163d0378916f4c5c24222df5dd7b18df0c8e5bf2a0ebef891215f148e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7a29a09943b2c2629629efabefca53f9

SHA1
144ae0fd23ce345afa0ec8721123ce03a5d33ae2

SHA256
2867b62b3a30f476b6b2a59d825f19524159afc73c9b04f1a6947c3334fcc665

SHA512
91305ab6cf010d66239170950ee35f271de5b4e61d3d8bfdd128efe3cc0d79fc333353c54083c1577235e987cbb722d0e068b37a1b5909ef030e7e835c75945f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8e46af240f56bf69e0ba0435ea8d96d5

SHA1
63188978d1ffd84b86732a1251cbbeed6d435ad1

SHA256
e103657a3bbd74a6d1afcdb6a75377798fc092d1e167e18bfd4d190c336f9cba

SHA512
4a6fcd701b52471eabe80dd37cb66e82ddfbe0948aa8cc0058d09c412ec21165efe2d04f0be25d4fea31762b24d9636c2805271d22372a25edb562bb1ccb8bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d789426175f67099e5a528f2749eaa31

SHA1
6d9c57060f7a75be4f8232326f68781fbe715642

SHA256
ed8c2b3b8d83d21da4ec668483e74e18bf564ef624010911fee868b6ad153914

SHA512
75a2e464bb72020ab34173c55a41ef9dce5777ec6495c0bea1645c2b6a57c7ac8f8fead32ae0a6aebaa546634dd67ccd40e1f4b7760ccbf8e022c3b371e98a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
c54d8e24f35ba9e380db14a02819d53f

SHA1
457744d91b39dd7430bd834d2fbfb36db1be9715

SHA256
fc10eac0d627f294a71739d15f112b61b31f6dcf59e0f4fb274e91599bef7ad2

SHA512
77e76d0027cbf9f8d8344f010ed65e7f73d020fdf75e2abbae81b5251cd2590c9350e2c8019f50888484589e6e91fe0e47ba2d79dab55c0f1e2557e84089844f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
3abb7f1be10d088140579dfcd829f036

SHA1
6cc9ceeedc38f19dfa492174314923c6a26ccdf8

SHA256
02e214f2682f17383abdf934c9c78d7e6967300c750a694ebed8cbe3eb1c19c5

SHA512
d76a3fbfd6baa87bf7d6f4f758c0a3c8f0579c2dc4c5d7546533d14d66ab3bd3cd82c6483f7aa94a7817a37c0527716679996f18ca28962941c49d34d34f2086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
105861c0b75739907d4d417039ed429d

SHA1
26eb19124a4a9893986a5b1485a47191f6e2d12a

SHA256
ef1bc8cb69d9175f1fe572a930f362891297adcb59010066f33a452a1199d175

SHA512
ba2967ecac42c3836ef53cb2f4c25172fe0ef1bf80e70523d061882260ca0d19327abc897cc5267af1e872ce08c5ce4b55e906176addeba36fbd98140b80f97c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a213d202280aebd68254a6111e0532b

SHA1
628d664eb79c8b070584a90ccd100c19aad7d37a

SHA256
217bd13e7cdc94bd6832a883afe66277a219bbed30ba5837630ff170edd16f4b

SHA512
f8e170f8b4524f94ce62b8a0983b1ab97dbbfac1bd8b6e04d6795a467292a45e4ec2f120ea125987622b2016f207a7170a53195b738c7c5be6f404d9ea0d7b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e90918a8c11d448090589146ae0987bf

SHA1
4613021fe4ed9456c0b3482450e3ebf9f6b11bf6

SHA256
bb2751e29b2eb7482ff8c1b1a39a555328786c3ab9772fa3eea693b8aa7e748b

SHA512
bd4ff48fdd57bfda3c2e2b897cd0e8a2a35efac428975590c1d986cfd207e7f77ca901ee6efa0e18f8337ef4b48232d87887d657d66e5cd270d9128a6ad8fd14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
966ce7049def73f67520ee7cd95dd474

SHA1
c3ed7e9fa0b8e9d007282a9e7581932a8f5ec35d

SHA256
78c271a97724de24d9bc2d38478322c081c20779c9e1320c45faad6bcc0602bb

SHA512
18de46a9d6ebe247155c35c0a51dc8400951c8a03c40c02977d40abc11586a643ab08f29c393bec7971eee14f89ddf23c23d0e40f0d26c6e69e9210695961c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f213e906166af41849c8a48b482509bb

SHA1
30134df02c28aa12dacd295e3eb779a5a547303b

SHA256
53f1049854eedda6153eaf4b0780abdd1306952dd66ee24aa113a3346501f468

SHA512
1e3383675c7329fb113146358a81a97bf6e235b1e925d59dd3089586fbe949d7c8b86c25039bd9e90a13f3e50fca313dfb3007a3beda1efea6ca08457f715e43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
164bb907aa33b62fd8f4fbc63cd02fad

SHA1
8b4ca9744d2a9d15d73af30968f3d3cfb034520a

SHA256
b4bde071905407734dc30394779298c039a239e99ce098ba10eac8fca26dbf5b

SHA512
4c328094bee9ecc8179b8f445be6da626ae0e12109c4f846558e344c637cca0c396df34ff7eb11c958befeba010ba496755cac2cc82dfcadab70bf35e0ab1051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
60cf1d7832f6cbdb2f73c31d938af3df

SHA1
58a1a8579065f637975fc0fdb5912d5d99b5c8cb

SHA256
11861b9e975c8349fc6cfef1602cf7f2b2b05824c7b71c3f0691ff210f13630c

SHA512
9e697db8b97cfad425cf8c2751318e60d79b9988366ae71f0618b1488c1ee6e7d97a6f501b05e3ce007ec0f9bcd7f06a96d74f5ae57e8bd00866c85f2178d4c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
b9c66a46a0f0d2f544c04a0a7ec0112f

SHA1
6d3ca3743fbd7a918538157c3376618d4c9863bc

SHA256
7dba8dbe6d1ed2d970d4b6e12e327bb21c866924b3fe47146394a2d82beef457

SHA512
86e825a36f28521fc1e0f5d9cbd0424550dadc2bb06ba8a2557c2d38d2a92937ad6b04fabb0e4ad8439916f7cfb0bf49502451c31d154bfebec9c9e019e3a0d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
dc13ed4fc62bb04a8b09ce10f1aba49a

SHA1
7c00fa0c254f35e7422723bb4ba6704191e7cb12

SHA256
42d29163513537bbc9fba9a7aad890b50b89ebb5e5c7c7dad72910efdc52f9d0

SHA512
0af78004334d7a497ecc49de288b71bf7396510e55bdf0982f9d9315b4d6e1b07e8c8c2d3bc81d68ae32650f2b84b59541de383d630353ee946abd44bb38f002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f36af55e3fda5a1e8ffa22ffc6a3bd0b

SHA1
f5b348fa64cd4af458f0ee4074f2b108c2a1d524

SHA256
65d2188f9850ea072016db290dcbcfee7212807cceb1a605cc0ce5b2e8d77498

SHA512
aa2d80a7bb822aa5f75e1c701449293c36085977c4b8081415c628b60d279bcc61041f47c99132d09b798c25320bcbbe23f3ae4e060110cef36f7f252b5bb33d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
292889502ace31fd0b61bff169846227

SHA1
e1b3e5956b19b8a5815d3cbba29fae8abaf8d69c

SHA256
bcbb3fb66980d75df89e7923b44aba536bdcd9524e818630aa9879b473a520ef

SHA512
aeebd0c346012eb0f6fd9692d373ac374fde593da37fd8f839edcec63fe1f4f1fbdcda2d5c493b1c57f825da7c0b5699fb7a15085d1a952ef30e6577803e9c2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7c6c40b69a95699ca03a98b6231b4591

SHA1
172f271ecb8915f04c0babb4570e0e72fa91fc3a

SHA256
a5b0ddae67e3054f597c607ca735e8606913ab8050d94b8c3e658faa5844af22

SHA512
ccf3d89056d5c2fe371306109bbb10dfe3cba4a2aa943c59320da31dad667303fd7abd765c4131763e3fabf1f02e712a6a9921e71b3b7ef64c3f197ae136b71e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8880a30340e94721cff31d98e4924fb7

SHA1
af6dab705bf79c7b4acc5501aa79374f7ab89550

SHA256
79223d813c0f943b02c995cf70b964fed6e05c4787208608b2d29241180a38d0

SHA512
fd524b42be36f09ee5248860da92d2988ecd84414c34ad30e265b8cc2d95e10217d59d9163125de624a3e314ef1c26130657db223b7caaf486d91a4931d74e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d22f5fd112460d4ec50b1dd83a81cd34

SHA1
6a4f9c493d85a0e63eae72c6353447ff35c59165

SHA256
f4f24692d0629d16b9ebd51684046639ea7a167ae4fde9ba78af5b842a315363

SHA512
c1258986eba9cc3d774630d9113c06962be5145c44e7091b4947c853755e09d0061d4df43179b0c1b1bd8f3196bbe80e55d554cf9ac4cfaace783f49d46a06ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6f9d91c12e20c6ce25945ce9b790e86f

SHA1
ca36002941a7dc546340c6aea2f657d55da03928

SHA256
2d17a8c8a23efebed0aad726bc9ab78e41ffa93884dd7372bcf01db867965efe

SHA512
b5abac1af53efdc0931d69504e0d84a6305a1ac2bd360faa620de0927788ca009c1d55e72fa4a5442b55d4f87408a3c899351dcbffb4f52e91ad1a4ede67c962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
35bca726fec7f8781a834306702883fb

SHA1
4259da9f1b8dbec911f81484d57affbb41afa615

SHA256
88a17f78669a91c02bfda5aa7d885092ce8e5ecee4d8ae30b8a84d210aa8e472

SHA512
69ee9613638cadea101f8367b9a848a903e2b65bc75ac26613868beede55704b6cd4dc61902e9ea75278fdee23e15686c71f0de24c7b328b0b5084cf1caa7727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
59807a5ad7a2de95bf0039ff95b6f8d3

SHA1
5875a56b63b63e8355c11539ce5a3a3fc3fa2130

SHA256
17e25af60126e91b7e5642f00d3291a2a616d7d046bdf27d626d3ce47c46ed2c

SHA512
360501906f67b5396dde086c00a44466a077577cca1d05da3d217dd4ae1b6c80221b20b75ce0737daa4706a21b923fbf60e160350eb91a976cf9bc0b0bc68586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
979cf9efe78a4031da983d1f8973ffd7

SHA1
082b0e08184195c1d582a4c8912e293838c37ff5

SHA256
e518f96b7bdd185587840ff38e3ed71ecf28f458876808746a37082222262fa1

SHA512
5f3303ae0347d6a5e0a118b3e995bf18b58d67780536925d16c7257f27f8b20088bf837730ab91929a95a466201b6f9fb4fce7d24af457f76e64ce9e93e71435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582d74.TMP

Filesize
1KB

MD5
a38d406f404e864c9f4972925f03fbb5

SHA1
a128b004b76124aae996ed674401d7a7c3c0421f

SHA256
6ca428c9428de4d19b5bf333b7535b2eae1a8f4dd72d1a8476ddd9947ee4580e

SHA512
e3e74d5047fb2d87d2a0c3900879810ff847c31aa33f006c5988f843d70657b5d597dad7b1ee1a82e44fff156601517f70dab5b3129e9bb9db647c3ad081008b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
57ab80d58a66f332679b7bc54c717971

SHA1
17994520ac2e9444933998e0faeba3884eed6c9f

SHA256
49d31ebe54c9008eb3e90a2290e855757d1462b6030b3c31a9f205b044d15ffd

SHA512
a6134408f9eef2d1a76c8485e775a3acbc98f7e5bf47bcde88b8d3f4852200e4028a45555d69ef3f155bb07c9509701c668128a9745c5aab8caa9a67904bd146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
794e0cca75dfe2cbc7c466f06276951a

SHA1
cc1e1d9c5cfd99069eb6e5e836e0663ba9b2a554

SHA256
f16aeb8f0246bb3fedc42f380121d49a2fa0ae1467186bd6bd9821cea50ad8e6

SHA512
f5a568c58dd370b5219ca96949dcd7bdc2051c80f8bbb6a2574a81bb57b2ddd89931975ca7100fca1af3c68c3c3775b6131c49b1a182f12ae72e3848c1fae472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1b2f7e97163ce3856119351fd26315a

SHA1
8a31576363da4f126b8479d7e6771c2bbd0a4104

SHA256
000e5e7616409d761b88ef395cbefd169d8c9af51fb1a98e4c97f38ed6842c74

SHA512
c39fffc2de7e909dc805d7eab8bd933b8e8257f9e55e223829742836e3cc03a64b184e7112e3642c9de9dac507e9250f70eda6053c5ebc0be1835d794bb13efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d35bf52478a1f9ebcca761e39ac1d7b7

SHA1
977093dc0827b6f53fbd3b6a31098a6b4b4a30d0

SHA256
c30808f4c34a4ed99497c2462bb1014aa0f202959f0cc11230f0b00e8d9f3673

SHA512
dadb4c6cf2e247c4c9375c60e72c6910e541eca7836991be76e7120cb5ca19345e35b1219b0cf98e1b15c3bd1589b2ab8638a3d4bbc41b1f5e1158b4ad8c4d9d

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\088b0ee2-5af7-43b1-b820-d648014ec5aa.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ClearEnable.docx

Filesize
14KB

MD5
812090aa713774077f498aa430e0ad64

SHA1
ab785df8f320256a9cc2e90b2f124f0b4a294ccf

SHA256
8c47fa3e85e030f107751ce7bbe4fec3af2a2ffbbe750f858943f33ecde0b6b7

SHA512
08c13b7aea9decf95fc460604a7b669ba4857ee81df757d0df29e10fd1ce2934ec304d5c44f6cf0f754227ce5c33339ac1dd388be815ca2d466df383b2f23b25

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ExitBackup.bat

Filesize
221KB

MD5
7832fc030c68538c763b0aa4b94254f3

SHA1
c610428009d90041be067dded1fbfe0368f8f439

SHA256
82b97eb549b3f6a5fb57f02246535a67d8353ca1975b76b06fd4d8f55d6975be

SHA512
1de6709e71b1c22bda56c18eb008278efbeb67fa69f0c30ed7d64925003e42f15f8697fbd90f00fccbcfc67357e7ffc79107b110af2b9f0a78e3c02b9ca3be57

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ImportInitialize.docx

Filesize
18KB

MD5
e0c15236ab8ec5afb58bb5c8bf26cf98

SHA1
9ed77c3f8f84d60cf8e8e9957eb2df7d309eb541

SHA256
281de57f586242dae0fcf45f26ae00f63e263d46e8a90677ef8818127b731f14

SHA512
413c9f7f139637254fec087ee957365b2fd44e853ef951b09ab24904cf8a059113105aab1cb6dc857bc3a473159ed0ca830012d970d2e93676246d0ee64e7c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ResumeGroup.jpg

Filesize
211KB

MD5
72b7b0aab9253b0d61f7fd46c569aa59

SHA1
925c6677a8ff33aec6d5fe04505618a2e7d5c04b

SHA256
0787aa171d10d4e16e136722d40f4c3976775200ac596e53eb7315789c384038

SHA512
9bca4497430039ffdca8f72b75801c4a39bfaa91402a13a2a516d62b0e64629998329c21802d2b92de5709ffd6e9e2a3503b77587263bc52430f940bb64b093f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\DisconnectGroup.docx

Filesize
20KB

MD5
ee3f4212b3c19a55d155e6c361c11ba3

SHA1
3fed29ebe66e19b3fc864895ba3052f362480f61

SHA256
4e911cff87ed192ce78de67c1ae160dfc7b90ab6019992090a64e1222c6945b1

SHA512
e5d99a9e88ef4793878775bb2035ea999cf5e24051505a7e901e66a470da93bfb76dc5f8d64b346ca1e1257df951341d41fc33b212dd95f1cd9f9c08db51e990

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\LimitSplit.doc

Filesize
506KB

MD5
ebdeca13779f263855c1ae03eec197e7

SHA1
e4408d818772deb38f3240f7858da75f2e0f2427

SHA256
d881da6fb6e70f6c66e7dd98fc5ddc1f4e4d7ee900e7a355b48db71d690a3699

SHA512
67f44d77ca0ff0e0be5f23c3b7277cc2710f1fc1b949714ec65fdd3fea3c5da91c42ad0d75d0de4a7ed6691058031b9dd7c09b3e480c9b081ac6fb7f4f8b46a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MountComplete.docx

Filesize
16KB

MD5
de7b18916bbd563c07dffca43bfa612f

SHA1
73c54e07bcb7214ab46b21e4708385534dd42abb

SHA256
bfd5453f160933e67cce1cde9fbaacc64e9269eb4d9df244bcf065aa5804b40f

SHA512
cdeeea07ed0899c2a4cce1c5e82d9a535848fed777b1999e5cd3627c41e8ed6ed8cb23cbdbc56d4ca4d9f32f663a1e8373691f54c709dfffde5d51d43d532259

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\PopSync.csv

Filesize
325KB

MD5
f06da279ea2a699fc0f1cba94cb1c783

SHA1
9457e5a5e20cb9e49655760ab1268d4a92251f82

SHA256
a3e554a1f8ed38daccbefc0e43937debaaca65c42f53b8038fb6ee170f50ad0d

SHA512
611238690f35d52695649ca78f1fb0851d0d376bf74f0f91b54d40001dfe6c3dad2e733d8252dd2243fd36af4cf2bcb2273c41d4292c9101546e1f4414c7182a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SwitchUnlock.xlsx

Filesize
590KB

MD5
6c15767c6ee65ee5744bb2ea93a36449

SHA1
1df87f57ebc1e9f8e5ee33a91090451dc12e6683

SHA256
c65a1ac6ca73917a8c899fac925e92dc84414e41edc8d378f5309b0224d99268

SHA512
5e57a135f3f1d5b289ad0185211bcee98c12792f8a6005c75509a2db11e48f0a58a8f19e7d2cc1bb688d72ecb02b324797b5db74c4ef7ee8e6063b71ef2a0609

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\WriteSet.txt

Filesize
289KB

MD5
1e85385037f3befb1f13e9260576560b

SHA1
e6afa0d1223753762eb097441aef1ca25d13e70c

SHA256
4072e7a26fb04c10f3f85da6da12e52f1682568a653dc331e3f182972197aed8

SHA512
e8dc9dc2fb6a3ad87d1ad0ce84a4946f0f0616fff7c217c5b6f83ff6b2dd4fdf33fafb48ad61764bbb9dda9666dcbaf804cd235adecc5828dc23b8348701d94b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ApproveEnter.doc

Filesize
225KB

MD5
8b5b3f5bd0341e24ca29927cc8f44c28

SHA1
c1f64af5b4e37fcff90096a8a1ee68a48db68a9f

SHA256
3d9128819cc461767ea72714199c6e0f768138c51bf63dbfce5d959264266cf6

SHA512
ae77583147b3edb026f6a96e5da97664f7f8184c6e58e0bc6888819c427aef5e64c46fe6c7bc3d963bebe5022f2d156ba4b7dd79dc17f64d336cb10d52cd6206

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\FindSubmit.doc

Filesize
250KB

MD5
1dc21e268c336a42b4e571b56b394c12

SHA1
8fe2d41b9abfc317ec5545b8636e3c6570493e0e

SHA256
299b732b0b90c3542216b1a24e72e5705edf20d4fc3a5dff6afd1f710a0949da

SHA512
466b95aacff20c344effa17a54b51d5edc35d1c9c8865150d6cac9038d98fbb9bdba5d36e9d518fc9d83311b0d3ce3d8173dba33b6d6ef017daf85abde41352d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\MountBackup.txt

Filesize
275KB

MD5
fb03b8a75936c3643868d4579210ed69

SHA1
129e467788eb2da8fdd3e391c6ff1205b8c654f9

SHA256
c26c8b7fd3802d4e3a4a148114f63aba4002758745ea1f4d652be0c574528970

SHA512
12f3123f7384f948397ec043a76580f669ba2b3e0c5ecc63cdf4bb55764cb12f471d5321732467a1a1067cce30cb9830cc3b9a67cadca4561582b2890fafcf86

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ResizeReset.csv

Filesize
287KB

MD5
7f3092f4866337e20b3d089f28c20cd4

SHA1
5b0f5f2f90f7214cb324cc8074f6dab590d365cd

SHA256
70683fae56e249105de12705f773fc6929d730f19fb6dd26ace790077ba7c073

SHA512
75d267e8d0b5ff61f8dae08c817d96d6b4dc987d09cf58f4dd34b60a6dddd6a86ec302a5fed77cff26c5c8786834a6c38225104573702ad423279be0807f1d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\StopUse.mp3

Filesize
525KB

MD5
87b6dfa366cd9c19de98da0c2bba25cc

SHA1
5da144190c88df3e1f9ae69a46504d527dd594b5

SHA256
205f419f03caa7f9e962d285531640c3320f614ae27b88e3fb3626d5244f23d2

SHA512
f9afdf4751d11d5ab49b029b02ecdb0c117e58b421ca86b976c54882a2dac489fcb91a17830f81bb6b47fa20849ba613d030ae8a156026d660accf61bed7404d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\DisconnectLimit.txt

Filesize
534KB

MD5
6ce4244a6ba391d1fa7dc78aba7d6c99

SHA1
db16e1618cd5ddcd71fc1a255fe46463b8f839d0

SHA256
f63dd65fefe1b8fc2f8828499afaf8b698855df5bad6b61282738990d690f9c2

SHA512
4ee795050c696fb3910ecd5577e8426a6d815af264381f367e4c8db70023170a9f148c775b60575936f3217e2935f1ace99f278486f7970dafb9f89785215bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\LimitPublish.mp3

Filesize
645KB

MD5
b7ac680b7a6cb54647f47585c92071a2

SHA1
5390861c6b91b4282591283a58e9a3bc293079cb

SHA256
7af309a44f32155d2b352f159468d32d0cf652b0532b16470c7ea962a37ae502

SHA512
fb541a5a0110d15e9d8ac8b24205608f1b4ad52d5ca48b82816b39aecf1b6e002e5708ce2724f8d31900c3fcd1400209e186ad2422878e765e2392c3d565b830

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ResolveComplete.jpg

Filesize
682KB

MD5
727967b8cfe4275e290f83b81e8361ff

SHA1
95d19467d33dd6f503f1e4f382a2c53534e829c9

SHA256
ba11e11cfe6af5ebfa539df2b6d54b9658379ab8248a268b4be2fb0445b2a3c5

SHA512
369ef92146b923e2f090614e982c0aa21d73c7107c3c3d0fa93a1d293db54067138606e2bd07c88cfabb2abbd4c17a38c0015fe00fc54a88c84d1b43b1930b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\DisableBackup.pcx

Filesize
485KB

MD5
499bfea68f25a6208acc58f7b64a3864

SHA1
6ae24197f50e6a6ce1ce6c8dafa91616f5c43b07

SHA256
6ce6b1e4539c7c0d8d09cf4e2b7a210394da35ec4001b2af5c2b20c8751b7a08

SHA512
fe09da83e9c6742ff40ef0eac954f0df60bf142f2cf11000cf98702194c3c9da500a5437d50cac50a5701f6592a4ec33a5ba6142233250e0af07994e00c3b441

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\GroupUnlock.png

Filesize
298KB

MD5
2ddca983471089e375a72c0cbfd34bbb

SHA1
4f3b8f6b33a7c133af95c78032bf6b035dee3cab

SHA256
8f8736f94c3c97be13972f7b2521bd0c125537ca3de9798d1579003c283f788a

SHA512
7a6cac3e999d246f84a891b52d9b043815b75b770d2386b431ee1cc35c60895cb8610ee8495d5fb6d158936edbb7d424eef87005887b5f9d1d32187c208c8ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\LimitSuspend.jpeg

Filesize
502KB

MD5
3bd4c327727c093c59bc987c20753c1f

SHA1
8c85cac24184cc5b37f67b1c8ac12672ead15ce9

SHA256
29f5e7d700412242b11dfc0d3b1df492f0d81ee9ee9a92733b76a2f63abe37a8

SHA512
498191d67486f735d0842cef71da76f8b44a5753648b4f45ac204b34484c4657e6860c5029eb2650a2e138309ce5de5df91ac352b57f8a3b21a8f86cf9323f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\OpenUnprotect.png

Filesize
571KB

MD5
5a3d973de9e1fb748030c7b1f150543a

SHA1
26fb977d52bf9ffb4050ba8c78030e0d7918f22d

SHA256
4b0e934285c58db58c8d9732932a790408be81f3c7d26d629d37f696158e39e3

SHA512
b8dd52123a633c61c03fb92ceed6074da13cf7cafbe01ce7c5898b386039f2f6b41b96623f1e769aeda17f57b03cddbe4ca28033f2d70d82460c292aaa50b55a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\OutRepair.png

Filesize
605KB

MD5
12c3093a63601ebf49e84d85583ffbc6

SHA1
6229112026cefc89f97de89e0a3558929286b895

SHA256
d9fae2499ca83fae84dce03c85c4801d0f2f0c4183439722b1d5f34fc4babf1d

SHA512
f9e1da147d3f7c0831fcf58f134a0d39147f43ac73bb3c65b9cdfe787e1801d810a7af66845b518fcc291ffde234c5752e314818e9e661d8583f0938aa7df274

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RegisterDisable.jpeg

Filesize
741KB

MD5
386f550f656ead74f44b7160a4fc6609

SHA1
f6355e78ae16847a5ddeb259f1743ebc60676b67

SHA256
c09fd2baf2871086f5ab40662a5b6e8cd4f673da718391f6c39485007b1dcdd1

SHA512
8e3c8ae842827e46e0b8e2ba15edd16e34392ad79824c86f9c38e15b247a82eb15d5babea9f22e061008b95a81c98f988ea2009a05dc2208bffbf762c0086144

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\StartMove.png

Filesize
400KB

MD5
d2ddd50ef735e6ff12574b60e9f69901

SHA1
4fc3274c46ca997f71a5ee97f32dfc86b5a6611c

SHA256
3ecd1c15b1f5ef0f8c64609fd8bc95bda5d9b2b9bb910187d4b2d4eff2b92069

SHA512
1d2e1ee810b9d60fb7fa24b4722ab368fe986a611d84b2e24faad808832b8c0f573464767efc24e5b32c30cbbf1872b6e78e3eeef42400159794a97dd4b58246

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\TestFind.jpg

Filesize
332KB

MD5
2b187c02236dbc3345b2622c6407e53b

SHA1
89a7a28547e913c30fa04f3254942c4135bf27c8

SHA256
835fb9f586b80da5705b3e4b1617c420506166269fc679af6719d6532d595031

SHA512
dfad0bc3711e47758387e338032464e6181f10e36d29ffb42ec92949d2c8c132b600d57ef906cbd859c1403e0710ae826fc56bfe1b78cc0fddbed5a378de095c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UpdatePop.png

Filesize
537KB

MD5
2b857b3ef560779ccf907fe27221430d

SHA1
9addfb21d6dd475e6007524d69ce65ab2d53cd1f

SHA256
9c7e6818e73fccff920bc2f334e97f0487c468591fc4cc087c17c5b9fe2e02f1

SHA512
8cc40d5c7400ccb183f6ea1a4db2685f191e52e0a5893b48782a484784eae89b788bc683c05a080038ec6356f9d4b39767d4e326257e58ea48d2e129432b16b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_asyncio.pyd

Filesize
34KB

MD5
1b8ce772a230a5da8cbdccd8914080a5

SHA1
40d4faf1308d1af6ef9f3856a4f743046fd0ead5

SHA256
fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f

SHA512
d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_bz2.pyd

Filesize
46KB

MD5
80c69a1d87f0c82d6c4268e5a8213b78

SHA1
bae059da91d48eaac4f1bb45ca6feee2c89a2c06

SHA256
307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87

SHA512
542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
2443ecaddfe40ee5130539024324e7fc

SHA1
ea74aaf7848de0a078a1510c3430246708631108

SHA256
9a5892ac0cd00c44cd7744d60c9459f302d5984ddb395caea52e4d8fd9bca2da

SHA512
5896af78cf208e1350cf2c31f913aa100098dd1cf4bae77cd2a36ec7695015986ec9913df8d2ebc9992f8f7d48bba102647dc5ee7f776593ae7be36f46bd5c93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_ctypes.pyd

Filesize
57KB

MD5
b4c41a4a46e1d08206c109ce547480c7

SHA1
9588387007a49ec2304160f27376aedca5bc854d

SHA256
9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9

SHA512
30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_decimal.pyd

Filesize
104KB

MD5
e9501519a447b13dcca19e09140c9e84

SHA1
472b1aa072454d065dfe415a05036ffd8804c181

SHA256
6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c

SHA512
ef481e0e4f9b277642652cd090634e1c04702df789e2267a87205e0fe12b00f1de6cdd4fafb51da01efa726606c0b57fcb2ea373533c772983fc4777dc0acc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_hashlib.pyd

Filesize
33KB

MD5
0629bdb5ff24ce5e88a2ddcede608aee

SHA1
47323370992b80dafb6f210b0d0229665b063afb

SHA256
f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8

SHA512
3faeff1a19893257c17571b89963af37534c189421585ea03dd6a3017d28803e9d08b0e4daceee01ffeda21da60e68d10083fe7dbdbbde313a6b489a40e70952

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_lzma.pyd

Filesize
84KB

MD5
bfca96ed7647b31dd2919bedebb856b8

SHA1
7d802d5788784f8b6bfbb8be491c1f06600737ac

SHA256
032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e

SHA512
3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_multiprocessing.pyd

Filesize
25KB

MD5
849b4203c5f9092db9022732d8247c97

SHA1
ed7bd0d6dcdcfa07f754b98acf44a7cfe5dcb353

SHA256
45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807

SHA512
cc618b4fc918b423e5dbdcbc45206653133df16bf2125fd53bafef8f7850d2403564cf80f8a5d4abb4a8928ff1262f80f23c633ea109a18556d1871aff81cd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_overlapped.pyd

Filesize
30KB

MD5
97a40f53a81c39469cc7c8dd00f51b5d

SHA1
6c3916fe42e7977d8a6b53bfbc5a579abcf22a83

SHA256
11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f

SHA512
02af654ab73b6c8bf15a81c0e9071c8faf064c529b1439a2ab476e1026c860cf7d01472945112d4583e5da8e4c57f1df2700331440be80066dbb6a7e89e1c5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_queue.pyd

Filesize
24KB

MD5
0614691624f99748ef1d971419bdb80d

SHA1
39c52450ed7e31e935b5b0e49d03330f2057747d

SHA256
ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d

SHA512
184bc172c7bb8a1fb55c4c23950cbe5e0b5a3c96c1c555ed8476edf79c5c729ed297112ee01b45d771e5c0055d2dc402b566967d1900b5abf683ee8e668c5b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_socket.pyd

Filesize
41KB

MD5
04e7eb0b6861495233247ac5bb33a89a

SHA1
c4d43474e0b378a00845cca044f68e224455612a

SHA256
7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383

SHA512
d4ea0484363edf284ac08a1c3356cc3112d410dd80fe5010c1777acf88dbd830e9f668b593e252033d657a3431a79f7b68d09eb071d0c2ceb51632dbe9b8ed97

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_sqlite3.pyd

Filesize
54KB

MD5
d9eeeeacc3a586cf2dbf6df366f6029e

SHA1
4ff9fb2842a13e9371ce7894ec4fe331b6af9219

SHA256
67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29

SHA512
0b9f1d80fb92c796682dba94a75fbce0e4fbeaedccd50e21d42d4b9366463a830109a8cd4300aa62b41910655f8ca96ecc609ea8a1b84236250b6fd08c965830

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_ssl.pyd

Filesize
60KB

MD5
fd0f4aed22736098dc146936cbf0ad1d

SHA1
e520def83b8efdbca9dd4b384a15880b036ee0cf

SHA256
50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892

SHA512
c8f3c04d87da19041f28e1d474c8eb052fe8c03ffd88f0681ef4a2ffe29755cfd5b9c100a1b1d2fdb233cb0f70e367af500cbd3cd4ce77475f441f2b2aa0ab8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\_uuid.pyd

Filesize
21KB

MD5
3377ae26c2987cfee095dff160f2c86c

SHA1
0ca6aa60618950e6d91a7dea530a65a1cdf16625

SHA256
9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b

SHA512
8e408b84e2130ff48b8004154d1bdf6a08109d0b40f9fafb6f55e9f215e418e05dca819f411c802792a9d9936a55d6b90460121583e5568579a0fda6935852ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\aiohttp\_helpers.cp311-win_amd64.pyd

Filesize
26KB

MD5
580df94471407eb0eabe4f1bdb7645d5

SHA1
049b6518f159c02b0a3584c86ed78c31fe84b2aa

SHA256
83fddc339f13339aa17f872a17816b84f535b873b07500f9892ec105be0d6beb

SHA512
3fc02b48154120d93e85baa2e6ff4e4f728f06e7173c552c4fdb55a731fe506494cb4e9e33d1054876a1db59cf796c3a98c5bedbfcbba781e37a5d5074472b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\aiohttp\_http_parser.cp311-win_amd64.pyd

Filesize
80KB

MD5
1286f2b36ee759286a25ba58348ad300

SHA1
9d9448da7f20061431b3a261bef0f1b9fc5dd871

SHA256
c523606610296699a05b83cc3ab4c5eeb4a74596e4166f83a1405c89b4229244

SHA512
8bf9e78ec7755e6ee70257f2be006da854fac1f3fa3a4808f929319fecaef2bcf7355aedbabfdb5569e4b185356bd3be5b7a1c0085cfb3c2a2726034a9f7c9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\aiohttp\_http_writer.cp311-win_amd64.pyd

Filesize
24KB

MD5
b45a1db267ace9925422eb13a3f721d2

SHA1
83b8a6318f0f3f820fb0a6abf7b8e8bd4d09af19

SHA256
41085f597a17954b38b72e52c5c61cd605293bcaaed65964a317a5773b5d264d

SHA512
2bc5fb4ae64dd0c5465e8a7dcc8b3bca909e68b5a877f2084124a254215d0e1a65692519323def87a47fd71d76913d2c19904c417326f50254c04a2f8b15d935

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\aiohttp\_websocket.cp311-win_amd64.pyd

Filesize
20KB

MD5
031388d797d6bef0f9b1799b78f9398c

SHA1
cfbfe488e93a3881fb3fd53888c619aa001ad4cc

SHA256
8db41f035b34e3ddfd1c6361c25b73949d92f8e74f55fef075f7945852ca6266

SHA512
609202958836d5b39472bec86ee9d25d4d5d57b386aab1b7d78e0ac54061fc72ecc190c62deb55f159664db20f7973932d8f380a934baa1cc903776da5694c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\base_library.zip

Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.1MB

MD5
073606ea92928af7b2863782c0114949

SHA1
ec7b4dbf415af6a071a6ca3a0d4f4a0cf544515c

SHA256
9be10e3f170875a5b3e403f29d7241bf64957c01bfcae3504f5576578183610a

SHA512
5cd48348b475c9de7c2c8d85f36a1f8cf63ee5ee2bde60e2e5a1026f0e877b4c686ad07ab37c8ae37b46b719233b28aa699ce5a2fedd0247c7607da6e519a11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\frozenlist\_frozenlist.cp311-win_amd64.pyd

Filesize
35KB

MD5
15b0df96344baf6a4c72766721943e52

SHA1
a3666e88594d1ec97de23b9242f346c43a34c070

SHA256
abb6f497003738db2407b01dfa0abc61f6bc7fdb2452c52f76ab11f5430d844f

SHA512
4fbf295d0882646b8c4b3284f11331fb12767fd1404d78d3e4d88a434896058c2df05dd1a2d9c8ce696d2d3aad8c7251d00d95c399df2e8c11bb319f87a4385e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\libffi-8.dll

Filesize
24KB

MD5
decbba3add4c2246928ab385fb16a21e

SHA1
5f019eff11de3122ffa67a06d52d446a3448b75e

SHA256
4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d

SHA512
760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
eeaded775eabfaaede5ca025f55fd273

SHA1
8eefb3b9d85b4d5ad4033308f8af2a24e8792e02

SHA256
db4d6a74a3301788d32905b2ccc525e9a8e2219f1a36924464871cf211f115a0

SHA512
a6055d5604cc53428d89b308c223634cd94082be0ba4081513974e1826775d6e9fc26180c816d9a38fead89b5e04c5e7cf729c056bfae0ed74d6885c921b70ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\pyexpat.pyd

Filesize
86KB

MD5
fe0e32bfe3764ed5321454e1a01c81ec

SHA1
7690690df0a73bdcc54f0f04b674fc8a9a8f45fb

SHA256
b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92

SHA512
d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\select.pyd

Filesize
24KB

MD5
c39459806c712b3b3242f8376218c1e1

SHA1
85d254fb6cc5d6ed20a04026bff1158c8fd0a530

SHA256
7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9

SHA512
b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\sqlite3.dll

Filesize
608KB

MD5
895f001ae969364432372329caf08b6a

SHA1
4567fc6672501648b277fe83e6b468a7a2155ddf

SHA256
f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7

SHA512
05b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\unicodedata.pyd

Filesize
293KB

MD5
06a5e52caf03426218f0c08fc02cc6b8

SHA1
ae232c63620546716fbb97452d73948ebfd06b35

SHA256
118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a

SHA512
546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34482\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
40KB

MD5
9a8f969ecdf0c15734c1d582d2ae35d8

SHA1
a40691e81982f610a062e49a5ad29cffb5a2f5a8

SHA256
874e52cceae9a3c967bac7b628f4144c32e51fc77f519542fc1bac19045ecde8

SHA512
e0deb59abef7440f30effb1aab6295b5a50c817f685be30b21a3c453e3099b97fd71984e6ca6a6c6e0021abb6e906838566f402b00a11813e67a4e00b119619f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lonjrwgh.o3t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
72ac4d025b914a75130b50a1b778a18c

SHA1
c103a8951929ddbb6ce893182c9bec7f0af6f218

SHA256
eed14f9772ff9c8724e61a379bb47492edca879eaf147c16c930b79b7ef9cf62

SHA512
5e0450665869082ac96194af9b78f14bb1104252a5ad1781177d9e3ef0e27c71daf3e198a8f810cee9bb236de145f9755b109e1b26cc90ed0d5743bc3b3f738c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
11KB

MD5
0e1eb5978a8ee9373e75dd0da73dfdc6

SHA1
d54dc2bb47b4f4e28a832231c64cdef49325e77b

SHA256
41c38b303de8143546770d987168da3adbdf2241e00319f564530a6979d468d4

SHA512
1c287b1f49229eb3ff03c4d7fadb1d0ddc7ac2a9cdfcafd5e83ba0ad386d11d79b2b6a388dc5eef778c55e706ec64b96fa4441e28e63455f48671a9848330743

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
a61d5b93973f508c731bbef90454896a

SHA1
71cd4dd8b771f3f670588c05f964e5002d988450

SHA256
8b06b649f2c304a5eea8bd5aed60b3beae96ef3265a933c7c2317276f8e99c75

SHA512
7290e5de7840dc834897e6d01f0955e1b14f31d9194de53a707c070c477ea637f87491ecf6c9aeb627560c92dea01fa63d487ca6d32f8d60e36e71676a41cb44

Download Submit
memory/1448-430-0x00007FF9836B0000-0x00007FF9836C9000-memory.dmp

Filesize
100KB

Download
memory/1448-630-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp

Filesize
5.9MB

Download
memory/1448-411-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp

Filesize
5.9MB

Download
memory/1448-423-0x00007FF986890000-0x00007FF9868A5000-memory.dmp

Filesize
84KB

Download
memory/1448-428-0x00007FF9836F0000-0x00007FF983712000-memory.dmp

Filesize
136KB

Download
memory/1448-253-0x00007FF983BD0000-0x00007FF983BFE000-memory.dmp

Filesize
184KB

Download
memory/1448-245-0x00007FF986A80000-0x00007FF986AA4000-memory.dmp

Filesize
144KB

Download
memory/1448-271-0x00007FF982900000-0x00007FF982938000-memory.dmp

Filesize
224KB

Download
memory/1448-252-0x00007FF9839B0000-0x00007FF983B23000-memory.dmp

Filesize
1.4MB

Download
memory/1448-254-0x00007FF9821E0000-0x00007FF982298000-memory.dmp

Filesize
736KB

Download
memory/1448-256-0x00007FF986890000-0x00007FF9868A5000-memory.dmp

Filesize
84KB

Download
memory/1448-257-0x00007FF983990000-0x00007FF9839A2000-memory.dmp

Filesize
72KB

Download
memory/1448-261-0x00007FF9836F0000-0x00007FF983712000-memory.dmp

Filesize
136KB

Download
memory/1448-255-0x00007FF971050000-0x00007FF9713C5000-memory.dmp

Filesize
3.5MB

Download
memory/1448-263-0x00007FF9836B0000-0x00007FF9836C9000-memory.dmp

Filesize
100KB

Download
memory/1448-244-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp

Filesize
5.9MB

Download
memory/1448-243-0x00007FF970780000-0x00007FF970F21000-memory.dmp

Filesize
7.6MB

Download
memory/1448-214-0x00007FF983030000-0x00007FF98307D000-memory.dmp

Filesize
308KB

Download
memory/1448-210-0x00007FF9836B0000-0x00007FF9836C9000-memory.dmp

Filesize
100KB

Download
memory/1448-209-0x00007FF9836D0000-0x00007FF9836E7000-memory.dmp

Filesize
92KB

Download
memory/1448-208-0x00007FF9836F0000-0x00007FF983712000-memory.dmp

Filesize
136KB

Download
memory/1448-59-0x00007FF9878B0000-0x00007FF9878BF000-memory.dmp

Filesize
60KB

Download
memory/1448-108-0x00007FF983970000-0x00007FF983984000-memory.dmp

Filesize
80KB

Download
memory/1448-110-0x00007FF983950000-0x00007FF983964000-memory.dmp

Filesize
80KB

Download
memory/1448-192-0x00007FF970F30000-0x00007FF97104C000-memory.dmp

Filesize
1.1MB

Download
memory/1448-193-0x00007FF983940000-0x00007FF98394D000-memory.dmp

Filesize
52KB

Download
memory/1448-112-0x00007FF970F30000-0x00007FF97104C000-memory.dmp

Filesize
1.1MB

Download
memory/1448-116-0x00007FF9836F0000-0x00007FF983712000-memory.dmp

Filesize
136KB

Download
memory/1448-119-0x00007FF9839B0000-0x00007FF983B23000-memory.dmp

Filesize
1.4MB

Download
memory/1448-121-0x00007FF9836D0000-0x00007FF9836E7000-memory.dmp

Filesize
92KB

Download
memory/1448-1220-0x00007FF971050000-0x00007FF9713C5000-memory.dmp

Filesize
3.5MB

Download
memory/1448-1225-0x00007FF986A40000-0x00007FF986A59000-memory.dmp

Filesize
100KB

Download
memory/1448-1224-0x00007FF9878A0000-0x00007FF9878AD000-memory.dmp

Filesize
52KB

Download
memory/1448-1223-0x00007FF986A60000-0x00007FF986A79000-memory.dmp

Filesize
100KB

Download
memory/1448-1231-0x00007FF983010000-0x00007FF983021000-memory.dmp

Filesize
68KB

Download
memory/1448-1243-0x00007FF982FF0000-0x00007FF98300E000-memory.dmp

Filesize
120KB

Download
memory/1448-1246-0x00007FF983940000-0x00007FF98394D000-memory.dmp

Filesize
52KB

Download
memory/1448-1245-0x00007FF982900000-0x00007FF982938000-memory.dmp

Filesize
224KB

Download
memory/1448-1244-0x00007FF970780000-0x00007FF970F21000-memory.dmp

Filesize
7.6MB

Download
memory/1448-1242-0x00007FF983CF0000-0x00007FF983CFA000-memory.dmp

Filesize
40KB

Download
memory/1448-1241-0x00007FF983030000-0x00007FF98307D000-memory.dmp

Filesize
308KB

Download
memory/1448-1240-0x00007FF9836B0000-0x00007FF9836C9000-memory.dmp

Filesize
100KB

Download
memory/1448-1239-0x00007FF9836D0000-0x00007FF9836E7000-memory.dmp

Filesize
92KB

Download
memory/1448-1238-0x00007FF9836F0000-0x00007FF983712000-memory.dmp

Filesize
136KB

Download
memory/1448-1237-0x00007FF970F30000-0x00007FF97104C000-memory.dmp

Filesize
1.1MB

Download
memory/1448-1236-0x00007FF983950000-0x00007FF983964000-memory.dmp

Filesize
80KB

Download
memory/1448-1235-0x00007FF983970000-0x00007FF983984000-memory.dmp

Filesize
80KB

Download
memory/1448-1234-0x00007FF983990000-0x00007FF9839A2000-memory.dmp

Filesize
72KB

Download
memory/1448-1233-0x00007FF986890000-0x00007FF9868A5000-memory.dmp

Filesize
84KB

Download
memory/1448-1232-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp

Filesize
5.9MB

Download
memory/1448-1230-0x00007FF9821E0000-0x00007FF982298000-memory.dmp

Filesize
736KB

Download
memory/1448-1229-0x00007FF983BD0000-0x00007FF983BFE000-memory.dmp

Filesize
184KB

Download
memory/1448-1228-0x00007FF9839B0000-0x00007FF983B23000-memory.dmp

Filesize
1.4MB

Download
memory/1448-1227-0x00007FF983D00000-0x00007FF983D23000-memory.dmp

Filesize
140KB

Download
memory/1448-1226-0x00007FF986A10000-0x00007FF986A3D000-memory.dmp

Filesize
180KB

Download
memory/1448-1222-0x00007FF9878B0000-0x00007FF9878BF000-memory.dmp

Filesize
60KB

Download
memory/1448-1221-0x00007FF986A80000-0x00007FF986AA4000-memory.dmp

Filesize
144KB

Download
memory/1448-144-0x00007FF982900000-0x00007FF982938000-memory.dmp

Filesize
224KB

Download
memory/1448-124-0x00007FF983BD0000-0x00007FF983BFE000-memory.dmp

Filesize
184KB

Download
memory/1448-125-0x00007FF9836B0000-0x00007FF9836C9000-memory.dmp

Filesize
100KB

Download
memory/1448-131-0x0000027100400000-0x0000027100775000-memory.dmp

Filesize
3.5MB

Download
memory/1448-132-0x00007FF983030000-0x00007FF98307D000-memory.dmp

Filesize
308KB

Download
memory/1448-133-0x00007FF983CF0000-0x00007FF983CFA000-memory.dmp

Filesize
40KB

Download
memory/1448-135-0x00007FF971050000-0x00007FF9713C5000-memory.dmp

Filesize
3.5MB

Download
memory/1448-136-0x00007FF983010000-0x00007FF983021000-memory.dmp

Filesize
68KB

Download
memory/1448-138-0x00007FF986890000-0x00007FF9868A5000-memory.dmp

Filesize
84KB

Download
memory/1448-139-0x00007FF982FF0000-0x00007FF98300E000-memory.dmp

Filesize
120KB

Download
memory/1448-142-0x00007FF970780000-0x00007FF970F21000-memory.dmp

Filesize
7.6MB

Download
memory/1448-128-0x00007FF9821E0000-0x00007FF982298000-memory.dmp

Filesize
736KB

Download
memory/1448-115-0x00007FF983D00000-0x00007FF983D23000-memory.dmp

Filesize
140KB

Download
memory/1448-102-0x00007FF986890000-0x00007FF9868A5000-memory.dmp

Filesize
84KB

Download
memory/1448-104-0x00007FF986A60000-0x00007FF986A79000-memory.dmp

Filesize
100KB

Download
memory/1448-105-0x00007FF983990000-0x00007FF9839A2000-memory.dmp

Filesize
72KB

Download
memory/1448-86-0x00007FF986A10000-0x00007FF986A3D000-memory.dmp

Filesize
180KB

Download
memory/1448-96-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp

Filesize
5.9MB

Download
memory/1448-97-0x00007FF9821E0000-0x00007FF982298000-memory.dmp

Filesize
736KB

Download
memory/1448-99-0x00007FF971050000-0x00007FF9713C5000-memory.dmp

Filesize
3.5MB

Download
memory/1448-100-0x00007FF986A80000-0x00007FF986AA4000-memory.dmp

Filesize
144KB

Download
memory/1448-98-0x0000027100400000-0x0000027100775000-memory.dmp

Filesize
3.5MB

Download
memory/1448-92-0x00007FF983BD0000-0x00007FF983BFE000-memory.dmp

Filesize
184KB

Download
memory/1448-90-0x00007FF9839B0000-0x00007FF983B23000-memory.dmp

Filesize
1.4MB

Download
memory/1448-88-0x00007FF983D00000-0x00007FF983D23000-memory.dmp

Filesize
140KB

Download
memory/1448-84-0x00007FF986A40000-0x00007FF986A59000-memory.dmp

Filesize
100KB

Download
memory/1448-80-0x00007FF986A60000-0x00007FF986A79000-memory.dmp

Filesize
100KB

Download
memory/1448-82-0x00007FF9878A0000-0x00007FF9878AD000-memory.dmp

Filesize
52KB

Download
memory/1448-57-0x00007FF986A80000-0x00007FF986AA4000-memory.dmp

Filesize
144KB

Download
memory/1448-49-0x00007FF9713D0000-0x00007FF9719B8000-memory.dmp

Filesize
5.9MB

Download
memory/2480-200-0x000002447F3F0000-0x000002447F412000-memory.dmp

Filesize
136KB

Download