exelastealer | hxxps://mega[.]nz/file/7iZT3SZA#rlTLI3DUTQjLH6YtaDMnrrYLkKooofl1ZQZXm1j-fbA

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/7iZT3SZA#rlTLI3DUTQjLH6YtaDMnrrYLkKooofl1ZQZXm1j-fbA

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5580	netsh.exe
6124	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	BootstrapperV1.18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	BootstrapperV1.18.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4104	cmd.exe
5428	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2148	BootstrapperV1.18.exe
5176	Exela.exe
5268	BootstrapperV1.18.exe
5644	Exela.exe
2696	BootstrapperV1.22.exe

Loads dropped DLL 33 IoCs

pid	Process
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe
5644	Exela.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
94	pastebin.com
99	pastebin.com
122	discord.com
217	discord.com
218	discord.com
120	discord.com
121	discord.com
134	discord.com
139	discord.com
216	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
111	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2148	cmd.exe
5752	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5924	tasklist.exe
5248	tasklist.exe
4928	tasklist.exe
5128	tasklist.exe
3664	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5868	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5644-336-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp	upx
behavioral1/files/0x0007000000023d98-333.dat	upx
behavioral1/memory/5644-346-0x00007FFDE6980000-0x00007FFDE698F000-memory.dmp	upx
behavioral1/memory/5644-358-0x00007FFDCCE40000-0x00007FFDCCE6C000-memory.dmp	upx
behavioral1/files/0x0007000000023d9a-361.dat	upx
behavioral1/memory/5644-372-0x00007FFDCCDF0000-0x00007FFDCCE1E000-memory.dmp	upx
behavioral1/files/0x0007000000023d5a-379.dat	upx
behavioral1/files/0x0007000000023d9e-391.dat	upx
behavioral1/files/0x0007000000023d61-398.dat	upx
behavioral1/memory/5644-405-0x00007FFDCC6F0000-0x00007FFDCC701000-memory.dmp	upx
behavioral1/memory/5644-406-0x00007FFDCB440000-0x00007FFDCB45E000-memory.dmp	upx
behavioral1/memory/5644-404-0x00007FFDCF610000-0x00007FFDCF629000-memory.dmp	upx
behavioral1/memory/5644-408-0x00007FFDC8660000-0x00007FFDC8DFA000-memory.dmp	upx
behavioral1/memory/5644-403-0x00007FFDCB460000-0x00007FFDCB4A9000-memory.dmp	upx
behavioral1/memory/5644-410-0x00007FFDCB400000-0x00007FFDCB438000-memory.dmp	upx
behavioral1/memory/5644-409-0x00007FFDCCE40000-0x00007FFDCCE6C000-memory.dmp	upx
behavioral1/memory/5644-402-0x00007FFDCC710000-0x00007FFDCC729000-memory.dmp	upx
behavioral1/memory/5644-401-0x00007FFDCFA30000-0x00007FFDCFA54000-memory.dmp	upx
behavioral1/memory/5644-400-0x00007FFDCC730000-0x00007FFDCC747000-memory.dmp	upx
behavioral1/memory/5644-397-0x00007FFDCC750000-0x00007FFDCC772000-memory.dmp	upx
behavioral1/memory/5644-396-0x00007FFDCCD10000-0x00007FFDCCD27000-memory.dmp	upx
behavioral1/memory/5644-395-0x00007FFDC9ED0000-0x00007FFDC9FE8000-memory.dmp	upx
behavioral1/files/0x0007000000023d9f-394.dat	upx
behavioral1/memory/5644-393-0x00007FFDCCDD0000-0x00007FFDCCDE4000-memory.dmp	upx
behavioral1/memory/5644-419-0x00007FFDCB4B0000-0x00007FFDCB568000-memory.dmp	upx
behavioral1/memory/5644-420-0x00007FFDC9FF0000-0x00007FFDCA365000-memory.dmp	upx
behavioral1/memory/5644-418-0x00007FFDCCDF0000-0x00007FFDCCE1E000-memory.dmp	upx
behavioral1/files/0x0007000000023d9c-389.dat	upx
behavioral1/memory/5644-388-0x00007FFDCC780000-0x00007FFDCC8FD000-memory.dmp	upx
behavioral1/memory/5644-387-0x00007FFDCCD90000-0x00007FFDCCDA5000-memory.dmp	upx
behavioral1/memory/5644-386-0x00007FFDCCDB0000-0x00007FFDCCDC4000-memory.dmp	upx
behavioral1/memory/5644-385-0x00007FFDE32A0000-0x00007FFDE32B0000-memory.dmp	upx
behavioral1/files/0x0007000000023d57-383.dat	upx
behavioral1/files/0x0007000000023d95-381.dat	upx
behavioral1/files/0x0007000000023d52-376.dat	upx
behavioral1/memory/5644-374-0x00007FFDC9FF0000-0x00007FFDCA365000-memory.dmp	upx
behavioral1/memory/5644-373-0x00007FFDCB4B0000-0x00007FFDCB568000-memory.dmp	upx
behavioral1/memory/5644-371-0x00007FFDCCE20000-0x00007FFDCCE3F000-memory.dmp	upx
behavioral1/memory/5644-363-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp	upx
behavioral1/files/0x0007000000023d91-370.dat	upx
behavioral1/files/0x0007000000023d93-368.dat	upx
behavioral1/files/0x0007000000023d5e-365.dat	upx
behavioral1/files/0x0007000000023d5d-360.dat	upx
behavioral1/files/0x0007000000023d58-357.dat	upx
behavioral1/memory/5644-356-0x00007FFDCCE70000-0x00007FFDCCE88000-memory.dmp	upx
behavioral1/files/0x0007000000023d53-354.dat	upx
behavioral1/memory/5644-353-0x00007FFDE68D0000-0x00007FFDE68DD000-memory.dmp	upx
behavioral1/memory/5644-352-0x00007FFDCF610000-0x00007FFDCF629000-memory.dmp	upx
behavioral1/files/0x0007000000023d99-350.dat	upx
behavioral1/files/0x0007000000023d5c-348.dat	upx
behavioral1/memory/5644-446-0x00007FFDCCD10000-0x00007FFDCCD27000-memory.dmp	upx
behavioral1/memory/5644-445-0x00007FFDCCDD0000-0x00007FFDCCDE4000-memory.dmp	upx
behavioral1/memory/5644-345-0x00007FFDCFA30000-0x00007FFDCFA54000-memory.dmp	upx
behavioral1/files/0x0007000000023d92-344.dat	upx
behavioral1/files/0x0007000000023d55-342.dat	upx
behavioral1/memory/5644-453-0x00007FFDCC750000-0x00007FFDCC772000-memory.dmp	upx
behavioral1/memory/5644-490-0x00007FFDCC730000-0x00007FFDCC747000-memory.dmp	upx
behavioral1/memory/5644-491-0x00007FFDE68E0000-0x00007FFDE68ED000-memory.dmp	upx
behavioral1/memory/5644-518-0x00007FFDCB460000-0x00007FFDCB4A9000-memory.dmp	upx
behavioral1/memory/5644-527-0x00007FFDCC780000-0x00007FFDCC8FD000-memory.dmp	upx
behavioral1/memory/5644-544-0x00007FFDCB400000-0x00007FFDCB438000-memory.dmp	upx
behavioral1/memory/5644-546-0x00007FFDC8660000-0x00007FFDC8DFA000-memory.dmp	upx
behavioral1/memory/5644-539-0x00007FFDCC710000-0x00007FFDCC729000-memory.dmp	upx
behavioral1/memory/5644-538-0x00007FFDCC730000-0x00007FFDCC747000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5640	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000a000000023d4e-223.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BootstrapperV1.18.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5324	cmd.exe
4052	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5776	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
368	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
432	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2936	ipconfig.exe
5776	NETSTAT.EXE
1600	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5328	systeminfo.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
5132	taskkill.exe
5548	taskkill.exe
5764	taskkill.exe
1160	taskkill.exe
5824	taskkill.exe
6116	taskkill.exe
5356	taskkill.exe
5476	taskkill.exe
5952	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133755519957171499"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
1724	msedge.exe
1724	msedge.exe
2324	identity_helper.exe
2324	identity_helper.exe
4636	msedge.exe
4636	msedge.exe
5428	powershell.exe
5428	powershell.exe
5428	powershell.exe
4624	chrome.exe
4624	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5948	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2388	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2388	AUDIODG.EXE
Token: SeRestorePrivilege	4948	7zG.exe
Token: 35	4948	7zG.exe
Token: SeSecurityPrivilege	4948	7zG.exe
Token: SeSecurityPrivilege	4948	7zG.exe
Token: SeDebugPrivilege	5268	BootstrapperV1.18.exe
Token: SeIncreaseQuotaPrivilege	432	WMIC.exe
Token: SeSecurityPrivilege	432	WMIC.exe
Token: SeTakeOwnershipPrivilege	432	WMIC.exe
Token: SeLoadDriverPrivilege	432	WMIC.exe
Token: SeSystemProfilePrivilege	432	WMIC.exe
Token: SeSystemtimePrivilege	432	WMIC.exe
Token: SeProfSingleProcessPrivilege	432	WMIC.exe
Token: SeIncBasePriorityPrivilege	432	WMIC.exe
Token: SeCreatePagefilePrivilege	432	WMIC.exe
Token: SeBackupPrivilege	432	WMIC.exe
Token: SeRestorePrivilege	432	WMIC.exe
Token: SeShutdownPrivilege	432	WMIC.exe
Token: SeDebugPrivilege	432	WMIC.exe
Token: SeSystemEnvironmentPrivilege	432	WMIC.exe
Token: SeRemoteShutdownPrivilege	432	WMIC.exe
Token: SeUndockPrivilege	432	WMIC.exe
Token: SeManageVolumePrivilege	432	WMIC.exe
Token: 33	432	WMIC.exe
Token: 34	432	WMIC.exe
Token: 35	432	WMIC.exe
Token: 36	432	WMIC.exe
Token: SeDebugPrivilege	5128	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5328	WMIC.exe
Token: SeSecurityPrivilege	5328	WMIC.exe
Token: SeTakeOwnershipPrivilege	5328	WMIC.exe
Token: SeLoadDriverPrivilege	5328	WMIC.exe
Token: SeSystemProfilePrivilege	5328	WMIC.exe
Token: SeSystemtimePrivilege	5328	WMIC.exe
Token: SeProfSingleProcessPrivilege	5328	WMIC.exe
Token: SeIncBasePriorityPrivilege	5328	WMIC.exe
Token: SeCreatePagefilePrivilege	5328	WMIC.exe
Token: SeBackupPrivilege	5328	WMIC.exe
Token: SeRestorePrivilege	5328	WMIC.exe
Token: SeShutdownPrivilege	5328	WMIC.exe
Token: SeDebugPrivilege	5328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5328	WMIC.exe
Token: SeRemoteShutdownPrivilege	5328	WMIC.exe
Token: SeUndockPrivilege	5328	WMIC.exe
Token: SeManageVolumePrivilege	5328	WMIC.exe
Token: 33	5328	WMIC.exe
Token: 34	5328	WMIC.exe
Token: 35	5328	WMIC.exe
Token: 36	5328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	432	WMIC.exe
Token: SeSecurityPrivilege	432	WMIC.exe
Token: SeTakeOwnershipPrivilege	432	WMIC.exe
Token: SeLoadDriverPrivilege	432	WMIC.exe
Token: SeSystemProfilePrivilege	432	WMIC.exe
Token: SeSystemtimePrivilege	432	WMIC.exe
Token: SeProfSingleProcessPrivilege	432	WMIC.exe
Token: SeIncBasePriorityPrivilege	432	WMIC.exe
Token: SeCreatePagefilePrivilege	432	WMIC.exe
Token: SeBackupPrivilege	432	WMIC.exe
Token: SeRestorePrivilege	432	WMIC.exe
Token: SeShutdownPrivilege	432	WMIC.exe
Token: SeDebugPrivilege	432	WMIC.exe
Token: SeSystemEnvironmentPrivilege	432	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
4948	7zG.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe
5948	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1356	1724	msedge.exe	84
PID 1724 wrote to memory of 1356	1724	msedge.exe	84
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4524	1724	msedge.exe	85
PID 1724 wrote to memory of 4928	1724	msedge.exe	86
PID 1724 wrote to memory of 4928	1724	msedge.exe	86
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87
PID 1724 wrote to memory of 4340	1724	msedge.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6076	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/file/7iZT3SZA#rlTLI3DUTQjLH6YtaDMnrrYLkKooofl1ZQZXm1j-fbA
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde2bf46f8,0x7ffde2bf4708,0x7ffde2bf4718
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,5900501827871506258,9487138255782381695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x2d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1224

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap2662:70:7zEvent7234
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4948

C:\Users\Admin\Desktop\Solara\BootstrapperV1.18.exe
"C:\Users\Admin\Desktop\Solara\BootstrapperV1.18.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2148
- C:\Users\Admin\AppData\Local\Temp\Exela.exe
  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
  2⤵
  - Executes dropped EXE
  PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Exela.exe
    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:5172
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      PID:5156
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:4692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:5124
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      PID:5472
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        
        PID:5520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:5604
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:5684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:3212
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      PID:5868
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:6076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
      4⤵
      PID:6064
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
        5⤵
        Adds Run key to start application
        
        PID:5936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:5956
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5924
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1724"
      4⤵
      PID:5908
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1724
        5⤵
        Kills process with taskkill
        
        PID:6116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1356"
      4⤵
      PID:1516
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1356
        5⤵
        Kills process with taskkill
        
        PID:5132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4524"
      4⤵
      PID:5308
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5172
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4524
        5⤵
        Kills process with taskkill
        
        PID:5356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4928"
      4⤵
      PID:5220
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4928
        5⤵
        Kills process with taskkill
        
        PID:5548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4340"
      4⤵
      PID:3156
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5128
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4340
        5⤵
        Kills process with taskkill
        
        PID:5476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4428"
      4⤵
      PID:5488
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4428
        5⤵
        Kills process with taskkill
        
        PID:5764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2908"
      4⤵
      PID:5604
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2908
        5⤵
        Kills process with taskkill
        
        PID:1160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3588"
      4⤵
      PID:3212
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3588
        5⤵
        Kills process with taskkill
        
        PID:5824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2296"
      4⤵
      PID:5944
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2296
        5⤵
        Kills process with taskkill
        
        PID:5952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:5748
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:5912
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:5408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:5900
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:5336
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:5288
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:5248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      PID:4104
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:5428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5324
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      PID:2148
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:5328
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:3964
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        
        PID:368
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:4920
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:2912
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:2712
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:3180
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:3688
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:2908
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:3972
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:5000
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:4428
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:5536
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:5276
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:5320
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:5456
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:4928
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:2936
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:5500
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:5752
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:5776
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:5640
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5580
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:6124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:5968
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:5832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:5960
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:6000
- C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe
  "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5268
- - C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.22.exe
    "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.22.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe" --isUpdate true
    3⤵
    - Executes dropped EXE
    PID:2696
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c ipconfig /all
      4⤵
      PID:2976
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:1600

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5948
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Solara\DISCORD - Copy
  2⤵
  PID:5872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x120,0x124,0x128,0xf4,0x12c,0x7ffdd2d4cc40,0x7ffdd2d4cc4c,0x7ffdd2d4cc58
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2012,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1816,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2308,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4552,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4692,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5032,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5336,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5208,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5356,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5608,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5604 /prefetch:2
  2⤵
  PID:6136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4764,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5396,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3376,i,4066829096978615890,15246977337585914604,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5728

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
56bdc89991a0211616e7fd5e9890f12d

SHA1
982da49a85d975734616f18285e338b3ee9d448e

SHA256
75f189433b929f69c7ab67a016f901bd8b884c1799b61bbc4521f5ee0c94574a

SHA512
7d8cde40e9655af68c568fd17f21973dfb1b88a96b4a1d1f7f47a5028a2b7b61d99010e674ac9fdf2cfff6af958340d4ff19a609090186d465a9241493cfa943

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
9bebd816f7bb7897cb54c08a48ddc8d0

SHA1
fefffbecc3ccd7dac69ee0fe097b8bbca59c100b

SHA256
af58f699652e418c210ac52d41525c70e0fafbd30139f2f654f6090ef962a83b

SHA512
64901996fca7c5fd90bddeb3447d8cd1693a23524f35ee5901fa7543dc316768b56cce68eb3dc7bb206c1bb1ba569d1b02fb9a6941942de3ba1fb2ee1cb9a045

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
24493d949bd895a6d951cc66631e5d32

SHA1
493ee0bcc8dc76bafd5d39ddcead5216ff178be2

SHA256
0ab97961c23f35106b7c4ded89661abc738e81c4b49ae66f7dcca685d27a24de

SHA512
5cc23339bfae24a11bf125dec3d62df9da531d11e861089d0f8454c9e5d3a96e5dd46fe6242b99058c37feaac928dacb4b42ac8be843c7ba4fbdde1b58f4f141

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e84709437263bd2d8ab5bcd82cb1eeb4

SHA1
b697e8a8ea4d6cb2c4dd38fa2f4b893f87eff318

SHA256
8fb26940be08a4da9555eca2ef1788c58f422eabe191ffe3bbf413876e3bc963

SHA512
1bd265acccf44ff47af5f6929ea639583c807109704dfb202f95ddef129f5ae69258c97d160756e1e55eec8d2530b8b740c5d0fcc16bb0db1d81ae203fb3e03f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
efbe1d8e367d31932890d91d2100ff64

SHA1
3941c9ded998837ce2c19c60163f68193559659e

SHA256
2d5e234e2aebf094f31b9be755feee64f152f792ed0a7e193d41dba3ef43dc8c

SHA512
6623b40269c4656d77a25fa4ed8e81a8c0ff6cd43ed11b92483ce86146a4f9779b954568f6b0d45aa1b3488df0c1bba2061a85205934ee880c54b1e5db194614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
bfadfaa48bb8ec66e56bf5324adf8e90

SHA1
1705f4dd3624eab8e62fa581ca0c25aa7e2e2ca1

SHA256
0759e41317024af66ff4327ce7a1fca8712762ca44382444740e0942103231cb

SHA512
fef5dcd1ea701bdf633cdc14a271029923c329a2cf1d4de63c1cc3f92fb2285e9c9fc4b72d0f8825b0ee8ed4fa6cbda838a8d54531d36840de1d3dd89540a741

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
f6cad38bc756c3cb487feb8648486bce

SHA1
cfe4c8fe3bf68a7e74d5d8d8de95b3a979e16c67

SHA256
d34dbf4584347f3e967299d01467569c887eb0c560ffe9e6e2d19ffb5e893916

SHA512
c6a62cf349142737a61fc89dec7ff825f499bf508b57c870525d2c33d34c273973d1e2972a4dd416ba70b859dfaac9790fd7251e1e04b5c515841a0ed74067b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
5a1593c674c0ede2872dd9093e178f6a

SHA1
4f57fd32f4b62329342fd7ab8096fd16a14c303d

SHA256
833afe2172640d57d8616c0a205f206fa234a025b99a28d07a341b744ee7e4f6

SHA512
943b2d990b5ece4adde7721c3745971d6317e1e5b66302e2eaaadd17725eef0f4014e7d41cc30a8ccde8c1a8073ae55c166f717ff5819105620df046ece7e964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ddd6cdaefd8460dbb66fca690fcc431d

SHA1
c0fb3a186aa7399539e1319b27774b1049d1618d

SHA256
c1413e5fc4ccc5dc9f9e4666bb63f1e22d8b521dfa909296517759670db5132f

SHA512
ac06edcd536c2ac68e8c6dbd0c0a977b71240b652c6b8f46e95950b2e1f8d59a46bc9bdfd03a1b370f81f6ce83b3ecaec43bdd2fc8bfc0f3e9ad9720990f85bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6927d13ae0ffcc9a33efedf704a4a153

SHA1
9e712010baf2d6df035ed59f1f84afed5c27830b

SHA256
1e8e99e8f3373836d790b6ca669d2b7f5a08137c7cd1dd4a38c270cffa042184

SHA512
c783ea85aba45a6f9968dde08d94914e976e46b964aeae0e4d5b7ca59c70b26d98196028927819d429d94248b8daa265e908c6949f0629a51ccca4ab188942a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
deecaacb4be87e1299cdb2c4012236bd

SHA1
884b42efb5059407035ea6d63955d41df49db4d3

SHA256
5ce7ec63101a2afb55f6e327dc918b2fa5857a935a74829ae57e2c763904e66a

SHA512
c5fcf47aedfb1aaf96a5c5f25f4f37d8fffd0f62dac9db282e3c2af56e4ed8372a6594278d0168e33a1fa55e50165ee29083b2a15d1ad2accd21cd65ba418967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2630a5726b926c7e1147977a8d93d294

SHA1
619ce13ce9c6b344fff4d83573e826f6dd60a9b6

SHA256
996a6748687c884682d246cc180d069242df49ab007b42901fee85643939d02e

SHA512
0622ec470bd229b7dc92fbe9436241f5716d7ddebbef9344c6c0969d23f8c76fd8d3c28148cbe326480ad2554a76af9bd47d8114e1e598c94d8d466973c83624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
6ed8bc7a2fe17ce6d809535ef3c81e1f

SHA1
ea7f41ed0bbdecf61f3b0c8ed63e17366f85430a

SHA256
a5d8c6371ceaade29acd1deb7d3a2f1a24c2a73fd7eb25f06b9d6f12c209c0c5

SHA512
6ced18bbb75c167d45777c5248bb758be7b5a832f18cf30baf668650176f197d39e4b83692b8e4624acb2596dd09765eaf02918218af63bbc765009495797d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fa3e.TMP

Filesize
48B

MD5
e19ed1ffb5f89640272b31dee0d64761

SHA1
5f50cc3cf4100e416cf2d150d0c71f182545e7bf

SHA256
99645918bd81feea12260b788aa2f42b789df91793528ded85f990a79036ac9d

SHA512
bcba8c92c35963a23457b68357ce27f598c4e01e3b9f819925962b5575bf2c966224a2fce4a10218666940cb405ec0897dc23c5be150228c43c77c32ac8ded96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
75f53047c1f0bf5cf353fb5bb2427736

SHA1
0898a166b1f11604790b3f2f7ec002be46442a93

SHA256
d1cd088df204c6fa8220a3cbd9d355e8e672aa26a1eba289ef27c478ac49e914

SHA512
8c2c64b335fbe5299d0ff9fd166222c3c1f0a5a4e1354f25e70acd55221cd9a04449065ad8f6ff9f0ceacb91f6970cbd1e26dddf9c8c1a9fbfc6e6d724232ed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
01dbb45e11784c723ac4aa9db120fe4b

SHA1
63ce03e18625e423e9f26bd5f3515a4afd21efc5

SHA256
187680e1993fd47fd48879776357d952d6d1ff2cf3096825d6043abb93ee5fc0

SHA512
5002844297d9034f84d65157e2a57a557d86a2d63664e3dc9fa8629110123c7099d218cfd5f783c8f7b3b0a668308412aa0d88823084e2c30a5367c7763ac762

Download Submit
C:\Users\Admin\AppData\Local\Temp\267e7e93-f6ad-4547-944d-b5a9732ef44d.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\3de1b46d-40a6-4ead-a934-6286249e4b32.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.18.exe

Filesize
971KB

MD5
2458f330cda521460cc077238ab01b25

SHA1
13312b4dffbdda09da2f1848cc713bbe781c5543

SHA256
dc67b264b90e29cf5cffed4453de4567398faa7f3bf18e69e84033c5b33ab05c

SHA512
8f027ebd96901f5a22aad34191244b1786dfb66843cbe05a8470d930415d85d86430267da09e7f1a69b8011b170d229e7fb25ecf0bf7d9209d7b910b2cbab48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.22.exe

Filesize
800KB

MD5
2a4dcf20b82896be94eb538260c5fb93

SHA1
21f232c2fd8132f8677e53258562ad98b455e679

SHA256
ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a

SHA512
4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288

Download Submit
C:\Users\Admin\AppData\Local\Temp\Exela.exe

Filesize
10.3MB

MD5
b2e9b15dcac736d8369b071a0d1e522a

SHA1
4806153d01b3eb85f71fd65732749344341196f4

SHA256
f055295249d55f006eb5a8d5394ab2f25afebaba2d5dacdd4e8f41a139477575

SHA512
f6738d420a97ca40435efee845147af7e2d32a37d85c7e6831bff1bde2bee6f0bbfe78eb39d65c75747066dccc2c3af2a8f8242179f8af52bb2e367318507433

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CloseDismount.xlsx

Filesize
11KB

MD5
3cc83325757d3043207849d737f7cf8f

SHA1
83b2a023ead61968ded7e45afae61af521f8798a

SHA256
49f521c8f9d9d855b1607d4790eb9a7a45765a63ed42405dc5d897bbbc9a87d2

SHA512
1cf4970459f2a26fa71485f0f58e078dff24d2f2eb9d9996bc2cefcca3402aae4c0b6950b9c614794b06b4373c780be3a0c4468647ef19f32a265e6de2957739

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CompareHide.png

Filesize
549KB

MD5
e09c4c5db2d32f1af248db206712756b

SHA1
e5212cf4ffe0566b84f001e67e7ef4615b9c14fd

SHA256
a389b7c460ece6e58af898bb3314ced9e485c9ce33e713e3ad51ba9b8e45b4a3

SHA512
bf6f71b96f3aa6dd6304c0671bc75b13b19bb371352deb8884cf041eef347acde0621f75628e9b9ccbbd2b64ac23f9cd0097660b6f18e119b340c0634f0b600b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\EnableWatch.docx

Filesize
14KB

MD5
226901e348a0f350c2753a0242ecb13b

SHA1
a7c9d6a265aded8c2556d56f3cb95370489ca121

SHA256
2e32ae9e1811750df8629fc32c4a45edd05adede05641b843833d43cdb4fd78c

SHA512
1a368e01b942e0c41618f9dafa9bd3eb58dd7c527bfbf3828ad25d887e2af20d3fc7893dc0906cf6a647d3db48e409b253212f77eda2601912d83c815edd8c36

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RequestResume.doc

Filesize
319KB

MD5
9d3bd6fee36be3d6672acc12af9f073d

SHA1
2fe71297382c0a83b6382e5d19e23d614af3304f

SHA256
f1eb928c962d77075cc1831fc599e8dad6c86dfcfd9c053c04c44e0ccf3c8339

SHA512
158f62db63282fe6a1885750f82d1b0e1f1570fbf4ee77066f9c770308ac155b9c3499c149dc6b86727a93a4878814b6d0ed0d75ef0ba0dab2797a4dd458600d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SwitchJoin.docx

Filesize
15KB

MD5
03ceb39b141d383cfcade88b8af327be

SHA1
f96195ce72c454b7eea751268e293a21fabbd102

SHA256
dc04914b31e0915192598a479fafafd55d8f64e1aea6e950eb4557b040d38707

SHA512
d3547e235909b279a3a44deebf321d03ab3c6f8e2e6cb38909e22a4527001bb11b5e6f00fad3055eeeb79f0bdbb8f1f37e4ed0783009e8a2b2dab4a8f3c4012d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UpdateSelect.png

Filesize
472KB

MD5
cd42659036a49053e96fac160f40adbb

SHA1
461f76466ac0262255b54e729ce5bfd6f324a0c4

SHA256
883f2097f196e35a511b02af996791f46ad975910e1c50fcbc06d2cfad982cb1

SHA512
9b4f9a12fa6740a54be1cc16da635a97a74c47a943f3895f3ffb67ad9c986fbd4c8f851f8accbe787fbd60ad24f9628d9d95aea2c9c7a9ca533a6e5f1ef557a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UpdateRevoke.docx

Filesize
16KB

MD5
9fea89c24ecee3c8e59cf60533ff12b0

SHA1
37f0ce8323054a494664d99bdd8f300a6c305d12

SHA256
d1b7349fd5709551a7bedf6c46d2506de83bb24ec763376b217ca2fc7f4343c0

SHA512
d2ae7cfedea57c5dc9dd01119d0e449c9187bba2765756cbfc31180e2eafb0b61c64eee6d2bc10fd2f5d7c6c4ef63e18254e08688e11d046a220cf50e323fa05

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupInstall.pptm

Filesize
639KB

MD5
f081669718bcba7dd97a014758aacd99

SHA1
8ddf6ad8c6ea8b7f66fc4914f35c64ccfdef7ad3

SHA256
29dbaab1caa02cf730b01989f89a734377cf2a8c75a90561766f50a4aa388e01

SHA512
a22383fb95da7a38d646df0fd0da9bc0056cae24bba4c5b4b87069febe1be983d9175f76392cd67137befda0c50b7c34ebb7739ed82659c48693ae1aa94692b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ReadSelect.doc

Filesize
534KB

MD5
0decedb479eb3e6b6cafeed8266de98b

SHA1
77d809477f594fb509eeafa3f74cd05623802505

SHA256
0729de5a465844bf7860abae07c00e4a46fdaba20d00fcffca9f0006e153e1dd

SHA512
590e6db5742d504e17367ce15bdc55b92f4490a6808cc8f0bd2f98feb0ea4a41891c82627e434b361f6794a819432aefb3f83e8bcfff96e39e0f1b5fd0bcbc7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RenameCopy.csv

Filesize
458KB

MD5
42af22a93044608635ab63fc5cb84072

SHA1
198c554276e7fb3e9aa122f87caf4fe7ae000883

SHA256
82846c69e7a3d912cf7f65b32d049849d1722c8e02d6a4ff870244fc2504d684

SHA512
5d70a7e9ee0901c12c6ae7d2734f4b4b79a0e119c73ac26184e339c461af74bc40914739a945634ec4c8ea79ba75d30a1dde49ee43b5fff1067fed8ac0a26189

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupConvertFrom.vsdm

Filesize
509KB

MD5
b8ee475c476a2b6bc86606f556ea14eb

SHA1
d2482e8b9b287fa0cbce8614da2e314190af194b

SHA256
be33d9287730d3f8ced786063da1f4d18f9949fd3509ac6d87524a1900bc0ddb

SHA512
7e0994cafa1c310221e30005b561cf6fab348c7ed9c8339a686b8b2ad066820cce392d31f349eb80668a016df828d4409370f61de65af83b616ffb22a15eb48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupExport.dot

Filesize
356KB

MD5
d2df6b2b2b08964ff650535a796f7127

SHA1
5c873086eaab5989500b89c30ce3daabbd0fe674

SHA256
d9b7561eecc12d8ba11e54706e20ef9b9612d197dc0a8614e728cf2e2486cfb8

SHA512
1a9b96ec85cadabce8992231b61f5cbcc1f18ce1b81dd4c126094e80b0689eebf9701560d58470e670a7c9508ad2ec38ae18752c3452c978b2445865b5d5a058

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ConfirmUndo.jpg

Filesize
441KB

MD5
5d737fa11534b73f66d6eb095b408fe5

SHA1
cf269eb6d5ca582db7a49848b59785ec4a616bad

SHA256
864daa73c519bd693e0f99ba40f9104c4d254169d3e0db04746e07bb24805c5f

SHA512
a9fe0d9eb1e72a2b9ff98f1ce33ab984121f86dea25b6ab25fbf583311597daeb86e8540d1439087ca468afdc06729be4d2d9dc6ef1ac41619561105ab8bd27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SkipGet.jpg

Filesize
254KB

MD5
327673cf02b03921df86fa178f027b75

SHA1
a7370496e2d291bf61dfdbe46d5d6e701c41b6ac

SHA256
876411f92e52a1210e4f79a3ac6e031ecfb222bca71dc190306718d249708d5f

SHA512
5fd13bcd2122f0dd7f66eef35f855de111e16055f849168d1f2ef6c766412ce534153237e1515fe24ea7f85254657fcc11519481c1273508ece9f060212d6058

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\BackupStart.ico

Filesize
792KB

MD5
f5d65ca07d42fd39cb29f4b544ce4a60

SHA1
9459208ba3bbe7b510576ed37526e0d7f4b22467

SHA256
1770ede88d6a3a400fba926a6920bb68034539c3597025c94ef4a534b6d8229f

SHA512
e52358d39c5a028fd589a1d2aea785ea4a9ba27b9f9559b21be27ed85c6576470fa10a44a6387d72f39e7fed00fdbbad293d535ee64b5cc3ffa19af39a8e9bac

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\DismountMove.png

Filesize
460KB

MD5
61a502a2406b8923a7823b5954fcd559

SHA1
94bd28a50839ca3310c6943e2e71a6e750cc6c91

SHA256
baa8b487c0f143874008c2af5240beeb0848641c08ca4d228bc9e8f20ff33011

SHA512
1770aa5899444a54e30aad79393b051ba2f122172f0794dd678e93c96884f0602f09aa9b35250bbfcbf1bc1572c06b8a561b46fcb1eaa8c3e7c1cbbfb61f3a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\FormatBackup.jpeg

Filesize
387KB

MD5
f8f864421136612dc3d8e23af606d865

SHA1
7559c1d161cbd8b988e5be0be575fc74c6732a78

SHA256
231f2a76a1f944f462a04b289dd5e1e760ad440ce644691233110469d1538ad1

SHA512
971bf976a1954b909d48f3d62352100f96eb83c910ec1f2a02256c65bfa01c341672605f0a61a081b73e03041c29e1ab5fd88867170d922d00a0ac860a6e8b7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ReadSet.jpg

Filesize
940KB

MD5
edd13510eb146a42d8b347f450e8481e

SHA1
89b2d4167d077527deadd47e08ff09f8cb267607

SHA256
9772164025df2086a915749b6055519da408102b0b34c95c9e722e273bc22698

SHA512
28f1c9834de90f641061518cef84fcb45c779f972c4f932b60840d80c8f989e6fcae23d9cb1ce3e49bb43f5b9361c45d3ef6316b97c7ed1b57351087daad9a3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\TestPublish.jpeg

Filesize
424KB

MD5
ccf32bf5a68837e8db19219f967347bd

SHA1
bb9f840690bb1984a6ca615cf60657182197fd52

SHA256
1c9a3ea611a3b5fb939205cbb34761f5fc7eeddef217cddef59556d9e0008933

SHA512
bdbeae8718481100820c54faea9f326a61f1faeaa3cb4e28fb09a0c9ce524bbbe4fe0840dabd59c18235eaa9232296be147c1a3baa8d494d9b4ba5d6afb1ace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Solara\RIVALS SCRIPT.txt

Filesize
89B

MD5
13fbaf598afcb4c11235516a168b39b6

SHA1
e898cc6616217c11e46da49ef302191c7de371e6

SHA256
adec247fcf0e27cd1e5f533711fc43d6b172da44d483a400dd8e4a4addad1e28

SHA512
1eee8e2ce6ce6a1ac868a8112a4b611620c850b07aa3dddf397b621109ead352298511817deec3d5735080105577635cdd081bec90b10737fd590f523716ccad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_asyncio.pyd

Filesize
35KB

MD5
40c987a3f2048fe7be8f485abc25d690

SHA1
1adc852eed94327c859f8c26ed82dafcace789de

SHA256
38b15921f4f273731a6bc2c04ab21ca95e589d9d3b6a3b8c4833be912cc4fc11

SHA512
0f0e8a37d12ea33f145cf10435ccc31c85db76c8a5d77c41a6b2cb97be78d72a77174fcb086859026bf3a3d78dc2846fa6dd297de824b7a4fae42625138352ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_bz2.pyd

Filesize
47KB

MD5
04624a02b17fcbe6cad81bef5ab3120d

SHA1
6710f75cf758fe4ebf32254d1f5f522eccbf34cb

SHA256
b34adf4cf08f5987f8f96dd709446c1871f0c95bd43ca1abbf01febbed286761

SHA512
c8128004baf8ffada314c59d9954811932b8c59449f2484c7e48f24d4d912ed5f04e09fbdfb937b47c6677fddcca8b8d8a532dad05853c9ae42e54a687b7b28e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_ctypes.pyd

Filesize
58KB

MD5
3fe65d28fe096f64360b5440cf394032

SHA1
f784e26b333dc22678ee72d79d617d90bab10887

SHA256
75a2487d8879fd40347c616c920bebcd24c48483bc40d3113fcf76ee52cb3897

SHA512
3b0d5c41da9a71bc41c0446b40001ce3111134d0540daefda751d2a1cf9b64c293c64104d98b2be9db8a081d754beb743f2bb0467dc3d806bd0a705b0b0d2687

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_hashlib.pyd

Filesize
35KB

MD5
ac7d085ea6017c3fa86334ee06db9742

SHA1
ba503b4af9315b1094799d890cdd23ba6db34386

SHA256
c9af2db3297d5b2d9b4afb7cea861069fd6202dc07a98f97146c991a7973a48f

SHA512
2e7de5cf33c8a594004f44961e21333a85bb35a1858a3b1e4f196a127878c542d018f50c456fa463958172f41568f9ba7c58bb8ab120220c0aa25ecba82b306f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_lzma.pyd

Filesize
85KB

MD5
2e185ac31f220c582527316b7cd7d129

SHA1
3b79d955bd41d602397c90f0ac85e7629560164d

SHA256
bdf6e53fa9638b96035b039cf4ae199fbfc0181bdf68892c67d5989a4c707459

SHA512
ff49979f1795a7a617733d906cb7446298ac438d4080a5659c4bab647553a26bbb6fcdd8d6f5ee807bd0f06f98f49a504595082c3e54c5ab389354669ce62018

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_overlapped.pyd

Filesize
31KB

MD5
c765eaea2b7c3ea95c4d76e7e3367a27

SHA1
d1d3c140742784b654787f9921e2190f9e33e6fc

SHA256
899b2b0ffb86d66b21c032220da9853083988af6c2255c96fec75b1dff54acdd

SHA512
e9fb6acdee0f98f8527fc7b772dad9ddf916abfbf42b32146d18fe53075103203975cfb472ca3f307e9e2d1df11388119d4de1c628987ef460f20a04db82bc35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_socket.pyd

Filesize
42KB

MD5
5a19dc74add570332f53e568fd804d83

SHA1
073e842ed7d61822cd0117d82ce347574080b77a

SHA256
debc54d9a077c0fa72e307e507c856f8d5605cf1c97ca2edcaed8315efebba2a

SHA512
c9a014cd8f6b008c40027bcab414a29a29abc9418bc5a2a0bc0d6348cf8cfec34f9f3e24996b724714ec2f3fd59202c39582be0a466e803711b04ba5910023a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_sqlite3.pyd

Filesize
49KB

MD5
470553f4ae9f4c993d8a49a4bb2a3e9d

SHA1
ff3ec513d949bb14890f800ad876a08a66baa826

SHA256
e813e72d4244a74940be190d3dfbae4c529cb10b8d65081b7632db55156cfc37

SHA512
55c89c08cf6684be203f6c863388cb6a0a98ba991b7dcf51a7bcbdcecedcd17150821af98031cb388bf555a3d8057cae9e512f9a0984cc371f982f5cd9e1f9e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\_ssl.pyd

Filesize
62KB

MD5
5945b86f49b9293f7f34223bac0ce176

SHA1
bdfa825065a4d22541f971d4b6477b81318c1618

SHA256
ebda1726944ad954f67a8460a2a5e2fce2b06a487f2d5bb37aa075478661dd0b

SHA512
88b292aa213a542d43202dd888fd3d08780f4379acdfd8ced4d07327895a715f5c0ea7edbc0837a7a593c60de2f7fa6989cda4475e41f484a4369a5fb254fd95

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\aiohttp\_helpers.cp310-win_amd64.pyd

Filesize
26KB

MD5
979141b731e17262a48e9834b97b6f40

SHA1
823f01d5fe40b0aef6065c254f34086f69cc92b9

SHA256
0dba67aebcf9e2e8e6e2695e9f9f15dedc3fe433772510d3d767724e848cd9d4

SHA512
ba27064ff3ae4442abb85c0e369521ff2bd422878e1a248e0a654cbaa0f3c099e1ec3ea529a57e14f75f6e9e38ac8c60b60844be1aea4f3417fdefe4d6bcea4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\base_library.zip

Filesize
812KB

MD5
678d03034d0a29770e881bcb5ce31720

SHA1
a55befcf5cd76ceb98719bafc0e3dfb20c0640e3

SHA256
9c0e49af57460f5a550044ff40436615d848616b87cff155fcad0a7d609fd3cb

SHA512
19a6e2dc2df81ffc4f9af19df0a75cf2531ba1002dca00cd1e60bdc58ede08747dafa3778ab78781a88c93a3ece4e5a46c5676250ed624f70d8a38af2c75395f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\libcrypto-1_1.dll

Filesize
1.1MB

MD5
28fcf0c6cfa1db6cc42ae59752ab2771

SHA1
47a3aa91bda19e9c0f25bd8d2dd311a5dac4760e

SHA256
25f60666da1e83ee23224f1ad4368beebb58597d71731945a124ed25a33b6ab3

SHA512
4090d02fbe47460e6170328e0bce47536c15aa9dbc2d01e13470b911fb251993d148bb6472cc6c0d458a8258bcaab4a767362de08718b0289165f2464b043c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\libffi-7.dll

Filesize
23KB

MD5
8e1d2a11b94e84eaa382d6a680d93f17

SHA1
07750d78022d387292525a7d8385687229795cf1

SHA256
090a90cd17b74abefddf9f82d145effe5c676e7c62cf1a59834528f512d7ee82

SHA512
213bf92a707b14211941e5e071f1926be4b5795babc6df0d168b623ecd6cb7c7e0ae4320369c51d75c75b38ec282b5bf77f15eb94018ae74c8fd14f328b45a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\libssl-1_1.dll

Filesize
203KB

MD5
98a4c190631fc2ddd4e1180d28f12253

SHA1
cc6eb0bb9c0b7a199e283af3071c0757e9de42f6

SHA256
7652f04c716f536bf8d8dd62b3b36e2ddfa4606ab9b52c9c36e95cedbf2dc0c4

SHA512
b1abb3ba0e97833a58d8a8ba0f39dd7fb58644d8dc7686946723466c6fd5234ae4cb90ed1e8e5aded4243cf5c09ccde1ecb789069b92821b5c9a6dbb31b02135

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
d282e94282a608185de94e591889e067

SHA1
7d510c2c89c9bd5546cee8475e801df555e620bc

SHA256
84726536b40ff136c6d739d290d7660cd9514e787ab8cefbcbb7c3a8712b69aa

SHA512
e413f7d88dd896d387af5c3cfe3943ba794925c70ffb5f523a200c890bf9ceb6e4da74abe0b1b07d5e7818628cd9bc1f45ebc4e9d1e4316dd4ae27ea5f5450d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\python3.DLL

Filesize
64KB

MD5
24f4d5a96cd4110744766ea2da1b8ffa

SHA1
b12a2205d3f70f5c636418811ab2f8431247da15

SHA256
73b0f3952be222ce676672603ae3848ee6e8e479782bd06745116712a4834c53

SHA512
bd2f27441fe5c25c30bab22c967ef32306bcea2f6be6f4a5da8bbb5b54d3d5f59da1ffcb55172d2413fe0235dd7702d734654956e142e9a0810160b8c16225f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\python310.dll

Filesize
1.4MB

MD5
65015e7bf59f0af4f74f8462112e0ba2

SHA1
a3ce5d867b3f0ad81e7dad089db814d76400493d

SHA256
6f2c1c5ba0392319d41b8a4869053274cc728a05b3ee30dfc8bcf038a6c017fc

SHA512
cb0929d1e92ae6a12ad823b9faf7478b02b91e187300091a123d1c0e95e7fa7def54faa1fc2daacf4161e3922429ba8f711ae3220b01d3395fff8a7c28f96e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\select.pyd

Filesize
25KB

MD5
e0a855db8474495ce9238979c039f478

SHA1
6b3a59fe7182edd163e59eb531ec4ac517460484

SHA256
0bc51424b93dc18be35e389ad606652aec68572ff08ebfd516f5f42928ddfb55

SHA512
8e0f1e4d9bd58c7cc3cc2481d508adfa444f81c195b1250a0276309f94487afba5caea8705e53276705f6c026d8fa1fca5bdb00cc445b13ca8f8f49c8836c81c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\sqlite3.dll

Filesize
622KB

MD5
6663e140c48c1bd8e46bf7e9610fcca3

SHA1
3e578a189da2e0350f742b8516bcc72dd5c60769

SHA256
01f9bde5bd9d624be23a99df4294c95103c0991b8721911f49b13ad404ecd053

SHA512
368043480e3348f16cbb578b348dfde3bfa5f51a5a522456f5b45ba98069832448895e3a9e40e0edcb99a5c04aaadcff335bb1ac5316d3d6dd0d3ed8967b3fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\unicodedata.pyd

Filesize
289KB

MD5
4021bb6237c14966298289f40c9a40b2

SHA1
cca509bb914b0f1a0ffca3b5b754946424c1d3dd

SHA256
1c09244a4c7e61fe05d4633f4cb1525f3dd8e550953fc823e9f996c57c838cb0

SHA512
23cfc1430ae0d4c662154d6f1d35d7b46914fd79ad5ce065c0c5fe2ff36233c54c9ae38dcf2075daa6e46da03f935b25335cc17b2289178c2fd1c0250601b8b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\yarl\_helpers_c.cp310-win_amd64.pyd

Filesize
28KB

MD5
b118332c9151df3f6a05934059818d0e

SHA1
fca30160da127d699deb3defee4ae273e671dabb

SHA256
b4fca2a006995225fac3920bb9b47dc61d7cecc492ba56e9c1874c4afcc56d36

SHA512
5d02884098d76e4e52e9da914ffc0eb5b85af3339a3327fd3522723a891bea5cc1879231bac432039534c224661a311204b4393a5b8ffab60dd6765a56babf3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51762\yarl\_quoting_c.cp310-win_amd64.pyd

Filesize
41KB

MD5
f7acf7f14cd0f881049e774ce5c1d592

SHA1
74161470234d4ab292ad078ff85d1280b9fde28c

SHA256
00e10fe98aa2350477157fd11f11d28cdaeb85c28c34c9ff877f28ca5a176960

SHA512
4b83807de580bc3e1b2c0b715bf4f2ecac45e0f024bbe04f4fbe8e9c95d6b1baa699469832c500bee778eda2226616addec113cd6fa8cf23f100a9b02fd270ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yfadq0wi.sos.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_335907756\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\Desktop\Solara\BootstrapperV1.18.exe

Filesize
11.2MB

MD5
7b7c9af10f65f91d0dfa704b47df1ab3

SHA1
56001ae93e167310c4c93e626599b2189717ab46

SHA256
06ec992467d151d23b2574124b6e7955087c3f32a684627acb8d505938bd1220

SHA512
1280660abf697fd92610224cd09b3b0db6539acea64bc715dc2605fb17a2be706c4595183744d4cb5b5781cb5aef7d5a2ad89a5bfdceb67f27b89921cd367582

Download Submit
C:\Users\Admin\Downloads\Solara.zip

Filesize
10.7MB

MD5
d59097a6119751d315a7482761d31c96

SHA1
74df79fad98dfcd9e140aed2db8370b5f489ceae

SHA256
7188b8dab4a076febe33e04201a02daed9714fb4f4adc892921604fafc861e48

SHA512
e155411451a35251ccc54352cc0e680b8a38d56c2bcd39958c4e1bddb448fcfd8cbf5d86a53d16c4109fc0f24b689f97540045b7cf8900bb9f20d16d4ea4577f

Download Submit
memory/2696-517-0x000002653FEF0000-0x000002653FFBE000-memory.dmp

Filesize
824KB

Download
memory/5268-327-0x000001D8B5F10000-0x000001D8B600A000-memory.dmp

Filesize
1000KB

Download
memory/5268-450-0x000001D8B6480000-0x000001D8B64A2000-memory.dmp

Filesize
136KB

Download
memory/5644-400-0x00007FFDCC730000-0x00007FFDCC747000-memory.dmp

Filesize
92KB

Download
memory/5644-393-0x00007FFDCCDD0000-0x00007FFDCCDE4000-memory.dmp

Filesize
80KB

Download
memory/5644-490-0x00007FFDCC730000-0x00007FFDCC747000-memory.dmp

Filesize
92KB

Download
memory/5644-453-0x00007FFDCC750000-0x00007FFDCC772000-memory.dmp

Filesize
136KB

Download
memory/5644-345-0x00007FFDCFA30000-0x00007FFDCFA54000-memory.dmp

Filesize
144KB

Download
memory/5644-518-0x00007FFDCB460000-0x00007FFDCB4A9000-memory.dmp

Filesize
292KB

Download
memory/5644-527-0x00007FFDCC780000-0x00007FFDCC8FD000-memory.dmp

Filesize
1.5MB

Download
memory/5644-544-0x00007FFDCB400000-0x00007FFDCB438000-memory.dmp

Filesize
224KB

Download
memory/5644-546-0x00007FFDC8660000-0x00007FFDC8DFA000-memory.dmp

Filesize
7.6MB

Download
memory/5644-539-0x00007FFDCC710000-0x00007FFDCC729000-memory.dmp

Filesize
100KB

Download
memory/5644-538-0x00007FFDCC730000-0x00007FFDCC747000-memory.dmp

Filesize
92KB

Download
memory/5644-537-0x00007FFDCC750000-0x00007FFDCC772000-memory.dmp

Filesize
136KB

Download
memory/5644-536-0x00007FFDCCD10000-0x00007FFDCCD27000-memory.dmp

Filesize
92KB

Download
memory/5644-532-0x00007FFDE32A0000-0x00007FFDE32B0000-memory.dmp

Filesize
64KB

Download
memory/5644-531-0x00007FFDCCDD0000-0x00007FFDCCDE4000-memory.dmp

Filesize
80KB

Download
memory/5644-519-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp

Filesize
4.4MB

Download
memory/5644-526-0x00007FFDCCE20000-0x00007FFDCCE3F000-memory.dmp

Filesize
124KB

Download
memory/5644-520-0x00007FFDCFA30000-0x00007FFDCFA54000-memory.dmp

Filesize
144KB

Download
memory/5644-569-0x00007FFDCCDD0000-0x00007FFDCCDE4000-memory.dmp

Filesize
80KB

Download
memory/5644-566-0x00007FFDCCDF0000-0x00007FFDCCE1E000-memory.dmp

Filesize
184KB

Download
memory/5644-577-0x00007FFDCC710000-0x00007FFDCC729000-memory.dmp

Filesize
100KB

Download
memory/5644-575-0x00007FFDCC750000-0x00007FFDCC772000-memory.dmp

Filesize
136KB

Download
memory/5644-568-0x00007FFDC9FF0000-0x00007FFDCA365000-memory.dmp

Filesize
3.5MB

Download
memory/5644-567-0x00007FFDCB4B0000-0x00007FFDCB568000-memory.dmp

Filesize
736KB

Download
memory/5644-557-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp

Filesize
4.4MB

Download
memory/5644-584-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp

Filesize
4.4MB

Download
memory/5644-445-0x00007FFDCCDD0000-0x00007FFDCCDE4000-memory.dmp

Filesize
80KB

Download
memory/5644-446-0x00007FFDCCD10000-0x00007FFDCCD27000-memory.dmp

Filesize
92KB

Download
memory/5644-352-0x00007FFDCF610000-0x00007FFDCF629000-memory.dmp

Filesize
100KB

Download
memory/5644-353-0x00007FFDE68D0000-0x00007FFDE68DD000-memory.dmp

Filesize
52KB

Download
memory/5644-356-0x00007FFDCCE70000-0x00007FFDCCE88000-memory.dmp

Filesize
96KB

Download
memory/5644-363-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp

Filesize
4.4MB

Download
memory/5644-371-0x00007FFDCCE20000-0x00007FFDCCE3F000-memory.dmp

Filesize
124KB

Download
memory/5644-373-0x00007FFDCB4B0000-0x00007FFDCB568000-memory.dmp

Filesize
736KB

Download
memory/5644-374-0x00007FFDC9FF0000-0x00007FFDCA365000-memory.dmp

Filesize
3.5MB

Download
memory/5644-378-0x0000024876C70000-0x0000024876FE5000-memory.dmp

Filesize
3.5MB

Download
memory/5644-385-0x00007FFDE32A0000-0x00007FFDE32B0000-memory.dmp

Filesize
64KB

Download
memory/5644-386-0x00007FFDCCDB0000-0x00007FFDCCDC4000-memory.dmp

Filesize
80KB

Download
memory/5644-387-0x00007FFDCCD90000-0x00007FFDCCDA5000-memory.dmp

Filesize
84KB

Download
memory/5644-388-0x00007FFDCC780000-0x00007FFDCC8FD000-memory.dmp

Filesize
1.5MB

Download
memory/5644-418-0x00007FFDCCDF0000-0x00007FFDCCE1E000-memory.dmp

Filesize
184KB

Download
memory/5644-420-0x00007FFDC9FF0000-0x00007FFDCA365000-memory.dmp

Filesize
3.5MB

Download
memory/5644-419-0x00007FFDCB4B0000-0x00007FFDCB568000-memory.dmp

Filesize
736KB

Download
memory/5644-491-0x00007FFDE68E0000-0x00007FFDE68ED000-memory.dmp

Filesize
52KB

Download
memory/5644-395-0x00007FFDC9ED0000-0x00007FFDC9FE8000-memory.dmp

Filesize
1.1MB

Download
memory/5644-396-0x00007FFDCCD10000-0x00007FFDCCD27000-memory.dmp

Filesize
92KB

Download
memory/5644-397-0x00007FFDCC750000-0x00007FFDCC772000-memory.dmp

Filesize
136KB

Download
memory/5644-849-0x00007FFDCC780000-0x00007FFDCC8FD000-memory.dmp

Filesize
1.5MB

Download
memory/5644-852-0x00007FFDCCDF0000-0x00007FFDCCE1E000-memory.dmp

Filesize
184KB

Download
memory/5644-855-0x00007FFDCCDD0000-0x00007FFDCCDE4000-memory.dmp

Filesize
80KB

Download
memory/5644-867-0x00007FFDCB440000-0x00007FFDCB45E000-memory.dmp

Filesize
120KB

Download
memory/5644-866-0x00007FFDCC6F0000-0x00007FFDCC701000-memory.dmp

Filesize
68KB

Download
memory/5644-865-0x00007FFDCB460000-0x00007FFDCB4A9000-memory.dmp

Filesize
292KB

Download
memory/5644-864-0x00007FFDCC730000-0x00007FFDCC747000-memory.dmp

Filesize
92KB

Download
memory/5644-863-0x00007FFDC9ED0000-0x00007FFDC9FE8000-memory.dmp

Filesize
1.1MB

Download
memory/5644-862-0x00007FFDCCD10000-0x00007FFDCCD27000-memory.dmp

Filesize
92KB

Download
memory/5644-861-0x00007FFDCC750000-0x00007FFDCC772000-memory.dmp

Filesize
136KB

Download
memory/5644-860-0x00007FFDCC710000-0x00007FFDCC729000-memory.dmp

Filesize
100KB

Download
memory/5644-859-0x00007FFDCCD90000-0x00007FFDCCDA5000-memory.dmp

Filesize
84KB

Download
memory/5644-858-0x00007FFDCCDB0000-0x00007FFDCCDC4000-memory.dmp

Filesize
80KB

Download
memory/5644-857-0x00007FFDE32A0000-0x00007FFDE32B0000-memory.dmp

Filesize
64KB

Download
memory/5644-856-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp

Filesize
4.4MB

Download
memory/5644-854-0x00007FFDC9FF0000-0x00007FFDCA365000-memory.dmp

Filesize
3.5MB

Download
memory/5644-853-0x00007FFDCB4B0000-0x00007FFDCB568000-memory.dmp

Filesize
736KB

Download
memory/5644-851-0x00007FFDCCE20000-0x00007FFDCCE3F000-memory.dmp

Filesize
124KB

Download
memory/5644-850-0x00007FFDCCE40000-0x00007FFDCCE6C000-memory.dmp

Filesize
176KB

Download
memory/5644-848-0x00007FFDCCE70000-0x00007FFDCCE88000-memory.dmp

Filesize
96KB

Download
memory/5644-847-0x00007FFDCF610000-0x00007FFDCF629000-memory.dmp

Filesize
100KB

Download
memory/5644-846-0x00007FFDE68D0000-0x00007FFDE68DD000-memory.dmp

Filesize
52KB

Download
memory/5644-845-0x00007FFDCFA30000-0x00007FFDCFA54000-memory.dmp

Filesize
144KB

Download
memory/5644-844-0x00007FFDE6980000-0x00007FFDE698F000-memory.dmp

Filesize
60KB

Download
memory/5644-870-0x00007FFDE68E0000-0x00007FFDE68ED000-memory.dmp

Filesize
52KB

Download
memory/5644-869-0x00007FFDCB400000-0x00007FFDCB438000-memory.dmp

Filesize
224KB

Download
memory/5644-868-0x00007FFDC8660000-0x00007FFDC8DFA000-memory.dmp

Filesize
7.6MB

Download
memory/5644-401-0x00007FFDCFA30000-0x00007FFDCFA54000-memory.dmp

Filesize
144KB

Download
memory/5644-402-0x00007FFDCC710000-0x00007FFDCC729000-memory.dmp

Filesize
100KB

Download
memory/5644-409-0x00007FFDCCE40000-0x00007FFDCCE6C000-memory.dmp

Filesize
176KB

Download
memory/5644-410-0x00007FFDCB400000-0x00007FFDCB438000-memory.dmp

Filesize
224KB

Download
memory/5644-403-0x00007FFDCB460000-0x00007FFDCB4A9000-memory.dmp

Filesize
292KB

Download
memory/5644-408-0x00007FFDC8660000-0x00007FFDC8DFA000-memory.dmp

Filesize
7.6MB

Download
memory/5644-407-0x0000024876C70000-0x0000024876FE5000-memory.dmp

Filesize
3.5MB

Download
memory/5644-404-0x00007FFDCF610000-0x00007FFDCF629000-memory.dmp

Filesize
100KB

Download
memory/5644-406-0x00007FFDCB440000-0x00007FFDCB45E000-memory.dmp

Filesize
120KB

Download
memory/5644-405-0x00007FFDCC6F0000-0x00007FFDCC701000-memory.dmp

Filesize
68KB

Download
memory/5644-372-0x00007FFDCCDF0000-0x00007FFDCCE1E000-memory.dmp

Filesize
184KB

Download
memory/5644-358-0x00007FFDCCE40000-0x00007FFDCCE6C000-memory.dmp

Filesize
176KB

Download
memory/5644-346-0x00007FFDE6980000-0x00007FFDE698F000-memory.dmp

Filesize
60KB

Download
memory/5644-336-0x00007FFDCB570000-0x00007FFDCB9D6000-memory.dmp

Filesize
4.4MB

Download