exelastealer | fdb9f742ec550af9a8ca330f0a1d3aa012b1df6348e8182a52b6aac0f74a781b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ElectronV3.exe
Size

10.1MB
MD5

f625137a53ba0cb8cedb8185be877581
SHA1

343cb28c637aba4b058d0d0ad9b2a527ef596dcf
SHA256

fdb9f742ec550af9a8ca330f0a1d3aa012b1df6348e8182a52b6aac0f74a781b
SHA512

1e1bd65c14fcf64f2325dc54a38c1507cfadeeca1be126d6efc87301a4105b97657a59e9ed688fee20b171d0e2cef9693d6f0291acb5dcd2d37b898169d61b69
SSDEEP

196608:/yKypefxZlJ/TLx4hz7DIxyseNaHFJMIDJ+gsAGKkRrDTNfPT:qY7bTGz7kc6Fqy+gs17l

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3220	netsh.exe
3208	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2128	cmd.exe
4540	powershell.exe

Loads dropped DLL 33 IoCs

pid	Process
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe
2404	ElectronV3.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
26	discord.com
27	discord.com
29	discord.com
48	discord.com
53	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2512	cmd.exe
4408	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
2080	tasklist.exe
2724	tasklist.exe
4556	tasklist.exe
4140	tasklist.exe
380	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4652	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023c01-47.dat	upx
behavioral2/memory/2404-51-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp	upx
behavioral2/files/0x000a000000023b85-53.dat	upx
behavioral2/memory/2404-59-0x00007FF9113F0000-0x00007FF911414000-memory.dmp	upx
behavioral2/files/0x0008000000023bcd-58.dat	upx
behavioral2/memory/2404-61-0x00007FF911330000-0x00007FF91133F000-memory.dmp	upx
behavioral2/files/0x0008000000023bcc-62.dat	upx
behavioral2/files/0x0008000000023bfc-63.dat	upx
behavioral2/files/0x000a000000023b8f-81.dat	upx
behavioral2/files/0x000a000000023b8e-80.dat	upx
behavioral2/files/0x000a000000023b8d-79.dat	upx
behavioral2/files/0x000a000000023b8c-78.dat	upx
behavioral2/files/0x000a000000023b8b-77.dat	upx
behavioral2/files/0x000a000000023b8a-76.dat	upx
behavioral2/files/0x000a000000023b89-75.dat	upx
behavioral2/files/0x000a000000023b88-74.dat	upx
behavioral2/files/0x000a000000023b87-73.dat	upx
behavioral2/files/0x000a000000023b86-72.dat	upx
behavioral2/files/0x000a000000023b84-71.dat	upx
behavioral2/files/0x000a000000023b83-70.dat	upx
behavioral2/files/0x000a000000023b82-69.dat	upx
behavioral2/files/0x000a000000023b81-68.dat	upx
behavioral2/files/0x0008000000023c08-67.dat	upx
behavioral2/files/0x0008000000023c07-66.dat	upx
behavioral2/files/0x0008000000023c06-65.dat	upx
behavioral2/files/0x0008000000023bff-64.dat	upx
behavioral2/memory/2404-83-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp	upx
behavioral2/memory/2404-87-0x00007FF90F620000-0x00007FF90F639000-memory.dmp	upx
behavioral2/memory/2404-89-0x00007FF90C070000-0x00007FF90C09D000-memory.dmp	upx
behavioral2/memory/2404-91-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp	upx
behavioral2/memory/2404-85-0x00007FF90F840000-0x00007FF90F84D000-memory.dmp	upx
behavioral2/memory/2404-93-0x00007FF8FCC00000-0x00007FF8FCD71000-memory.dmp	upx
behavioral2/memory/2404-95-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp	upx
behavioral2/memory/2404-101-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp	upx
behavioral2/memory/2404-122-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp	upx
behavioral2/memory/2404-121-0x00007FF90BED0000-0x00007FF90BEE7000-memory.dmp	upx
behavioral2/files/0x0008000000023c21-120.dat	upx
behavioral2/memory/2404-119-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp	upx
behavioral2/memory/2404-118-0x00007FF8FC6A0000-0x00007FF8FC7B8000-memory.dmp	upx
behavioral2/files/0x0008000000023c20-116.dat	upx
behavioral2/memory/2404-113-0x00007FF90BEF0000-0x00007FF90BF04000-memory.dmp	upx
behavioral2/memory/2404-111-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp	upx
behavioral2/files/0x0008000000023bfe-110.dat	upx
behavioral2/memory/2404-109-0x00007FF90C660000-0x00007FF90C670000-memory.dmp	upx
behavioral2/memory/2404-108-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp	upx
behavioral2/memory/2404-105-0x00007FF90C000000-0x00007FF90C015000-memory.dmp	upx
behavioral2/memory/2404-103-0x00007FF9113F0000-0x00007FF911414000-memory.dmp	upx
behavioral2/memory/2404-100-0x00007FF8FCB40000-0x00007FF8FCBF8000-memory.dmp	upx
behavioral2/memory/2404-99-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-124.dat	upx
behavioral2/memory/2404-126-0x00007FF90BB40000-0x00007FF90BB57000-memory.dmp	upx
behavioral2/memory/2404-125-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp	upx
behavioral2/files/0x000a000000023b92-131.dat	upx
behavioral2/files/0x0008000000023bcb-136.dat	upx
behavioral2/files/0x000a000000023b94-133.dat	upx
behavioral2/files/0x000a000000023b93-129.dat	upx
behavioral2/memory/2404-137-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp	upx
behavioral2/memory/2404-143-0x00007FF90C110000-0x00007FF90C12E000-memory.dmp	upx
behavioral2/memory/2404-145-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp	upx
behavioral2/memory/2404-144-0x00007FF8FB780000-0x00007FF8FBF1A000-memory.dmp	upx
behavioral2/memory/2404-142-0x00007FF90C130000-0x00007FF90C13A000-memory.dmp	upx
behavioral2/memory/2404-141-0x00007FF90C140000-0x00007FF90C151000-memory.dmp	upx
behavioral2/memory/2404-140-0x00007FF90C210000-0x00007FF90C25D000-memory.dmp	upx
behavioral2/memory/2404-139-0x00007FF90B950000-0x00007FF90BA1F000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1868	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3772	netsh.exe
3904	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1284	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3724	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4412	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4768	ipconfig.exe
1284	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2740	systeminfo.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2552	schtasks.exe
2776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4540	powershell.exe
4540	powershell.exe
4540	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4412	WMIC.exe
Token: SeSecurityPrivilege	4412	WMIC.exe
Token: SeTakeOwnershipPrivilege	4412	WMIC.exe
Token: SeLoadDriverPrivilege	4412	WMIC.exe
Token: SeSystemProfilePrivilege	4412	WMIC.exe
Token: SeSystemtimePrivilege	4412	WMIC.exe
Token: SeProfSingleProcessPrivilege	4412	WMIC.exe
Token: SeIncBasePriorityPrivilege	4412	WMIC.exe
Token: SeCreatePagefilePrivilege	4412	WMIC.exe
Token: SeBackupPrivilege	4412	WMIC.exe
Token: SeRestorePrivilege	4412	WMIC.exe
Token: SeShutdownPrivilege	4412	WMIC.exe
Token: SeDebugPrivilege	4412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4412	WMIC.exe
Token: SeRemoteShutdownPrivilege	4412	WMIC.exe
Token: SeUndockPrivilege	4412	WMIC.exe
Token: SeManageVolumePrivilege	4412	WMIC.exe
Token: 33	4412	WMIC.exe
Token: 34	4412	WMIC.exe
Token: 35	4412	WMIC.exe
Token: 36	4412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5048	WMIC.exe
Token: SeSecurityPrivilege	5048	WMIC.exe
Token: SeTakeOwnershipPrivilege	5048	WMIC.exe
Token: SeLoadDriverPrivilege	5048	WMIC.exe
Token: SeSystemProfilePrivilege	5048	WMIC.exe
Token: SeSystemtimePrivilege	5048	WMIC.exe
Token: SeProfSingleProcessPrivilege	5048	WMIC.exe
Token: SeIncBasePriorityPrivilege	5048	WMIC.exe
Token: SeCreatePagefilePrivilege	5048	WMIC.exe
Token: SeBackupPrivilege	5048	WMIC.exe
Token: SeRestorePrivilege	5048	WMIC.exe
Token: SeShutdownPrivilege	5048	WMIC.exe
Token: SeDebugPrivilege	5048	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5048	WMIC.exe
Token: SeRemoteShutdownPrivilege	5048	WMIC.exe
Token: SeUndockPrivilege	5048	WMIC.exe
Token: SeManageVolumePrivilege	5048	WMIC.exe
Token: 33	5048	WMIC.exe
Token: 34	5048	WMIC.exe
Token: 35	5048	WMIC.exe
Token: 36	5048	WMIC.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4412	WMIC.exe
Token: SeSecurityPrivilege	4412	WMIC.exe
Token: SeTakeOwnershipPrivilege	4412	WMIC.exe
Token: SeLoadDriverPrivilege	4412	WMIC.exe
Token: SeSystemProfilePrivilege	4412	WMIC.exe
Token: SeSystemtimePrivilege	4412	WMIC.exe
Token: SeProfSingleProcessPrivilege	4412	WMIC.exe
Token: SeIncBasePriorityPrivilege	4412	WMIC.exe
Token: SeCreatePagefilePrivilege	4412	WMIC.exe
Token: SeBackupPrivilege	4412	WMIC.exe
Token: SeRestorePrivilege	4412	WMIC.exe
Token: SeShutdownPrivilege	4412	WMIC.exe
Token: SeDebugPrivilege	4412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4412	WMIC.exe
Token: SeRemoteShutdownPrivilege	4412	WMIC.exe
Token: SeUndockPrivilege	4412	WMIC.exe
Token: SeManageVolumePrivilege	4412	WMIC.exe
Token: 33	4412	WMIC.exe
Token: 34	4412	WMIC.exe
Token: 35	4412	WMIC.exe
Token: 36	4412	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2404	756	ElectronV3.exe	83
PID 756 wrote to memory of 2404	756	ElectronV3.exe	83
PID 2404 wrote to memory of 3980	2404	ElectronV3.exe	84
PID 2404 wrote to memory of 3980	2404	ElectronV3.exe	84
PID 2404 wrote to memory of 3716	2404	ElectronV3.exe	86
PID 2404 wrote to memory of 3716	2404	ElectronV3.exe	86
PID 2404 wrote to memory of 1768	2404	ElectronV3.exe	88
PID 2404 wrote to memory of 1768	2404	ElectronV3.exe	88
PID 2404 wrote to memory of 3296	2404	ElectronV3.exe	89
PID 2404 wrote to memory of 3296	2404	ElectronV3.exe	89
PID 2404 wrote to memory of 2756	2404	ElectronV3.exe	91
PID 2404 wrote to memory of 2756	2404	ElectronV3.exe	91
PID 3716 wrote to memory of 4412	3716	cmd.exe	94
PID 3716 wrote to memory of 4412	3716	cmd.exe	94
PID 1768 wrote to memory of 5048	1768	cmd.exe	95
PID 1768 wrote to memory of 5048	1768	cmd.exe	95
PID 2756 wrote to memory of 2080	2756	cmd.exe	96
PID 2756 wrote to memory of 2080	2756	cmd.exe	96
PID 2404 wrote to memory of 4672	2404	ElectronV3.exe	98
PID 2404 wrote to memory of 4672	2404	ElectronV3.exe	98
PID 4672 wrote to memory of 2236	4672	cmd.exe	100
PID 4672 wrote to memory of 2236	4672	cmd.exe	100
PID 2404 wrote to memory of 2348	2404	ElectronV3.exe	101
PID 2404 wrote to memory of 2348	2404	ElectronV3.exe	101
PID 2404 wrote to memory of 3564	2404	ElectronV3.exe	102
PID 2404 wrote to memory of 3564	2404	ElectronV3.exe	102
PID 3564 wrote to memory of 2724	3564	cmd.exe	105
PID 3564 wrote to memory of 2724	3564	cmd.exe	105
PID 2348 wrote to memory of 4528	2348	cmd.exe	106
PID 2348 wrote to memory of 4528	2348	cmd.exe	106
PID 2404 wrote to memory of 4652	2404	ElectronV3.exe	107
PID 2404 wrote to memory of 4652	2404	ElectronV3.exe	107
PID 4652 wrote to memory of 2384	4652	cmd.exe	109
PID 4652 wrote to memory of 2384	4652	cmd.exe	109
PID 2404 wrote to memory of 3244	2404	ElectronV3.exe	110
PID 2404 wrote to memory of 3244	2404	ElectronV3.exe	110
PID 3244 wrote to memory of 5092	3244	cmd.exe	112
PID 3244 wrote to memory of 5092	3244	cmd.exe	112
PID 2404 wrote to memory of 4604	2404	ElectronV3.exe	113
PID 2404 wrote to memory of 4604	2404	ElectronV3.exe	113
PID 4604 wrote to memory of 2552	4604	cmd.exe	115
PID 4604 wrote to memory of 2552	4604	cmd.exe	115
PID 2404 wrote to memory of 4692	2404	ElectronV3.exe	116
PID 2404 wrote to memory of 4692	2404	ElectronV3.exe	116
PID 4692 wrote to memory of 2776	4692	cmd.exe	120
PID 4692 wrote to memory of 2776	4692	cmd.exe	120
PID 2404 wrote to memory of 4376	2404	ElectronV3.exe	121
PID 2404 wrote to memory of 4376	2404	ElectronV3.exe	121
PID 2404 wrote to memory of 4380	2404	ElectronV3.exe	122
PID 2404 wrote to memory of 4380	2404	ElectronV3.exe	122
PID 4380 wrote to memory of 4556	4380	cmd.exe	125
PID 4380 wrote to memory of 4556	4380	cmd.exe	125
PID 4376 wrote to memory of 2004	4376	cmd.exe	126
PID 4376 wrote to memory of 2004	4376	cmd.exe	126
PID 2404 wrote to memory of 3480	2404	ElectronV3.exe	127
PID 2404 wrote to memory of 3480	2404	ElectronV3.exe	127
PID 2404 wrote to memory of 4832	2404	ElectronV3.exe	128
PID 2404 wrote to memory of 4832	2404	ElectronV3.exe	128
PID 2404 wrote to memory of 2036	2404	ElectronV3.exe	129
PID 2404 wrote to memory of 2036	2404	ElectronV3.exe	129
PID 2404 wrote to memory of 2128	2404	ElectronV3.exe	131
PID 2404 wrote to memory of 2128	2404	ElectronV3.exe	131
PID 3480 wrote to memory of 4804	3480	cmd.exe	135
PID 3480 wrote to memory of 4804	3480	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2384	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
  "C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:2384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /TN "ExelaUpdateService"
      4⤵
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:4804
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4832
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:396
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2036
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:2512
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2740
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:3724
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:4876
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:4860
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:2540
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:632
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:640
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:5092
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:1500
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:4320
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:4220
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:968
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:1380
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:4548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:4692
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:380
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4768
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:1536
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:4408
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1284
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:1868
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3220
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3904
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1468
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupOpen.odt

Filesize
571KB

MD5
c979e8c62e2a69ab6daa60fe5ba4ab54

SHA1
4012f23e4fa81bc3713e0ba9b57b8d519ed1528f

SHA256
450fae2520cdd94e2e8f9e11e4e7c3a88b6ce3d6763285afaede983cb4b559ba

SHA512
70d8cd5b00247ecdce79b3cdad20f6d7243ef738b06bf21177ca6b0912e88eb5c9741fe9604c0550c46119f29dd9d8da477851c2c2a90f1130fc63971458edba

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BlockSwitch.png

Filesize
380KB

MD5
ca96f3295e79246f9d17122aa25c737a

SHA1
0b9278297c84d2e645a23a0938de305091bdb236

SHA256
03bec7fafc445bb734fbb57dd4eaf64a2ac47789af9648c31ae7a9ded47854db

SHA512
db8d596e8bdf19e492e3447f390998ab0230ff59a80f3978790ea721609048ab5eea234e118920f223b78d10fde5766881a74d50ef8a58a1e71b1baab01a3c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\JoinStart.xls

Filesize
602KB

MD5
1ef93a0a15097834c6b676eaed705b18

SHA1
a05fd53c7bb8faa496ea78c86fa75c9c0eda7a08

SHA256
dac475c1e4d1f2b035e73bc41d1f0513c838ceed55057a726e96b817fc403a9e

SHA512
b99c8e60bd8be9f80e54683331a1dad9a15eddc39fe80bdb2e01c3a9c35b40f5d0bffe40cd3a8adc2a84bb06f03a741ee12fcce7b2a566d993b10045dd17941a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\MeasureCheckpoint.docx

Filesize
729KB

MD5
616ee35eff8b91a4b381a3c91267cbda

SHA1
0cae4ab267b79aa4ec7fa7d0dcfd46fc6f0cff0c

SHA256
980cc4d1b3ded997e50e02260813782e49a609f8927b1e80c0e189253f1b34e1

SHA512
2aa7600b916308b5ec587f08a069c3496997f9ea699acf3fc6693862d73ba8eaa45e87b6d16fc39a0c33bd9b5294e649ca8975057076365ad8be91bb315d1287

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RegisterUnlock.xlsx

Filesize
11KB

MD5
3d9182c22b821063dbeb8218bb68b78f

SHA1
b68e39b73aeff60e02e9118d00962f6841224053

SHA256
5f3400fd532ee0dc7c839527e5601729603b3435d1abc7ffba4f8df0dc457aaf

SHA512
754cdc8826c5382e3327ccadf56555a1d9335691c24023e1ff80947dfa99e21c0186783c9c597fa23b2dc401057c1317258e91bc8bd7a718709db08fa618421a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RepairOut.docx

Filesize
983KB

MD5
a54cf9a4c2e286875588b1d51bc21b74

SHA1
ff344d17ca61da34e9c39fb21f9402177d93db85

SHA256
b85015a77491a345acf51db1be199f026d0f6c439eeaa2ad0c20cfe2926e39b7

SHA512
a82b36c64340003584d8c0b9bba8cca5c9dd5b139cfc9576f2d996dd6e7b5f28574e7e87e6badfe052c7f5a1dd0ac5351ab1f2d38726bf74f2403c9529c0dd3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\EnableClear.pdf

Filesize
660KB

MD5
df7a6651643e75535d8412c6c0970d79

SHA1
af51989bebe2d5db9c34876605c8d88f0054105d

SHA256
1e0befc73d0fee48e0b314a0551ad4c4f4daec583dd8166888f011cad4dc8d8e

SHA512
cad9310f8a99a5591e091d1afe00a6a0e5a13c925b6ea19a57772fd0e87fe6732d90e5cb436dd759379a0d290eca1e50b627a647a131638d9f597c48510f9cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ExpandMerge.docx

Filesize
17KB

MD5
17707217425a96d8eddd3d28fe0eeb4a

SHA1
0cfee4f1efde573d727458bfbe2bd7a8c8e266b5

SHA256
517e16aaa73d9b37d71874e019708f417fef82c760a3915118af65a27d5a1257

SHA512
87af23b4031275b5ac155c05dbd5ef518be5801e1061636749eff3dea622f08a8ecbd5111842037d0d81e135908b21ab3e9b757e607835b8b785ba1bf847d112

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RevokeCopy.xlsx

Filesize
9KB

MD5
06c55f886dc268454760efa293731270

SHA1
38fd70dab141ec190477152a881e47035281110b

SHA256
609001d0300aff78fe13ed61aa01221490f1f60c8c252c4f8f4903dfe909deb2

SHA512
ac97e130510df19b8bfd223c69b0d44d038fb9784a4b14d7dfe3f59bd917f84a8822a46e3fb00e9e48927502231f02df30068b848b304150c1cee4b240846f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupNew.svg

Filesize
383KB

MD5
897cc5a0dbd35ec8ddff4a5042f7e286

SHA1
859ee6e5c94a796d270bd00a45b59c6c2378a8b1

SHA256
0efc6cd5b567fca29acc63854373830793655bb64351ebfb6d2741c842b58965

SHA512
3aa526827c873ed3c059418c96462d25acd0f37a4c70da4d063da650513e9b76cdc5a02e2e89bd542b52dc87f5d258d9a3d2f1a72848ac3028648bec6232bae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupSync.xltm

Filesize
570KB

MD5
f3d89ee7bcb886e18f9194703d6a1547

SHA1
4fd72045df770f4ce3ec408dd52a0aadc8baa734

SHA256
dfb7cdbd6263d4afb0122b8f75a6734adb8198faf5858251ef11dad95bd729cd

SHA512
07555a723515a9f7269478c903ab5b6ee8bc29840f4878d43e8f3ba49669419682003c4a164f65169d18d7f749c2dd17ed51347b46f0c5de624a8408da89218d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\DisconnectPublish.xls

Filesize
757KB

MD5
ba85eb58b2686bca7027f20ede8f3b81

SHA1
5c061ab8cc2254e2ae2324339983cf0bb746ebb7

SHA256
e810d4888bda39607991a7563344c5ecd25b31e36225ffd5c80b9f3afd72bdde

SHA512
9defec9bb8ed83aa13041ffd3a9cfe88b0aad3e3a6b7ff28067ccd18b69e095fc6c36ccf813452350df809f3cfac1215d6e8a0bbb7e5ef49f761001ca40c7450

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\PushGet.xlsx

Filesize
869KB

MD5
89412491be57f77e39dfc6acc5fb9b90

SHA1
65e9756a44a48b0f9b73f5c16c64021a8badd2e5

SHA256
9eb0f4ea9927b42b74c0b5acc36426e16b5503141ffb509bc5a6d6682a987cd7

SHA512
a561c3938ffe43b57986e2c4f9215ea6542a0ed1aa1cb414a1b2e84a396ce4286b648bf00a4a3a74ca8819ec9b59da2523c0d8ab28ef15a81a8d417e3a89b93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SetUse.png

Filesize
607KB

MD5
03498db36b3fea5d568773def25fa33f

SHA1
5578efe046e83c64f3a0abb8f48a69d26ecdccdf

SHA256
216d6228e9651496c10671721c116ede7d227256f4e1b916597cdf6869716b07

SHA512
e78bf7eb626ccd29ad4c258ba3c55ae9fbb07c12ad39abb014befacfe45640b4b68446b5d453018b75f09e63508ce7c6bf2806af58577c444417db781996008f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnlockOpen.jpg

Filesize
476KB

MD5
9e9986a555a2f133e370c9549fc04ad6

SHA1
cf81305fe34685f9a6a518eb1adf00813d898952

SHA256
65b9241c08317a772b8a515f5c596f1c910d945765c420a7f2d4b6d2b4fd8e97

SHA512
946f852a9e98a711f062879891f270ad2dcebc9c9d068ec2f4fe75e7a662ca80bc0ca81825b661c6f055ce406dd247b24f89925f37152162cced07af3822e379

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnregisterWait.jpg

Filesize
420KB

MD5
8e5201a34fb9d77150f4b49c1adc9a77

SHA1
725c9853fbfd2dacf6de5c6e10151e2f792089bc

SHA256
56bf19e4124d041c482df3f07817312951824e0c45d35857dbe44091f87b7706

SHA512
c39cd67dcfb81af953cba6cd81c1046601b2ca3ecdf0a3ab894a9bc5fe5fd5729b6712a2c9ef94a37ae961f955d1967d73799be5757e98756265d1f54a93cee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConnectBackup.tif

Filesize
654KB

MD5
31dd47e6810b07caff575eb53cfeeae1

SHA1
25e9971558de91e51b50ae27dd1d8e92c9ca29ee

SHA256
f6a06f2ccdc1d5ac0582ad4fdd15afd523f985eea2e20ebf0897e8d7ad21ca73

SHA512
6daeb79edf19d9639fd1980a61e8cbc79fe5e033e55bad9c5e92cbbf69ca802b7aac0520f5be3bb8e4ddd3d03acf4a3b1f1539bf0286d0699f101a459df39904

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\LimitGrant.jpg

Filesize
323KB

MD5
6aa959814bc8c8baebf96991f2cfb4d3

SHA1
6d06f53a363ca6a39d6042d1bd5291c73ba8d41e

SHA256
09f25e2126e969f4c1e374fae2e79783a776682c7871eef0b8de90e19e123099

SHA512
e6ad2b1034eff57ac0ac0be293f2426b175adf5cd50b8e5921a264fa5bd3dd8115606c574ab0103597184693c5cd12e705f9cb00dd92d485c0a29830c1ec4279

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\PingInstall.jpeg

Filesize
504KB

MD5
dcb0634bfc4f2b06b8c6f30502eb00e9

SHA1
2e85301bc4c5ac48e4aa9b6decb1d1ebb43b3be4

SHA256
0ebc0b129f6593d7858544ba3c4972dcc90ba6eecb223f9ae92bc93d1dbc2c35

SHA512
51c677a36fca687a7058ba0f2dce6dd6f586e0ed640e5d665a3ff9fab249a3c69b0277822396dc938060dc442d73d1b82a76b541af3364c8f0023be5e1e14d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ResetDeny.jpg

Filesize
729KB

MD5
8d20ca114472cd122b4e84cdc27ee647

SHA1
d4921b0b89d97a4fd63737141f9b3659df60ec16

SHA256
dd45031c93467c41ca11c15dff7e96066cb58b3d59f450ffe3e6ad58bfb74e64

SHA512
dd47ebb4040ee88ca269b1aa1e9780e985c228be83700b6e84e7a51e73ece57437719c241747940ced3db40585f3f1f8dbc23f4f22be25d2f7f5724d77f129ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SetUse.jpeg

Filesize
519KB

MD5
65bda4ba239082565b3107b3ce5652b4

SHA1
5aea1462520cae0b21e5e2e3b5b2ad32bbc3e823

SHA256
21840eaf473632bb7dc7ef071dedf6c0b4f5fb147a4fd119356e0858bede30e0

SHA512
a9b07fc6c257cbc43763f5a59b1874542d7d7711d5ff7c657cde204803dedb1d5f9ca08dbbbea956c825653fb88a16e2d162af1cad1bc711eb1c1d9ec3887011

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SuspendLock.jpeg

Filesize
263KB

MD5
d0add0b226a771f2a46f4ed662a44af1

SHA1
c177921129040f3f6399fcda68637f479aad6b25

SHA256
1e31c75035e58b1777a46e57d4f9a9475207cca25f382e3ea3ed13e0c6064c21

SHA512
6551760eddb6f98d79d605aa993cd14621aa267bca34e5670f5e2502ae2c418a3c7a7501fdcc464199008cff63c8116cf946a5210984731df427228f07ddb88a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_asyncio.pyd

Filesize
34KB

MD5
7d4f9a2b793e021f7e37b8448751ed4e

SHA1
0ea07b5024501aad5008655cfeae6d96b5da957a

SHA256
2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4

SHA512
af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_brotli.cp310-win_amd64.pyd

Filesize
274KB

MD5
94c13e0636646019a4c7d405c2d919df

SHA1
8ed8519e9b310f59e5b40f3c8fb675791cae09f9

SHA256
10517c02bb69dafd60053152e65d00c02e24952f63ca230af807ec6b2053f2a6

SHA512
82fba52c4db4206f7a1ebb1a3ebf12fc60f3deff4763fd5a059b00f46aa7513279da994a815a0883ce3301c3cdd1d20923db21b926c43b2ee732c28852979945

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_bz2.pyd

Filesize
46KB

MD5
6250a28b9d0bfefc1254bd78ece7ae9f

SHA1
4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd

SHA256
7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b

SHA512
6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_cffi_backend.cp310-win_amd64.pyd

Filesize
71KB

MD5
7727212e7bdbf63b1a39fb7faad24265

SHA1
a8fdec19d6690081b2bf55247e8e17657a68ac97

SHA256
b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c

SHA512
2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_ctypes.pyd

Filesize
56KB

MD5
4b90108fabdd64577a84313c765a2946

SHA1
245f4628683a3e18bb6f0d1c88aa26fb959ed258

SHA256
e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1

SHA512
91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_decimal.pyd

Filesize
103KB

MD5
20985dc78dbd1992382354af5ca28988

SHA1
385a3e7a7654e5e4c686399f3a72b235e941e311

SHA256
f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43

SHA512
61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_hashlib.pyd

Filesize
33KB

MD5
3b5530f497ff7c127383d0029e680c35

SHA1
fb5dc554bb9ff49622184cc16883a7567115c7ca

SHA256
5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573

SHA512
12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_lzma.pyd

Filesize
84KB

MD5
8edbeeccb6f3dbb09389d99d45db5542

SHA1
f7e7af2851a5bf22de79a24fe594b5c0435fca8a

SHA256
90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f

SHA512
2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_multiprocessing.pyd

Filesize
25KB

MD5
4fbc5fd5da9da74c04fe0374387b34d3

SHA1
1e9c98db0486f98fb7d8eb9fa57a949494b649b5

SHA256
b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950

SHA512
ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_overlapped.pyd

Filesize
30KB

MD5
5c1441f6ee11632183a83dac2d22853b

SHA1
eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2

SHA256
104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf

SHA512
e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_queue.pyd

Filesize
24KB

MD5
5c4c43763fb1a796134aa5734905c891

SHA1
44a5e1ae4806406a239129d77888bd87d291a410

SHA256
4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c

SHA512
07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_socket.pyd

Filesize
41KB

MD5
53e72716073038c1dd1db65bfdb1254c

SHA1
7bf220a02a3b51aa51300b3a9ea7fa48358ca161

SHA256
e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d

SHA512
c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_sqlite3.pyd

Filesize
48KB

MD5
e7d68df8f65fbb0298a45519e2336f32

SHA1
ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d

SHA256
2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79

SHA512
626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_ssl.pyd

Filesize
60KB

MD5
7e9d95ac47a2284706318656b4f711d3

SHA1
f085104709201c6e64635aeacf1da51599054e55

SHA256
38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9

SHA512
294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\_uuid.pyd

Filesize
21KB

MD5
59cfd9669367517b384922b2485cb6a7

SHA1
1bd44298543204d61d4efd2cd3980ad01071360d

SHA256
e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f

SHA512
d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_helpers.cp310-win_amd64.pyd

Filesize
26KB

MD5
543e83e6396cae6570f30eb0b07dbd85

SHA1
330c63d832b06cd94de04cdb9c3777b5fc0daf9c

SHA256
37f70d7409d0ff362ba1fdfc7717ed220f6b03cdbf04665b9a29a164cadc6384

SHA512
b5a7549d92c93861ba68b72f3d9e02de4c09b7ae41fba204604910c4e05bc88b8e32c40ae999cf3ccaabb3c6aee4618d285dc060c9f08a9a70d0ee31f1ff4d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_http_parser.cp310-win_amd64.pyd

Filesize
81KB

MD5
899af4aa2d81d3ef292518511b1dcec5

SHA1
a24d25f12b0e6cd68d4385f6227dcb686f223170

SHA256
533b97f4363ddd5a7d43cadd835404ff23b2ad9fe9a79fbed4b1ce9c12f0cebd

SHA512
cfec8c07c23a2a4ff29e366216494d48061be6c28ab0cde0fdaae04c648292170855491bee678116e9e76ccf3821781f776f03cf09896e5f0530c753999b0342

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_http_writer.cp310-win_amd64.pyd

Filesize
24KB

MD5
d77dcee3f14c440a8759afa058a12f89

SHA1
e106cb383a0116079e64d881efd172f2c1e53da4

SHA256
dcb467aad3b7281c04489c2fcb499a8f63b081d1388a8fde482a3392667e6391

SHA512
5327cc895467061159891e85da61dc6c0287a6961d820878d88b23514a81fdb7e01103e025e8e0cb74d3918725d128427c06c4749e7d33ad883ac0ed99335a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_websocket.cp310-win_amd64.pyd

Filesize
20KB

MD5
6d0b455fc452f5ab428cca27ba603e46

SHA1
d3ff9006c48217306808c2bf3ab1cc5ba0505369

SHA256
e8129a7262e537ce6377d6e58f047ec5c69216e4a7bee588d4c69578bb01be8b

SHA512
48873a1ee4871f0ad0d28aa0f58ed027cd11484caa232de8534260a2fd231a58bec939d851a5ee6bba788d939b696485136c3ee24e8b9f94db9803dcab6b169e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\base_library.zip

Filesize
859KB

MD5
5c712503cdf703ab569b2397371c9723

SHA1
07d5109714feee34f7386072ac87f3f70289cab6

SHA256
a995fcaada1fc114583e23d14dd0f5deeb03edda005c9d57934346fc66837841

SHA512
c6a51c9e4e9aadde6bebb564181fb72928ec42ff3aed1833bb4676871eaf398b497bc03a0f1cdfbbd7545585d438763d19a5411ea5bcf021383fad1124307596

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\frozenlist\_frozenlist.cp310-win_amd64.pyd

Filesize
36KB

MD5
6106b4d1eec11d2a71def28d2a2afa46

SHA1
e10039eff42f88a2cd8dfe11d428c35f6178c6ce

SHA256
19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da

SHA512
d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\libffi-7.dll

Filesize
23KB

MD5
d50ebf567149ead9d88933561cb87d09

SHA1
171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

SHA256
6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

SHA512
7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
7f691747ce66d3ed05a7c2c53220c8b5

SHA1
1d3f247042030cf8cf7c859002941beba5d15776

SHA256
7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228

SHA512
b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\pyexpat.pyd

Filesize
86KB

MD5
46331749084f98bcfe8631d74c5e038f

SHA1
5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347

SHA256
21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df

SHA512
edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\python3.DLL

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\python310.dll

Filesize
1.4MB

MD5
fc7bd515b12e537a39dc93a09b3eaad6

SHA1
96f5d4b0967372553cb106539c5566bc184f6167

SHA256
461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

SHA512
a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\select.pyd

Filesize
24KB

MD5
3797a47a60b606e25348c67043874fe8

SHA1
63a33fedffd52190236a6acd0fc5d9d491e3ac45

SHA256
312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac

SHA512
3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\sqlite3.dll

Filesize
608KB

MD5
6a3a34c9c67efd6c17d44292e8db8fad

SHA1
339b1e514d60d8370eaec1e2f2b71cead999f970

SHA256
7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9

SHA512
6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\unicodedata.pyd

Filesize
287KB

MD5
fed35db31377d515d198e5e446498be2

SHA1
62e388d17e17208ea0e881ccd96c75b7b1fbc5f7

SHA256
af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b

SHA512
0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\yarl\_helpers_c.cp310-win_amd64.pyd

Filesize
27KB

MD5
15591df44ee64cb8772f1a5583465094

SHA1
7c75d1f1e234e00d0023d803642d4fedce3b7b80

SHA256
1de4a743bf1182dcfd04942696201ad1a3babd9455adafa2283709a1f3dcbaf1

SHA512
6f65bfcfdb155841ebc58494f947218a17e06b370c39b289cb86aba6d8f0ce9aab71bb8fe74b3c37f4049f99b9097718c718a337a2da2a98d6445fa24c143a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7562\yarl\_quoting_c.cp310-win_amd64.pyd

Filesize
41KB

MD5
e73b7c4ab697651094b83841e21370a0

SHA1
3093c418051c4d4e32ddb041ebcd7920cd77a191

SHA256
4ed26f8531dfb4a33d88ccb591a36fbbb25f28ce4720a92e840897316b01ac5d

SHA512
4846a981773c89bbdb5999e4472ec7f25d359e8bb16528a059b925078e0896d476e125b6cfede022a4ecce53cce30e001e2d1bcc90d03a0b2de29e6c6c8eba49

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrmjvfev.get.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2404-101-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

Filesize
3.5MB

Download
memory/2404-111-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp

Filesize
80KB

Download
memory/2404-137-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

Filesize
3.5MB

Download
memory/2404-138-0x0000021BF9060000-0x0000021BF93D5000-memory.dmp

Filesize
3.5MB

Download
memory/2404-143-0x00007FF90C110000-0x00007FF90C12E000-memory.dmp

Filesize
120KB

Download
memory/2404-145-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

Filesize
100KB

Download
memory/2404-144-0x00007FF8FB780000-0x00007FF8FBF1A000-memory.dmp

Filesize
7.6MB

Download
memory/2404-142-0x00007FF90C130000-0x00007FF90C13A000-memory.dmp

Filesize
40KB

Download
memory/2404-141-0x00007FF90C140000-0x00007FF90C151000-memory.dmp

Filesize
68KB

Download
memory/2404-140-0x00007FF90C210000-0x00007FF90C25D000-memory.dmp

Filesize
308KB

Download
memory/2404-139-0x00007FF90B950000-0x00007FF90BA1F000-memory.dmp

Filesize
828KB

Download
memory/2404-147-0x00007FF90C0D0000-0x00007FF90C107000-memory.dmp

Filesize
220KB

Download
memory/2404-146-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

Filesize
84KB

Download
memory/2404-196-0x00007FF90C0C0000-0x00007FF90C0CD000-memory.dmp

Filesize
52KB

Download
memory/2404-126-0x00007FF90BB40000-0x00007FF90BB57000-memory.dmp

Filesize
92KB

Download
memory/2404-604-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp

Filesize
124KB

Download
memory/2404-213-0x00007FF90BED0000-0x00007FF90BEE7000-memory.dmp

Filesize
92KB

Download
memory/2404-214-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

Filesize
136KB

Download
memory/2404-215-0x00007FF90BB40000-0x00007FF90BB57000-memory.dmp

Filesize
92KB

Download
memory/2404-224-0x00007FF8FCC00000-0x00007FF8FCD71000-memory.dmp

Filesize
1.4MB

Download
memory/2404-245-0x00007FF90C210000-0x00007FF90C25D000-memory.dmp

Filesize
308KB

Download
memory/2404-246-0x00007FF8FB780000-0x00007FF8FBF1A000-memory.dmp

Filesize
7.6MB

Download
memory/2404-243-0x00007FF90C0D0000-0x00007FF90C107000-memory.dmp

Filesize
220KB

Download
memory/2404-237-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

Filesize
100KB

Download
memory/2404-229-0x00007FF90C660000-0x00007FF90C670000-memory.dmp

Filesize
64KB

Download
memory/2404-228-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

Filesize
84KB

Download
memory/2404-223-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp

Filesize
124KB

Download
memory/2404-217-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

Filesize
144KB

Download
memory/2404-216-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

Filesize
4.4MB

Download
memory/2404-278-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

Filesize
100KB

Download
memory/2404-269-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

Filesize
84KB

Download
memory/2404-266-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

Filesize
184KB

Download
memory/2404-275-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

Filesize
136KB

Download
memory/2404-268-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

Filesize
3.5MB

Download
memory/2404-267-0x00007FF8FCB40000-0x00007FF8FCBF8000-memory.dmp

Filesize
736KB

Download
memory/2404-257-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

Filesize
4.4MB

Download
memory/2404-99-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

Filesize
4.4MB

Download
memory/2404-100-0x00007FF8FCB40000-0x00007FF8FCBF8000-memory.dmp

Filesize
736KB

Download
memory/2404-102-0x0000021BF9060000-0x0000021BF93D5000-memory.dmp

Filesize
3.5MB

Download
memory/2404-103-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

Filesize
144KB

Download
memory/2404-105-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

Filesize
84KB

Download
memory/2404-108-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp

Filesize
100KB

Download
memory/2404-109-0x00007FF90C660000-0x00007FF90C670000-memory.dmp

Filesize
64KB

Download
memory/2404-125-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

Filesize
184KB

Download
memory/2404-113-0x00007FF90BEF0000-0x00007FF90BF04000-memory.dmp

Filesize
80KB

Download
memory/2404-118-0x00007FF8FC6A0000-0x00007FF8FC7B8000-memory.dmp

Filesize
1.1MB

Download
memory/2404-119-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp

Filesize
124KB

Download
memory/2404-121-0x00007FF90BED0000-0x00007FF90BEE7000-memory.dmp

Filesize
92KB

Download
memory/2404-122-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

Filesize
136KB

Download
memory/2404-95-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

Filesize
184KB

Download
memory/2404-93-0x00007FF8FCC00000-0x00007FF8FCD71000-memory.dmp

Filesize
1.4MB

Download
memory/2404-85-0x00007FF90F840000-0x00007FF90F84D000-memory.dmp

Filesize
52KB

Download
memory/2404-91-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp

Filesize
124KB

Download
memory/2404-89-0x00007FF90C070000-0x00007FF90C09D000-memory.dmp

Filesize
180KB

Download
memory/2404-87-0x00007FF90F620000-0x00007FF90F639000-memory.dmp

Filesize
100KB

Download
memory/2404-83-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp

Filesize
100KB

Download
memory/2404-61-0x00007FF911330000-0x00007FF91133F000-memory.dmp

Filesize
60KB

Download
memory/2404-59-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

Filesize
144KB

Download
memory/2404-51-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

Filesize
4.4MB

Download
memory/2404-597-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

Filesize
4.4MB

Download
memory/2404-603-0x00007FF90C070000-0x00007FF90C09D000-memory.dmp

Filesize
180KB

Download
memory/2404-602-0x00007FF90F620000-0x00007FF90F639000-memory.dmp

Filesize
100KB

Download
memory/2404-601-0x00007FF90F840000-0x00007FF90F84D000-memory.dmp

Filesize
52KB

Download
memory/2404-600-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp

Filesize
100KB

Download
memory/2404-599-0x00007FF911330000-0x00007FF91133F000-memory.dmp

Filesize
60KB

Download
memory/2404-598-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

Filesize
144KB

Download
memory/2404-621-0x00007FF90C110000-0x00007FF90C12E000-memory.dmp

Filesize
120KB

Download
memory/2404-625-0x00007FF90C0C0000-0x00007FF90C0CD000-memory.dmp

Filesize
52KB

Download
memory/2404-624-0x00007FF90C0D0000-0x00007FF90C107000-memory.dmp

Filesize
220KB

Download
memory/2404-623-0x00007FF8FCB40000-0x00007FF8FCBF8000-memory.dmp

Filesize
736KB

Download
memory/2404-622-0x00007FF8FB780000-0x00007FF8FBF1A000-memory.dmp

Filesize
7.6MB

Download
memory/2404-620-0x00007FF90C130000-0x00007FF90C13A000-memory.dmp

Filesize
40KB

Download
memory/2404-619-0x00007FF90C140000-0x00007FF90C151000-memory.dmp

Filesize
68KB

Download
memory/2404-618-0x00007FF90C210000-0x00007FF90C25D000-memory.dmp

Filesize
308KB

Download
memory/2404-617-0x00007FF90B950000-0x00007FF90BA1F000-memory.dmp

Filesize
828KB

Download
memory/2404-616-0x00007FF90BB40000-0x00007FF90BB57000-memory.dmp

Filesize
92KB

Download
memory/2404-615-0x00007FF90BED0000-0x00007FF90BEE7000-memory.dmp

Filesize
92KB

Download
memory/2404-614-0x00007FF8FC6A0000-0x00007FF8FC7B8000-memory.dmp

Filesize
1.1MB

Download
memory/2404-613-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

Filesize
136KB

Download
memory/2404-612-0x00007FF90BEF0000-0x00007FF90BF04000-memory.dmp

Filesize
80KB

Download
memory/2404-611-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp

Filesize
80KB

Download
memory/2404-610-0x00007FF90C660000-0x00007FF90C670000-memory.dmp

Filesize
64KB

Download
memory/2404-609-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

Filesize
84KB

Download
memory/2404-608-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

Filesize
3.5MB

Download
memory/2404-607-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

Filesize
100KB

Download
memory/2404-606-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

Filesize
184KB

Download
memory/2404-605-0x00007FF8FCC00000-0x00007FF8FCD71000-memory.dmp

Filesize
1.4MB

Download
memory/4540-204-0x000001D1A8BA0000-0x000001D1A8BC2000-memory.dmp

Filesize
136KB

Download