Analysis Overview
Threat Level: Known bad
The file https://onedrive.live.com/?authkey=%21AFVLIrnz4DEkhjo&id=882D07C9D8627858%21107&cid=882D07C9D8627858&parId=root&parQt=sharedby&o=OneUp was found to be: Known bad.
Malicious Activity Summary
Exela Stealer
Exelastealer family
Grants admin privileges
Modifies Windows Firewall
Downloads MZ/PE file
Loads dropped DLL
Executes dropped EXE
Clipboard Data
Looks up external IP address via web service
Network Service Discovery
UPX packed file
Hide Artifacts: Hidden Files and Directories
Enumerates processes with tasklist
Launches sc.exe
Browser Information Discovery
System Network Connections Discovery
Permission Groups Discovery: Local Groups
Detects Pyinstaller
System Network Configuration Discovery: Wi-Fi Discovery
Runs net.exe
Suspicious use of WriteProcessMemory
Detects videocard installed
Enumerates system info in registry
Gathers network information
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Views/modifies file attributes
Suspicious behavior: EnumeratesProcesses
Collects information from the system
Kills process with taskkill
Gathers system information
NTFS ADS
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-04 01:22
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-04 01:22
Reported
2024-11-04 01:23
Platform
win10v2004-20241007-en
Max time kernel
46s
Max time network
52s
Command Line
Signatures
Exela Stealer
Exelastealer family
Grants admin privileges
Downloads MZ/PE file
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Clipboard Data
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\Exela.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\Exela.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\Exela.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\Exela.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\Exela.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\Exela.exe | N/A |
Loads dropped DLL
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Network Service Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
| N/A | N/A | C:\Windows\system32\ARP.EXE | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
| N/A | N/A | C:\Windows\system32\tasklist.exe | N/A |
Hide Artifacts: Hidden Files and Directories
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\sc.exe | N/A |
Browser Information Discovery
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Permission Groups Discovery: Local Groups
System Network Configuration Discovery: Wi-Fi Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\cmd.exe | N/A |
System Network Connections Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NETSTAT.EXE | N/A |
Collects information from the system
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Detects videocard installed
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Gathers network information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\ipconfig.exe | N/A |
| N/A | N/A | C:\Windows\system32\NETSTAT.EXE | N/A |
Gathers system information
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\systeminfo.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskkill.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\Unconfirmed 639209.crdownload:SmartScreen | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Runs net.exe
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\tasklist.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://onedrive.live.com/?authkey=%21AFVLIrnz4DEkhjo&id=882D07C9D8627858%21107&cid=882D07C9D8627858&parId=root&parQt=sharedby&o=OneUp
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7a3846f8,0x7fff7a384708,0x7fff7a384718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3344 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5156 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6160 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,13524555403125845507,8449189085913457225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4656 /prefetch:8
C:\Users\Admin\Downloads\Exela.exe
"C:\Users\Admin\Downloads\Exela.exe"
C:\Users\Admin\Downloads\Exela.exe
"C:\Users\Admin\Downloads\Exela.exe"
C:\Users\Admin\Downloads\Exela.exe
"C:\Users\Admin\Downloads\Exela.exe"
C:\Users\Admin\Downloads\Exela.exe
"C:\Users\Admin\Downloads\Exela.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "gdb --version"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get Manufacturer
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
C:\Windows\System32\Wbem\WMIC.exe
wmic path Win32_ComputerSystem get Manufacturer
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
C:\Windows\system32\attrib.exe
attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
C:\Users\Admin\Downloads\Exela.exe
"C:\Users\Admin\Downloads\Exela.exe"
C:\Windows\system32\tasklist.exe
tasklist
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1788"
C:\Users\Admin\Downloads\Exela.exe
"C:\Users\Admin\Downloads\Exela.exe"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 1788
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3872"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3872
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4280"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4280
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3600"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3600
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1924"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 1924
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4092"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4092
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4424"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4424
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3392"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 3392
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1052"
C:\Windows\system32\taskkill.exe
taskkill /F /PID 1052
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4880"
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\taskkill.exe
taskkill /F /PID 4880
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
C:\Windows\system32\cmd.exe
cmd.exe /c chcp
C:\Windows\system32\tasklist.exe
tasklist /FO LIST
C:\Windows\system32\chcp.com
chcp
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe Get-Clipboard
C:\Windows\system32\cmd.exe
cmd.exe /c chcp
C:\Windows\system32\chcp.com
chcp
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
C:\Windows\system32\systeminfo.exe
systeminfo
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Windows\system32\HOSTNAME.EXE
hostname
C:\Windows\System32\Wbem\WMIC.exe
wmic logicaldisk get caption,description,providername
C:\Windows\system32\net.exe
net user
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user
C:\Windows\system32\query.exe
query user
C:\Windows\system32\quser.exe
"C:\Windows\system32\quser.exe"
C:\Windows\system32\net.exe
net localgroup
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup
C:\Windows\system32\net.exe
net localgroup administrators
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup administrators
C:\Windows\system32\net.exe
net user guest
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user guest
C:\Windows\system32\net.exe
net user administrator
C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user administrator
C:\Windows\System32\Wbem\WMIC.exe
wmic startup get caption,command
C:\Windows\system32\tasklist.exe
tasklist /svc
C:\Windows\system32\ipconfig.exe
ipconfig /all
C:\Windows\system32\ROUTE.EXE
route print
C:\Windows\system32\ARP.EXE
arp -a
C:\Windows\system32\NETSTAT.EXE
netstat -ano
C:\Windows\system32\sc.exe
sc query type= service state= all
C:\Windows\system32\netsh.exe
netsh firewall show state
C:\Windows\system32\netsh.exe
netsh firewall show config
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | onedrive.live.com | udp |
| US | 13.107.139.11:443 | onedrive.live.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | res-1.cdn.office.net | udp |
| GB | 2.19.161.28:443 | res-1.cdn.office.net | tcp |
| US | 8.8.8.8:53 | 11.139.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.161.19.2.in-addr.arpa | udp |
| GB | 2.19.161.28:443 | res-1.cdn.office.net | tcp |
| US | 8.8.8.8:53 | p.sfx.ms | udp |
| US | 8.8.8.8:53 | m365cdn.nel.measure.office.net | udp |
| IE | 20.105.125.100:443 | p.sfx.ms | tcp |
| GB | 2.19.117.138:443 | m365cdn.nel.measure.office.net | tcp |
| US | 8.8.8.8:53 | api.onedrive.com | udp |
| US | 13.107.42.12:443 | api.onedrive.com | tcp |
| US | 8.8.8.8:53 | 100.125.105.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.42.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | skyapi.onedrive.live.com | udp |
| US | 8.8.8.8:53 | ecs.office.com | udp |
| US | 52.113.194.132:443 | ecs.office.com | tcp |
| US | 13.107.42.12:443 | skyapi.onedrive.live.com | tcp |
| US | 8.8.8.8:53 | 132.194.113.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | storage.live.com | udp |
| NL | 20.135.25.0:443 | storage.live.com | tcp |
| US | 8.8.8.8:53 | browser.events.data.microsoft.com | udp |
| US | 20.189.173.14:443 | browser.events.data.microsoft.com | tcp |
| US | 20.189.173.14:443 | browser.events.data.microsoft.com | tcp |
| US | 8.8.8.8:53 | 0.25.135.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 20.189.173.14:443 | browser.events.data.microsoft.com | tcp |
| US | 20.189.173.14:443 | browser.events.data.microsoft.com | tcp |
| US | 8.8.8.8:53 | 14.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 2yhyrg.bn.files.1drv.com | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| N/A | 127.0.0.1:58856 | tcp | |
| N/A | 127.0.0.1:58905 | tcp | |
| N/A | 127.0.0.1:58958 | tcp | |
| N/A | 127.0.0.1:58985 | tcp | |
| N/A | 127.0.0.1:58987 | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 36988ca14952e1848e81a959880ea217 |
| SHA1 | a0482ef725657760502c2d1a5abe0bb37aebaadb |
| SHA256 | d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6 |
| SHA512 | d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173 |
\??\pipe\LOCAL\crashpad_1788_OXTDRTZJTFFHNACE
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | fab8d8d865e33fe195732aa7dcb91c30 |
| SHA1 | 2637e832f38acc70af3e511f5eba80fbd7461f2c |
| SHA256 | 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea |
| SHA512 | 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c9ca70a14f2383fbe4c3b890c3960353 |
| SHA1 | bcc1d85fb49e96390ed7258a8c70d351603f8555 |
| SHA256 | 689d16cd3b08fe9029ccb9d9ed57ab5d458715da179047639c2ec9d433264897 |
| SHA512 | df0627e2d2686a348b85aecd7d51fb0b9fbe09cc812ef134765d54fd7c41f8d470dcb906f648d516e7ddab89ee70df6c28f9569fdebb6dae478c217e0629b613 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 80464faf1a9893390e2fa0c47f45e596 |
| SHA1 | fcb922c371587a170349a5e55a878cf9a5882b9b |
| SHA256 | 79f92690a8a0b7a824594840c4e72240c1d32a2334de38f409d8d44c7756aa31 |
| SHA512 | 0abec5102cce006faea3a1a227ff0d8a5b219e8132a85da573b8de4b3607d1ca174fd98171c2d8a6407306dd347232ab35e1f5e59654a0dfc78a7767604c165d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | fc52e7f282ad0467e37025269e20a990 |
| SHA1 | 3e8abbfb0b87123f1862f07c6ace1c66d7e21a1c |
| SHA256 | 928210852d661b459f82a30e206d089bf98ecd37db15ffe96b62ba287e209b10 |
| SHA512 | b2e6a4268c3d0fec46d1250ed4407e678f9192e690bb4eee60f21a12020f406951159cd7e682ee39213de7a6afcda26e0f6d5e281262dd5f3747420766a66e38 |
C:\Users\Admin\Downloads\Unconfirmed 639209.crdownload
| MD5 | 14a0bd7adb2e3b11987f34053a872ba5 |
| SHA1 | eb2f42b048cb86aeb2ed4def6a9ec50b653a66eb |
| SHA256 | 2ca6a42c8eafc733dae514e08ed33f2ae2cd2c1bfcba04ef94174c46b9ae7251 |
| SHA512 | 7bf7cc977c3cca01312dff1ac9562f9df6eb72ee727583cf5ed8320dc6750b563caeacaeac7797b5d7f529621fe59d51b2f5ab4395207a53de31fafc265a3556 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | d3f0cb29a9a6a4862010c1224a083b58 |
| SHA1 | 42150e5d26fa9c01540935d28e23ebb0638f1be2 |
| SHA256 | 2ca0bdebfadf3834e9c173f0eb92016778c86b9a694652efacceb5598adbdd0d |
| SHA512 | f59f3ee94b0b767fb511558ccf24af79409ecfc59ca1abdeb89a7c4f2adb11183848c61292a8f8ce501e05085fcbc2f2abfcb3bd6cb3ef581c2d1bf1160cc1d6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | c56669407a92ccbf820040cba0ef7021 |
| SHA1 | 6867a98c8ce8726a89e35cd9a468ce48570de4b0 |
| SHA256 | f6f3641d8aa95863cdee1621493f33a694c0cc9437d446026660e3b09b6d6357 |
| SHA512 | f120514635b0269d4b803baf102e03fc71b5e97542d3cb56e205de382796f53adc8b0363d36154c78d250108644565cb7a2ec4923a3c270310633f4b7c58b494 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\ucrtbase.dll
| MD5 | 0e0bac3d1dcc1833eae4e3e4cf83c4ef |
| SHA1 | 4189f4459c54e69c6d3155a82524bda7549a75a6 |
| SHA256 | 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae |
| SHA512 | a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\python313.dll
| MD5 | d99ac8bac1343105b642295397ca2ffc |
| SHA1 | 93fd73c1fb9ee99ddc66d38885a657cf81f62836 |
| SHA256 | 9116e56cedeb1c4ae82b4bde560f2fe0b83a16764865012cbf5501673d3c5536 |
| SHA512 | 89d30bc84978daf469008ffc347cbd3e189f1df2c1a302dedfc2b700267cc28c671c7c35b5e95ba29a300e7fda75ccfc720d2173ea6db6eb69978772c0b8339f |
memory/6020-365-0x00007FFF67950000-0x00007FFF67FB3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI55282\VCRUNTIME140.dll
| MD5 | 862f820c3251e4ca6fc0ac00e4092239 |
| SHA1 | ef96d84b253041b090c243594f90938e9a487a9a |
| SHA256 | 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153 |
| SHA512 | 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\libffi-8.dll
| MD5 | 0d1c6b92d091cef3142e32ac4e0cc12e |
| SHA1 | 440dad5af38035cb0984a973e1f266deff2bd7fc |
| SHA256 | 11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6 |
| SHA512 | 5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233 |
memory/6020-381-0x00007FFF69990000-0x00007FFF699BB000-memory.dmp
memory/6020-380-0x00007FFF71CE0000-0x00007FFF71CF9000-memory.dmp
memory/6020-379-0x00007FFF79B10000-0x00007FFF79B1F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI55282\_lzma.pyd
| MD5 | 4c91d0d2bd873740d3b835cd29ba4806 |
| SHA1 | 76a4a59ea939d87177dc2e600a444bc908729d9a |
| SHA256 | 95578954b3282a5ed9c2db1e214cf3b4459afd955eabc898a896344b02908aba |
| SHA512 | f551a17495b7620dbf6d60cf40c29f6a4ceb5afee31472e398492491308023e7401a334c50883f37b60767d209801be4611a6f57ed16a419b06ab8ad5c967565 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\_bz2.pyd
| MD5 | 76dda2f9e6796b85d4c80b7a49585bd0 |
| SHA1 | 9d8eb7052fd218d75094c87c669a7e4d6d1614b9 |
| SHA256 | 1ddc1386f8bec84b4c7d17e75a84fd2b7abef20bd3d5cdc648b3884252e78ca3 |
| SHA512 | 602bfb0b42d3f8184f15082b61692796c18715c9581dbc840069209a2550545bb4af54e35c1f971a6a9a9830b94fb491f4c9f8d5f4899cf1b534ee6388505019 |
memory/6020-373-0x00007FFF699C0000-0x00007FFF699E7000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI55282\_ctypes.pyd
| MD5 | 83f2a420d3a54dc73dc553faead3bbd4 |
| SHA1 | 954525c475713acc04fa2116191bd5a914cd881a |
| SHA256 | b50b87720095fe7ed8dfad73f7a6a0bbeb408a24b561a2cfd7e3b333f87bed90 |
| SHA512 | 21a80a2a6e3ca2e87df87bf3c34f0a61be441ca5d7bcb9fe7d35dfbce17a02ec04153e72864b284c001f6edcf4f7260476b21c2881614d0f632eeaa34656b1ac |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\python3.dll
| MD5 | 16855ebef31c5b1ebe767f1c617645b3 |
| SHA1 | 315521f3a748abfa35cd4d48e8dd09d0556d989b |
| SHA256 | a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4 |
| SHA512 | c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-crt-filesystem-l1-1-0.dll
| MD5 | 5107487b726bdcc7b9f7e4c2ff7f907c |
| SHA1 | ebc46221d3c81a409fab9815c4215ad5da62449c |
| SHA256 | 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade |
| SHA512 | a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-crt-environment-l1-1-0.dll
| MD5 | f9235935dd3ba2aa66d3aa3412accfbf |
| SHA1 | 281e548b526411bcb3813eb98462f48ffaf4b3eb |
| SHA256 | 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200 |
| SHA512 | ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-crt-convert-l1-1-0.dll
| MD5 | edf71c5c232f5f6ef3849450f2100b54 |
| SHA1 | ed46da7d59811b566dd438fa1d09c20f5dc493ce |
| SHA256 | b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc |
| SHA512 | 481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a |
memory/6020-412-0x00007FFF79AD0000-0x00007FFF79ADD000-memory.dmp
memory/6020-411-0x00007FFF696C0000-0x00007FFF696D9000-memory.dmp
memory/6020-415-0x00007FFF69690000-0x00007FFF696A4000-memory.dmp
memory/6020-414-0x00007FFF71730000-0x00007FFF7173F000-memory.dmp
memory/6020-413-0x00007FFF73E30000-0x00007FFF73E3D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-crt-conio-l1-1-0.dll
| MD5 | d4fba5a92d68916ec17104e09d1d9d12 |
| SHA1 | 247dbc625b72ffb0bf546b17fb4de10cad38d495 |
| SHA256 | 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5 |
| SHA512 | d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-util-l1-1-0.dll
| MD5 | 0f129611a4f1e7752f3671c9aa6ea736 |
| SHA1 | 40c07a94045b17dae8a02c1d2b49301fad231152 |
| SHA256 | 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f |
| SHA512 | 6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae |
memory/6020-416-0x00007FFF67410000-0x00007FFF67943000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | d12403ee11359259ba2b0706e5e5111c |
| SHA1 | 03cc7827a30fd1dee38665c0cc993b4b533ac138 |
| SHA256 | f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781 |
| SHA512 | 9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-sysinfo-l1-1-0.dll
| MD5 | fd46c3f6361e79b8616f56b22d935a53 |
| SHA1 | 107f488ad966633579d8ec5eb1919541f07532ce |
| SHA256 | 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df |
| SHA512 | 3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-synch-l1-2-0.dll
| MD5 | 1281e9d1750431d2fe3b480a8175d45c |
| SHA1 | bc982d1c750b88dcb4410739e057a86ff02d07ef |
| SHA256 | 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa |
| SHA512 | a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-synch-l1-1-0.dll
| MD5 | 225d9f80f669ce452ca35e47af94893f |
| SHA1 | 37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50 |
| SHA256 | 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232 |
| SHA512 | 2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b |
memory/6020-418-0x00007FFF69650000-0x00007FFF69684000-memory.dmp
memory/6020-421-0x00007FFF69990000-0x00007FFF699BB000-memory.dmp
memory/6020-423-0x00007FFF672D0000-0x00007FFF672F5000-memory.dmp
memory/6020-424-0x00007FFF67150000-0x00007FFF672CF000-memory.dmp
memory/6020-422-0x00007FFF67300000-0x00007FFF67336000-memory.dmp
memory/6020-425-0x00007FFF669C0000-0x00007FFF6714A000-memory.dmp
memory/6020-420-0x00007FFF699C0000-0x00007FFF699E7000-memory.dmp
memory/6020-417-0x00007FFF67950000-0x00007FFF67FB3000-memory.dmp
memory/6020-419-0x00007FFF67340000-0x00007FFF6740E000-memory.dmp
memory/6020-432-0x00007FFF66830000-0x00007FFF668E3000-memory.dmp
memory/6020-433-0x00007FFF67410000-0x00007FFF67943000-memory.dmp
memory/6020-434-0x00007FFF66810000-0x00007FFF6682B000-memory.dmp
memory/6020-431-0x00007FFF69690000-0x00007FFF696A4000-memory.dmp
memory/6020-430-0x00007FFF668F0000-0x00007FFF66912000-memory.dmp
memory/6020-429-0x00007FFF66920000-0x00007FFF66934000-memory.dmp
memory/6020-428-0x00007FFF66940000-0x00007FFF66952000-memory.dmp
memory/6020-427-0x00007FFF66960000-0x00007FFF66976000-memory.dmp
memory/6020-426-0x00007FFF66980000-0x00007FFF669B8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-string-l1-1-0.dll
| MD5 | 2666581584ba60d48716420a6080abda |
| SHA1 | c103f0ea32ebbc50f4c494bce7595f2b721cb5ad |
| SHA256 | 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328 |
| SHA512 | befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-rtlsupport-l1-1-0.dll
| MD5 | a0c2dbe0f5e18d1add0d1ba22580893b |
| SHA1 | 29624df37151905467a223486500ed75617a1dfd |
| SHA256 | 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f |
| SHA512 | 3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-profile-l1-1-0.dll
| MD5 | f3ff2d544f5cd9e66bfb8d170b661673 |
| SHA1 | 9e18107cfcd89f1bbb7fdaf65234c1dc8e614add |
| SHA256 | e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f |
| SHA512 | 184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 517eb9e2cb671ae49f99173d7f7ce43f |
| SHA1 | 4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab |
| SHA256 | 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54 |
| SHA512 | 492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-processthreads-l1-1-0.dll
| MD5 | c3632083b312c184cbdd96551fed5519 |
| SHA1 | a93e8e0af42a144009727d2decb337f963a9312e |
| SHA256 | be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125 |
| SHA512 | 8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-processenvironment-l1-1-0.dll
| MD5 | 0462e22f779295446cd0b63e61142ca5 |
| SHA1 | 616a325cd5b0971821571b880907ce1b181126ae |
| SHA256 | 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e |
| SHA512 | 07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-namedpipe-l1-1-0.dll
| MD5 | 321a3ca50e80795018d55a19bf799197 |
| SHA1 | df2d3c95fb4cbb298d255d342f204121d9d7ef7f |
| SHA256 | 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f |
| SHA512 | 3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-memory-l1-1-0.dll
| MD5 | 3c38aac78b7ce7f94f4916372800e242 |
| SHA1 | c793186bcf8fdb55a1b74568102b4e073f6971d6 |
| SHA256 | 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d |
| SHA512 | c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 724223109e49cb01d61d63a8be926b8f |
| SHA1 | 072a4d01e01dbbab7281d9bd3add76f9a3c8b23b |
| SHA256 | 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210 |
| SHA512 | 19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-libraryloader-l1-1-0.dll
| MD5 | 1f2a00e72bc8fa2bd887bdb651ed6de5 |
| SHA1 | 04d92e41ce002251cc09c297cf2b38c4263709ea |
| SHA256 | 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142 |
| SHA512 | 8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-interlocked-l1-1-0.dll
| MD5 | c6024cc04201312f7688a021d25b056d |
| SHA1 | 48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd |
| SHA256 | 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500 |
| SHA512 | d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-heap-l1-1-0.dll
| MD5 | accc640d1b06fb8552fe02f823126ff5 |
| SHA1 | 82ccc763d62660bfa8b8a09e566120d469f6ab67 |
| SHA256 | 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f |
| SHA512 | 6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-handle-l1-1-0.dll
| MD5 | e89cdcd4d95cda04e4abba8193a5b492 |
| SHA1 | 5c0aee81f32d7f9ec9f0650239ee58880c9b0337 |
| SHA256 | 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238 |
| SHA512 | 55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-file-l2-1-0.dll
| MD5 | bfffa7117fd9b1622c66d949bac3f1d7 |
| SHA1 | 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2 |
| SHA256 | 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e |
| SHA512 | b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-file-l1-2-0.dll
| MD5 | 1c58526d681efe507deb8f1935c75487 |
| SHA1 | 0e6d328faf3563f2aae029bc5f2272fb7a742672 |
| SHA256 | ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2 |
| SHA512 | 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-file-l1-1-0.dll
| MD5 | efad0ee0136532e8e8402770a64c71f9 |
| SHA1 | cda3774fe9781400792d8605869f4e6b08153e55 |
| SHA256 | 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed |
| SHA512 | 69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-errorhandling-l1-1-0.dll
| MD5 | eb0978a9213e7f6fdd63b2967f02d999 |
| SHA1 | 9833f4134f7ac4766991c918aece900acfbf969f |
| SHA256 | ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e |
| SHA512 | 6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-debug-l1-1-0.dll
| MD5 | 33bbece432f8da57f17bf2e396ebaa58 |
| SHA1 | 890df2dddfdf3eeccc698312d32407f3e2ec7eb1 |
| SHA256 | 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e |
| SHA512 | 619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-datetime-l1-1-0.dll
| MD5 | cfe0c1dfde224ea5fed9bd5ff778a6e0 |
| SHA1 | 5150e7edd1293e29d2e4d6bb68067374b8a07ce6 |
| SHA256 | 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e |
| SHA512 | b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\api-ms-win-core-console-l1-1-0.dll
| MD5 | e8b9d74bfd1f6d1cc1d99b24f44da796 |
| SHA1 | a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452 |
| SHA256 | b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59 |
| SHA512 | b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27 |
C:\Users\Admin\AppData\Local\Temp\_MEI55282\base_library.zip
| MD5 | a9cbd0455b46c7d14194d1f18ca8719e |
| SHA1 | e1b0c30bccd9583949c247854f617ac8a14cbac7 |
| SHA256 | df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19 |
| SHA512 | b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528 |
memory/6020-471-0x00007FFF672D0000-0x00007FFF672F5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_MEI17322\attrs-24.2.0.dist-info\INSTALLER
| MD5 | 365c9bfeb7d89244f2ce01c1de44cb85 |
| SHA1 | d7a03141d5d6b1e88b6b59ef08b6681df212c599 |
| SHA256 | ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508 |
| SHA512 | d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1 |
memory/6020-470-0x00007FFF66020000-0x00007FFF6603E000-memory.dmp
memory/6020-543-0x00007FFF67150000-0x00007FFF672CF000-memory.dmp
memory/5884-553-0x00007FFF657D0000-0x00007FFF65E33000-memory.dmp
memory/6020-469-0x00007FFF664D0000-0x00007FFF664E1000-memory.dmp
memory/6020-468-0x00007FFF66780000-0x00007FFF667CD000-memory.dmp
memory/5884-555-0x00007FFF69700000-0x00007FFF6970F000-memory.dmp
memory/5884-554-0x00007FFF69710000-0x00007FFF69737000-memory.dmp
memory/6020-467-0x00007FFF667D0000-0x00007FFF667E8000-memory.dmp
memory/6020-556-0x00007FFF669C0000-0x00007FFF6714A000-memory.dmp
memory/5884-560-0x00007FFF657B0000-0x00007FFF657C9000-memory.dmp
memory/5884-563-0x00007FFF65730000-0x00007FFF6573F000-memory.dmp
memory/5884-565-0x00007FFF65700000-0x00007FFF65714000-memory.dmp
memory/6020-564-0x00007FFF66830000-0x00007FFF668E3000-memory.dmp
memory/5884-566-0x00007FFF651C0000-0x00007FFF656F3000-memory.dmp
memory/6020-562-0x00007FFF66960000-0x00007FFF66976000-memory.dmp
memory/5884-561-0x00007FFF65760000-0x00007FFF65779000-memory.dmp
memory/5884-559-0x00007FFF65740000-0x00007FFF6574D000-memory.dmp
memory/5884-558-0x00007FFF65750000-0x00007FFF6575D000-memory.dmp
memory/5884-557-0x00007FFF65780000-0x00007FFF657AB000-memory.dmp
memory/6020-466-0x00007FFF667F0000-0x00007FFF66806000-memory.dmp
memory/5884-569-0x00007FFF65070000-0x00007FFF6513E000-memory.dmp
memory/5884-568-0x00007FFF65140000-0x00007FFF65174000-memory.dmp
memory/5884-570-0x00007FFF65010000-0x00007FFF65046000-memory.dmp
memory/5884-573-0x00007FFF64E90000-0x00007FFF6500F000-memory.dmp
memory/5884-572-0x00007FFF657D0000-0x00007FFF65E33000-memory.dmp
memory/5884-576-0x00007FFF63C30000-0x00007FFF643BA000-memory.dmp
memory/5884-571-0x00007FFF65190000-0x00007FFF651B5000-memory.dmp
memory/5884-577-0x00007FFF64E50000-0x00007FFF64E88000-memory.dmp
memory/5884-584-0x00007FFF64DC0000-0x00007FFF64DDB000-memory.dmp
memory/5884-585-0x00007FFF651C0000-0x00007FFF656F3000-memory.dmp
memory/5884-583-0x00007FFF65700000-0x00007FFF65714000-memory.dmp
memory/5884-582-0x00007FFF64E30000-0x00007FFF64E42000-memory.dmp
memory/5884-581-0x00007FFF64A30000-0x00007FFF64AE3000-memory.dmp
memory/5884-580-0x00007FFF64DE0000-0x00007FFF64E02000-memory.dmp
memory/5884-579-0x00007FFF64E10000-0x00007FFF64E24000-memory.dmp
memory/5884-578-0x00007FFF65050000-0x00007FFF65066000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | afbb03306a55e435c660a1bfb2198052 |
| SHA1 | 25ff0ccb7266c01bb5672d8732161a6b82591d87 |
| SHA256 | 5135eefd40f49620ccd57936189ace12aefe9318c0601c598447f7a28e647b2b |
| SHA512 | 1762e612ca05a05b7f817fa20e45744d59afbf4e1e0db43624ee03574b7fec2ecdff694a9c902299b90bc65f5f6d3afcb95f49dd9dbfa9443cd0d7ba0e65d935 |
memory/5884-602-0x00007FFF64D60000-0x00007FFF64D71000-memory.dmp
memory/5884-599-0x00007FFF65140000-0x00007FFF65174000-memory.dmp
memory/5884-600-0x00007FFF64D80000-0x00007FFF64D98000-memory.dmp
memory/5884-601-0x00007FFF649E0000-0x00007FFF64A2D000-memory.dmp
memory/5884-598-0x00007FFF65070000-0x00007FFF6513E000-memory.dmp
memory/5884-597-0x00007FFF64DA0000-0x00007FFF64DB6000-memory.dmp
memory/5884-615-0x00007FFF649C0000-0x00007FFF649DE000-memory.dmp
memory/5884-635-0x00007FFF65760000-0x00007FFF65779000-memory.dmp
memory/5884-634-0x00007FFF64E30000-0x00007FFF64E42000-memory.dmp
memory/5884-632-0x00007FFF64D60000-0x00007FFF64D71000-memory.dmp
memory/5884-631-0x00007FFF649E0000-0x00007FFF64A2D000-memory.dmp
memory/5884-630-0x00007FFF64D80000-0x00007FFF64D98000-memory.dmp
memory/5884-629-0x00007FFF64DA0000-0x00007FFF64DB6000-memory.dmp
memory/5884-628-0x00007FFF64DC0000-0x00007FFF64DDB000-memory.dmp
memory/5884-626-0x00007FFF64DE0000-0x00007FFF64E02000-memory.dmp
memory/5884-621-0x00007FFF63C30000-0x00007FFF643BA000-memory.dmp
memory/5884-620-0x00007FFF64E90000-0x00007FFF6500F000-memory.dmp
memory/5884-619-0x00007FFF65190000-0x00007FFF651B5000-memory.dmp
memory/5884-618-0x00007FFF65010000-0x00007FFF65046000-memory.dmp
memory/5884-627-0x00007FFF64A30000-0x00007FFF64AE3000-memory.dmp
memory/5884-616-0x00007FFF65140000-0x00007FFF65174000-memory.dmp
memory/5884-613-0x00007FFF651C0000-0x00007FFF656F3000-memory.dmp
memory/5884-614-0x00007FFF64E90000-0x00007FFF6500F000-memory.dmp
memory/5884-612-0x00007FFF65700000-0x00007FFF65714000-memory.dmp
memory/5884-611-0x00007FFF65730000-0x00007FFF6573F000-memory.dmp
memory/5884-610-0x00007FFF65740000-0x00007FFF6574D000-memory.dmp
memory/5884-609-0x00007FFF65750000-0x00007FFF6575D000-memory.dmp
memory/5884-607-0x00007FFF65780000-0x00007FFF657AB000-memory.dmp
memory/5884-606-0x00007FFF657B0000-0x00007FFF657C9000-memory.dmp
memory/5884-605-0x00007FFF69700000-0x00007FFF6970F000-memory.dmp
memory/5884-604-0x00007FFF69710000-0x00007FFF69737000-memory.dmp
memory/5884-603-0x00007FFF657D0000-0x00007FFF65E33000-memory.dmp
memory/5884-625-0x00007FFF64E10000-0x00007FFF64E24000-memory.dmp
memory/5884-623-0x00007FFF65050000-0x00007FFF65066000-memory.dmp
memory/5884-622-0x00007FFF64E50000-0x00007FFF64E88000-memory.dmp
memory/5884-617-0x00007FFF65070000-0x00007FFF6513E000-memory.dmp
memory/5820-770-0x00007FFF65450000-0x00007FFF65AB3000-memory.dmp
memory/5820-772-0x00007FFF69710000-0x00007FFF69737000-memory.dmp
memory/5820-773-0x00007FFF69700000-0x00007FFF6970F000-memory.dmp
memory/5820-775-0x00007FFF65400000-0x00007FFF6542B000-memory.dmp
memory/5820-774-0x00007FFF65430000-0x00007FFF65449000-memory.dmp
memory/5820-776-0x00007FFF653E0000-0x00007FFF653F9000-memory.dmp
memory/5820-777-0x00007FFF653D0000-0x00007FFF653DD000-memory.dmp
memory/6020-789-0x00007FFF69650000-0x00007FFF69684000-memory.dmp
memory/6020-790-0x00007FFF67340000-0x00007FFF6740E000-memory.dmp
memory/5820-808-0x00007FFF653B0000-0x00007FFF653BF000-memory.dmp
memory/5820-807-0x00007FFF653C0000-0x00007FFF653CD000-memory.dmp
memory/5820-810-0x00007FFF64E40000-0x00007FFF65373000-memory.dmp
memory/5820-809-0x00007FFF65380000-0x00007FFF65394000-memory.dmp
memory/6020-796-0x00007FFF66960000-0x00007FFF66976000-memory.dmp
memory/6020-788-0x00007FFF67410000-0x00007FFF67943000-memory.dmp
memory/6020-778-0x00007FFF67950000-0x00007FFF67FB3000-memory.dmp
memory/6020-786-0x00007FFF71730000-0x00007FFF7173F000-memory.dmp
memory/5820-811-0x00007FFF65450000-0x00007FFF65AB3000-memory.dmp
memory/5820-814-0x00007FFF64A20000-0x00007FFF64AEE000-memory.dmp
memory/5820-813-0x00007FFF64E00000-0x00007FFF64E34000-memory.dmp
memory/5820-812-0x00007FFF69710000-0x00007FFF69737000-memory.dmp
memory/5820-816-0x00007FFF79FA0000-0x00007FFF79FD6000-memory.dmp
memory/5820-819-0x00007FFF79DF0000-0x00007FFF79F6F000-memory.dmp
memory/5820-818-0x00007FFF79F70000-0x00007FFF79F95000-memory.dmp
memory/5820-820-0x00007FFF63C30000-0x00007FFF643BA000-memory.dmp
memory/5820-821-0x00007FFF79DB0000-0x00007FFF79DE8000-memory.dmp
memory/5820-840-0x00007FFF69710000-0x00007FFF69737000-memory.dmp
memory/5820-839-0x00007FFF65450000-0x00007FFF65AB3000-memory.dmp
memory/5820-842-0x00007FFF65430000-0x00007FFF65449000-memory.dmp
memory/5820-843-0x00007FFF65400000-0x00007FFF6542B000-memory.dmp
memory/5820-844-0x00007FFF653E0000-0x00007FFF653F9000-memory.dmp
memory/5820-841-0x00007FFF69700000-0x00007FFF6970F000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tj3y5fqi.m3x.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |