exelastealer | hxxps://gofile[.]io/d/N6SHvi

Analysis

max time kernel
78s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/N6SHvi

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3672	netsh.exe
5184	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4752	cmd.exe
232	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1744	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe

Loads dropped DLL 32 IoCs

pid	Process
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe
2548	UB.GG Permanent Serial Changer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
70	discord.com
71	discord.com
69	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3680	cmd.exe
5512	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5172	tasklist.exe
5768	tasklist.exe
6064	tasklist.exe
4520	tasklist.exe
3012	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5852	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023d49-167.dat	upx
behavioral1/memory/2548-171-0x00007FFD888E0000-0x00007FFD88EC9000-memory.dmp	upx
behavioral1/files/0x0007000000023d41-178.dat	upx
behavioral1/memory/2548-193-0x00007FFDA1DF0000-0x00007FFDA1DFF000-memory.dmp	upx
behavioral1/files/0x0007000000023d19-191.dat	upx
behavioral1/files/0x0007000000023d18-190.dat	upx
behavioral1/files/0x0007000000023d16-189.dat	upx
behavioral1/files/0x0008000000023d13-188.dat	upx
behavioral1/files/0x0008000000023d12-187.dat	upx
behavioral1/files/0x0007000000023d4c-186.dat	upx
behavioral1/files/0x0007000000023d4b-185.dat	upx
behavioral1/files/0x0007000000023d4a-184.dat	upx
behavioral1/files/0x0007000000023d47-183.dat	upx
behavioral1/files/0x0007000000023d42-182.dat	upx
behavioral1/files/0x0007000000023d40-181.dat	upx
behavioral1/memory/2548-179-0x00007FFD9CA40000-0x00007FFD9CA63000-memory.dmp	upx
behavioral1/files/0x0007000000023d17-177.dat	upx
behavioral1/files/0x0007000000023d20-199.dat	upx
behavioral1/files/0x0007000000023d1f-198.dat	upx
behavioral1/files/0x0007000000023d1e-197.dat	upx
behavioral1/files/0x0007000000023d1d-196.dat	upx
behavioral1/files/0x0007000000023d1c-195.dat	upx
behavioral1/files/0x0007000000023d1b-194.dat	upx
behavioral1/files/0x0007000000023d1a-192.dat	upx
behavioral1/memory/2548-202-0x00007FFD891E0000-0x00007FFD891F9000-memory.dmp	upx
behavioral1/memory/2548-204-0x00007FFD9D320000-0x00007FFD9D32D000-memory.dmp	upx
behavioral1/memory/2548-206-0x00007FFD89010000-0x00007FFD89029000-memory.dmp	upx
behavioral1/memory/2548-208-0x00007FFD88FE0000-0x00007FFD8900D000-memory.dmp	upx
behavioral1/memory/2548-212-0x00007FFD88730000-0x00007FFD888A7000-memory.dmp	upx
behavioral1/memory/2548-211-0x00007FFD888B0000-0x00007FFD888D3000-memory.dmp	upx
behavioral1/memory/2548-214-0x00007FFD886F0000-0x00007FFD88723000-memory.dmp	upx
behavioral1/memory/2548-219-0x00007FFD88620000-0x00007FFD886ED000-memory.dmp	upx
behavioral1/memory/2548-218-0x00007FFD888E0000-0x00007FFD88EC9000-memory.dmp	upx
behavioral1/memory/2548-222-0x00007FFD9CA40000-0x00007FFD9CA63000-memory.dmp	upx
behavioral1/memory/2548-221-0x00007FFD880F0000-0x00007FFD88612000-memory.dmp	upx
behavioral1/memory/2548-224-0x00007FFD880D0000-0x00007FFD880E5000-memory.dmp	upx
behavioral1/memory/2548-227-0x00007FFD880B0000-0x00007FFD880C2000-memory.dmp	upx
behavioral1/memory/2548-226-0x00007FFD891E0000-0x00007FFD891F9000-memory.dmp	upx
behavioral1/files/0x0007000000023d44-229.dat	upx
behavioral1/memory/2548-230-0x00007FFD88090000-0x00007FFD880A4000-memory.dmp	upx
behavioral1/memory/2548-234-0x00007FFD88070000-0x00007FFD88084000-memory.dmp	upx
behavioral1/memory/2548-233-0x00007FFD88FE0000-0x00007FFD8900D000-memory.dmp	upx
behavioral1/memory/2548-232-0x00007FFD89010000-0x00007FFD89029000-memory.dmp	upx
behavioral1/memory/2548-235-0x00007FFD88040000-0x00007FFD88062000-memory.dmp	upx
behavioral1/memory/2548-237-0x00007FFD87F20000-0x00007FFD8803C000-memory.dmp	upx
behavioral1/memory/2548-236-0x00007FFD888B0000-0x00007FFD888D3000-memory.dmp	upx
behavioral1/memory/2548-239-0x00007FFD87F00000-0x00007FFD87F1B000-memory.dmp	upx
behavioral1/memory/2548-238-0x00007FFD88730000-0x00007FFD888A7000-memory.dmp	upx
behavioral1/memory/2548-242-0x00007FFD88620000-0x00007FFD886ED000-memory.dmp	upx
behavioral1/memory/2548-241-0x00007FFD9BC70000-0x00007FFD9BC89000-memory.dmp	upx
behavioral1/memory/2548-244-0x00007FFD87EB0000-0x00007FFD87EFD000-memory.dmp	upx
behavioral1/memory/2548-240-0x00007FFD886F0000-0x00007FFD88723000-memory.dmp	upx
behavioral1/memory/2548-249-0x00007FFD87E50000-0x00007FFD87E6E000-memory.dmp	upx
behavioral1/memory/2548-248-0x00007FFD880D0000-0x00007FFD880E5000-memory.dmp	upx
behavioral1/memory/2548-247-0x00007FFD87E70000-0x00007FFD87EA2000-memory.dmp	upx
behavioral1/memory/2548-246-0x00007FFD9BC50000-0x00007FFD9BC61000-memory.dmp	upx
behavioral1/memory/2548-245-0x00007FFD880F0000-0x00007FFD88612000-memory.dmp	upx
behavioral1/memory/2548-250-0x00007FFD87650000-0x00007FFD87E4B000-memory.dmp	upx
behavioral1/memory/2548-251-0x00007FFD872E0000-0x00007FFD87317000-memory.dmp	upx
behavioral1/memory/2548-255-0x00007FFD88040000-0x00007FFD88062000-memory.dmp	upx
behavioral1/memory/2548-259-0x00007FFD87F20000-0x00007FFD8803C000-memory.dmp	upx
behavioral1/memory/2548-267-0x00007FFD87F00000-0x00007FFD87F1B000-memory.dmp	upx
behavioral1/memory/2548-289-0x00007FFD87EB0000-0x00007FFD87EFD000-memory.dmp	upx
behavioral1/memory/2548-326-0x00007FFDA1F50000-0x00007FFDA1F5D000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5180	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0008000000023d03-92.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4996	cmd.exe
5260	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5256	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5808	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5204	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5264	ipconfig.exe
5256	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
788	systeminfo.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
4644	taskkill.exe
5788	taskkill.exe
5936	taskkill.exe
5204	taskkill.exe
5552	taskkill.exe
1672	taskkill.exe
5476	taskkill.exe
5792	taskkill.exe
5892	taskkill.exe
5280	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 141904.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
2128	msedge.exe
2128	msedge.exe
548	identity_helper.exe
548	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
232	powershell.exe
232	powershell.exe
232	powershell.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5192	WMIC.exe
Token: SeSecurityPrivilege	5192	WMIC.exe
Token: SeTakeOwnershipPrivilege	5192	WMIC.exe
Token: SeLoadDriverPrivilege	5192	WMIC.exe
Token: SeSystemProfilePrivilege	5192	WMIC.exe
Token: SeSystemtimePrivilege	5192	WMIC.exe
Token: SeProfSingleProcessPrivilege	5192	WMIC.exe
Token: SeIncBasePriorityPrivilege	5192	WMIC.exe
Token: SeCreatePagefilePrivilege	5192	WMIC.exe
Token: SeBackupPrivilege	5192	WMIC.exe
Token: SeRestorePrivilege	5192	WMIC.exe
Token: SeShutdownPrivilege	5192	WMIC.exe
Token: SeDebugPrivilege	5192	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5192	WMIC.exe
Token: SeRemoteShutdownPrivilege	5192	WMIC.exe
Token: SeUndockPrivilege	5192	WMIC.exe
Token: SeManageVolumePrivilege	5192	WMIC.exe
Token: 33	5192	WMIC.exe
Token: 34	5192	WMIC.exe
Token: 35	5192	WMIC.exe
Token: 36	5192	WMIC.exe
Token: SeDebugPrivilege	5172	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5204	WMIC.exe
Token: SeSecurityPrivilege	5204	WMIC.exe
Token: SeTakeOwnershipPrivilege	5204	WMIC.exe
Token: SeLoadDriverPrivilege	5204	WMIC.exe
Token: SeSystemProfilePrivilege	5204	WMIC.exe
Token: SeSystemtimePrivilege	5204	WMIC.exe
Token: SeProfSingleProcessPrivilege	5204	WMIC.exe
Token: SeIncBasePriorityPrivilege	5204	WMIC.exe
Token: SeCreatePagefilePrivilege	5204	WMIC.exe
Token: SeBackupPrivilege	5204	WMIC.exe
Token: SeRestorePrivilege	5204	WMIC.exe
Token: SeShutdownPrivilege	5204	WMIC.exe
Token: SeDebugPrivilege	5204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5204	WMIC.exe
Token: SeRemoteShutdownPrivilege	5204	WMIC.exe
Token: SeUndockPrivilege	5204	WMIC.exe
Token: SeManageVolumePrivilege	5204	WMIC.exe
Token: 33	5204	WMIC.exe
Token: 34	5204	WMIC.exe
Token: 35	5204	WMIC.exe
Token: 36	5204	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5192	WMIC.exe
Token: SeSecurityPrivilege	5192	WMIC.exe
Token: SeTakeOwnershipPrivilege	5192	WMIC.exe
Token: SeLoadDriverPrivilege	5192	WMIC.exe
Token: SeSystemProfilePrivilege	5192	WMIC.exe
Token: SeSystemtimePrivilege	5192	WMIC.exe
Token: SeProfSingleProcessPrivilege	5192	WMIC.exe
Token: SeIncBasePriorityPrivilege	5192	WMIC.exe
Token: SeCreatePagefilePrivilege	5192	WMIC.exe
Token: SeBackupPrivilege	5192	WMIC.exe
Token: SeRestorePrivilege	5192	WMIC.exe
Token: SeShutdownPrivilege	5192	WMIC.exe
Token: SeDebugPrivilege	5192	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5192	WMIC.exe
Token: SeRemoteShutdownPrivilege	5192	WMIC.exe
Token: SeUndockPrivilege	5192	WMIC.exe
Token: SeManageVolumePrivilege	5192	WMIC.exe
Token: 33	5192	WMIC.exe
Token: 34	5192	WMIC.exe
Token: 35	5192	WMIC.exe
Token: 36	5192	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
6072	mshta.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe
1228	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1220	2128	msedge.exe	83
PID 2128 wrote to memory of 1220	2128	msedge.exe	83
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 4244	2128	msedge.exe	84
PID 2128 wrote to memory of 3016	2128	msedge.exe	85
PID 2128 wrote to memory of 3016	2128	msedge.exe	85
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86
PID 2128 wrote to memory of 1148	2128	msedge.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5900	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/N6SHvi
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8e3646f8,0x7ffd8e364708,0x7ffd8e364718
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1760,3530763248961857972,6472664778220157972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2296

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3876

C:\Users\Admin\Downloads\UB.GG Permanent Serial Changer.exe
"C:\Users\Admin\Downloads\UB.GG Permanent Serial Changer.exe"
1⤵
- Executes dropped EXE
PID:1744
- C:\Users\Admin\Downloads\UB.GG Permanent Serial Changer.exe
  "C:\Users\Admin\Downloads\UB.GG Permanent Serial Changer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:4632
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:2544
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1440
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:5492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5676
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5684
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5852
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
    3⤵
    PID:5916
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
      4⤵
      Adds Run key to start application
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:5976
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2128"
    3⤵
    PID:5352
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2128
      4⤵
      Kills process with taskkill
      PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1220"
    3⤵
    PID:4632
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1220
      4⤵
      Kills process with taskkill
      PID:5476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4244"
    3⤵
    PID:5516
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4244
      4⤵
      Kills process with taskkill
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3016"
    3⤵
    PID:2792
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3016
      4⤵
      Kills process with taskkill
      PID:5788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1148"
    3⤵
    PID:5840
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1148
      4⤵
      Kills process with taskkill
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 808"
    3⤵
    PID:5844
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 808
      4⤵
      Kills process with taskkill
      PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1600"
    3⤵
    PID:5864
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1600
      4⤵
      Kills process with taskkill
      PID:5936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4900"
    3⤵
    PID:6096
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4900
      4⤵
      Kills process with taskkill
      PID:5280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4440"
    3⤵
    PID:1804
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4440
      4⤵
      Kills process with taskkill
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4616"
    3⤵
    PID:5316
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4616
      4⤵
      Kills process with taskkill
      PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4464
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:2284
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4728
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:1376
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:472
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:3680
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:788
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:5792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:5808
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:5876
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:5892
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:5872
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:5904
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:6116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:2088
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:5936
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:6140
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:5940
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:6020
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:6004
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:6080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:1868
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3012
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:5264
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:5284
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:5512
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:5256
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:5180
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3672
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4996
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5476
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5984
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5200

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e87248619737d547759b100099517e40

SHA1
34d6d26485e260ebd6c7ae4884023f2f4dac331d

SHA256
789e0d0bc38214be11da24a571363ad82231d73db2438998261df420ae476785

SHA512
9a672a37d3a99e63ccc3a1ae076a66176be8c07c39882fc57148b9443d0d012502f0af9dd910cc07762d62ba76908cd09060da0d58864a55f463a2394f327ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
84eb8af5cf4d15e0279232b4bc6c208a

SHA1
0881e07759777f150373a3ca8e7abab1b73d1e45

SHA256
2be0e8ee37626eabaaf45099ef560a189046a76559d9e5280259700685b0b4b5

SHA512
917ec8ecac2d6c3fb9f384abc503373177b70bfeb8746539f37d895973a85b64c8d0198d9c3569339182285920dc25ff5a8ab3593c341fc7791a1ed955887a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c28c01d15bb01aac11df8f235fe27957

SHA1
770bdf87b256a2ea0dc51d4ed88d202111c3d519

SHA256
2c67dfce4caff40288a7d7d77e28f36c154225b2bbe254cbd4e1afe8f877eddc

SHA512
c066a7ff76b6838e7969d388764854858f048e0694a21c74e37473eb5d9f69cbded28ceb57d918c75d03c3067d8a78ca17affda11b9b0702224aa105fa9f49bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
555c265de364cf0dd69ae7c88c8be724

SHA1
0af29d8b96c3247e8ebb4aaafb6f0fdd258c319b

SHA256
887501fa270eb07f038420127f035b63f705fab860e1e04d0084bed2a15a8a0a

SHA512
a651b5597cfd70b6118ed49832d412c1e9133b593d14e7e5c0094f8661b97145b6721c43c8771908e2805f6f290498dcfd17f8dccbb85c62ea1abe17ae9841b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4af8abbf1cd2c700c05a47511fbd72e8

SHA1
e7e59b651f44ca284c186161e7ee04a36f8711c2

SHA256
a0258aaa55230dda3dc5d26f98ea770183b432f5643b161673c5cb7de2e42df1

SHA512
c5cb9e600926c64ab3b5e356a4e8cce685b24c4bf722d473e15f07174e95e3f31b7cf37e97d67d993ab334cf930ae7541a497fe9793b55b4efba62cc9ccddca0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a200f3d9734e42ffe7e7e90d99d0f23

SHA1
23986e7adde34071f95d4118e76c7204f7be7014

SHA256
d8404d7ed8443e0443996f4aa8f76606de2f8a671e237792e4d13a82eeabcf9e

SHA512
b8b2f850ad255ad0a799e43dfc8e2f59082fcac65760ac264b97242a4e1e00cc4830ddb4e009e3f1297e5a7dd38e05365ff3ff18a20b99a0d6025538577408ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\HideSearch.docx

Filesize
423KB

MD5
97e4c63b78b3084d8d15b9609e8be79c

SHA1
e1b1c2a37f89742dcdaa276e1378794c6ec17355

SHA256
59eecf099d977e9110bab7e624fd6c722bc705766039583c0a5311d1e263c3ab

SHA512
3a1fc1f638013f70c08bc7f343465e3dd5678bd29b2ad60033961648b4ae207b51ac66207779d09aae15e3b3378e3d34a6687b9c61f8cf6f36285bb926635dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\OutBackup.vsw

Filesize
646KB

MD5
f4c7e40560ebaeb761923053da2a55d4

SHA1
fd3111b9a32fa947bf077e76aa3ae4e3d347450c

SHA256
e38436cb4b56d9e734125e6d153d03c0e966928bb042c4eadd7742642b6432ad

SHA512
aca0f04f193b8b4142de0318acd18c3fccad912da283cca052e971da0716350c18c7b8878b83f976db9492afde5f3fe6c1ea16cedd80e2f73775c1fe1a96a045

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\OutExit.jpg

Filesize
246KB

MD5
6314da4582637c4c75f4af4ccf1519d4

SHA1
baf87f589e8d1fa0f809371a1afc529de076e88f

SHA256
81cb00afd176bb2ee5d8b22a3f123bc3c3d133b9619f2ece9238898dfa9687d1

SHA512
e23f39424e9ba264b6c65a58cee16fd13bce6714f97b5e09f0f88bc191c188a2eee2c53db0b2565fa277129eed6639e3a02b70215cbcf79b0c3d1a9e0a8f8057

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\PingConvertTo.docx

Filesize
19KB

MD5
7e9649ebd5cbb9507dc8bef432f925ef

SHA1
ee66aaa5645964f02d01ad2ca6ce59ce681275bd

SHA256
ca1a28f5abec201171ee4e7853537e76de56bea49bbd058b16c2e4a229e63ab7

SHA512
29c1ea5dd91f156cd84d44d46ad43f9f613d89fb6b19a6cbe7453bba77ad6f91969abb53b06ca0824735f3ebcd21429b87bc9690222b3bc845477cf988e5fc75

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RegisterReceive.docx

Filesize
14KB

MD5
52c7cd9185f31e47a2e3b19f15845e32

SHA1
ef256b0d4815caaa96fcc584b580f79c6558bc1b

SHA256
9f8eefbcc905361b412c53933940643fdbae30de78f8dbba2cea054adf9fcf55

SHA512
7de743d56600d2f3abd9ec5a3d7bf1db2554289c1b9cc2eff7ee019d320a42611bb638837120077df1455b58bfbacdff749130ffa1ace8ba924363d1c794851e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\StartShow.txt

Filesize
305KB

MD5
0ab53ee53d5aa6b2744eabea8b4f1a71

SHA1
b9e21bbdf26d2cc1cf4c6ad494fa63b8b09aaf1b

SHA256
93aaecc62fc01001447f3916c1033d805631aff858d99e81a15902fa675d8915

SHA512
de330f1f1af7e23c456bb2840ace20ea1bf9df84a206032777c1859c80ee4af8f9a33dfd522bda74a82b43300cf7ccd851a6f7007e63fa83665479146c228605

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SubmitEdit.docx

Filesize
16KB

MD5
3349cb13db51168f986cff4cfd328d64

SHA1
be4b022b7dc5f2b5dd0d86c336bafc1a111dce57

SHA256
b2dd500bf34b052c4a48cb40782e4dabfd987888fd81e2d736f34b37ca8fa57d

SHA512
5eb00c7a9b268ed114c180cecb12ac6377fbf8aa3b9c97cf8f37424db14c5690e2b9dfd05c60d1ae928e6ccc1050c66c47a0ef5669b511cd72df6cf8e19e5108

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\CloseDeny.xlsx

Filesize
12KB

MD5
e66d36bb38d306cf86279569f272a158

SHA1
096c5e5d3af653264e88839dcb4e8dc43bd23cea

SHA256
c6efcee975f69f60039fb28d550592930ceba8e14d17539e2445ca60249451e2

SHA512
563ecfb442f583b795e3baa788c737d9d0b4a070824b1ba66d8573c1bf25877a467ab42e07c468ea840097200956f1fdc477b26e1779618c511671ac11653364

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\EditRestore.csv

Filesize
1.1MB

MD5
ae2557b137235a024c99db6f7209b9c3

SHA1
aa61217675fca34b6b8a0a4cd1d69b12cfb3cceb

SHA256
db2f9fa8ecec310dcf8bcd5a8e67cbdb582b6766e845a5ee3a3904fa760766ca

SHA512
bba35e818456424c3afabbccace5a2b9c4788a89423b3943a4d00094f4e3e16c813809b5fe267d6ef7b1b50bbbb977078e37de4879f86d0b978eb6609804ccc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OutSave.docx

Filesize
1.8MB

MD5
6911cb0f6b3c0b39072965d2f881d4a9

SHA1
0b49780273c7fb8b255b5c5a4b22e19cd02944f0

SHA256
73d83af84512d3d379757cf06d02fcde1e96b066c39418ef661348a1a00a7f2e

SHA512
de93642a2e0b1fb3ca14080fad91d088d5c8d1dde5c869835481140237e65e627903f8247692e102ab3e7cb54c3d7f8a4586a28c59ce4913f8f8a17131f3f509

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RemoveStart.xlsx

Filesize
13KB

MD5
b78ffda1fa43aa28cb43d2c7edd0e00c

SHA1
15523f9738df57e70881e1ccd90d0f65b5ad3ab5

SHA256
d5a2b3d09725d9a0ace2715ec4245674712b96738cf913f2f8b03644e8aa17e0

SHA512
fd27864bbcf5aab62458501c4d64306d171e7bbd3bdfa080144f0ec6cbccf62bb8c910a7d0132ced3dd4d2e0cd9fcf10dfa9ab0a9b6110809898daebe1bc6222

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ResizeInitialize.docx

Filesize
20KB

MD5
74f588760761ccf90da72be376f5152e

SHA1
38739716168958ac78bddda787cd3d41c715afbe

SHA256
f93799a73698f4ef027e4535ebda8578fbb0432aa57802f19c90c9a6008eed50

SHA512
bd30c21c33011fcce3892f4f3a75e03df46378eb035f3ebd32357e6a873a79bae4d8fb4776f54e6ef84c6c1096b86ea2fdea4d70c5688bbc21af434eb17aa91d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RestoreSearch.csv

Filesize
1.5MB

MD5
83c3e91e0792648e59a7a2c044e910b3

SHA1
45bba9c756b11bce374d62017472d1ed37f4780a

SHA256
c7b5dbc0dcfb677b4b4a66dfee6744d7e5fde29028e780a718f70f116f8f3293

SHA512
27bde127ea53edcf4f140ea4793cc92154d1ccfae1e17340d8ba0a027a582e94f8f15cc12cd5f8c805ff8628d6679a7689920d8c9ef0976e3f4a84327c1071d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RestoreSet.xlsx

Filesize
11KB

MD5
65ea650bd755de9bece169f8dd06d663

SHA1
6d46b4892c76cd7f39a7aa8977bd8c3e2964326d

SHA256
9327a459d7246216c4f3e2317ca7975ce3f68b6532063d3a32c9ddfa71616d2a

SHA512
cc225a1249bc43341d940f574537a1a290c1c5fc9bdbfef433d8eb2d53bbd51bf5e60ad2731324fad12c6c4adae55690e806741b098879b08dacc0b116d4dce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CheckpointCopy.jpg

Filesize
750KB

MD5
2452dd6a1c9f14c59afb61d0235a3c5d

SHA1
ec0ccee326934d977f3967235bc23cbcbc869116

SHA256
3cc93eab4941bf3376f9f273a1808863928c7952f7c3aa1f3701ec627230113d

SHA512
16e64128b3d00f6becfb643cf03b78e52662cbd966eabf1c43e1676f3a68a0773568f14750f3c6d2a41f894469a8d072fee52d10640e3de10650121167598dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ConvertFromCompare.xls

Filesize
555KB

MD5
5178d6dca1e1d8a34e5a1677d03116b9

SHA1
0e1894940a13fae600b380fd89bbeaa133a29879

SHA256
cb18ce9858910f68e4ceea980e1c04a3ee33ee6d38d81ebdf75b86db1825b8bd

SHA512
2e9afff1474f5077050ec314d07b7ce8fccb181e04fb4138b60e091d9e820f1bdaca15c58f35f1f0f725031442e61a0acb87db9f95cef1b035de3fe7b0db2bc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RemoveStep.jpg

Filesize
585KB

MD5
64215b68e25fb8a0bebeb1d91e784b7a

SHA1
281152aa8884bfd91e9440627d58ce2435f6d560

SHA256
4eb3e9f84bf5eee0966c03dac16fb5f6ba52ebec9063a59a1b28ee73138e5823

SHA512
bda6d5712ac0bb3cc86a1f4c069a0aa61bb124f308f34bfaf5a947df790680ec635ae819fd3cd8bf4552833ef7e230d0ee51c14727fd16f27563bbd6a1919232

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RevokeShow.jpeg

Filesize
270KB

MD5
e6b2e64540c5408bf3914ad3a554edfa

SHA1
44f9d0d666c9826f6f6ee68cf0342dd74decbc49

SHA256
145b5c3cc83d942e4c78c6e6ac9472b7822b31b9d28ad3ad2286054c08417392

SHA512
35aaadedc9f33fc032a0c8d87b4cc965f1ce42c1dd0e1be9d5215f069318066e20cf3b70e929883a95e7979d5aecbf7009c1c8729eabfbc92ccff057c843ffe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnprotectGet.xls

Filesize
315KB

MD5
577a4d20bf1117a5dc8220f26ea0a51b

SHA1
86824dbd6e0461fe3bfb80d6e2c9f6b5909ab50f

SHA256
626b8a1685c69b86feadfd054686d494a5ed0d714f88d63edb3c8f211a07a5ac

SHA512
d011f47924e480aa50a5b5a25becfbd889a3c321a88e9cefa12d215ac5b9464d58620113043b43de9cacfd7f1aa012152e15a021d1738ae5f9bc76527efc2dc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\MeasureProtect.jpg

Filesize
670KB

MD5
82ada01a397e0b78e0e0bccc35476b8c

SHA1
4c6b57583e07caad4c22e3e5e78d75d9e00b7a09

SHA256
e24ed92e50254bf59919c3fcf25bf03cc0fc162878255891794df6cb58b15497

SHA512
c4ee8bd3e486b63d57dd038a58bf2cceed55f4bd4e25b6958f5a7630dbb19c0ed9e96fd72a1dc1459927fd3a141bdcc51d923d1663f0b8a89b53fdef44fb0bd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ReadExport.xls

Filesize
644KB

MD5
7b8f484f58bf0fa81c679c641843d3b8

SHA1
a639f54abf5536aa3c8accf86b90c2bdf9235518

SHA256
96425c8a5ebcdf1aa9331aafe9a566782a150eab0b12cdec543ddf52514df352

SHA512
381552a38dfd6a0baa1a28a72c013f491a34e96bea9432ba2ac6023b2d34a0ad7640d91305f4040e924102f1bbe98002d599e615a606e8c3f8f97ebc32183343

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\WatchResolve.xlsx

Filesize
872KB

MD5
7fec23b722300cf16a31dec23fad915b

SHA1
8ca7e883121bcf6d81b013ebc2022d338fe8b584

SHA256
9eebfea4e68e4b61f197255fb9e3c25584a204cbf531695e213f62fcb2f0efc5

SHA512
4597a1ff0c9d3f8089956e32b5464114527572f4eebe6e8d86a63884372e5607279aece0073fecfd714715383a3c8f51ce6b87c18c692a6c89257d718f7f3c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SkipUse.png

Filesize
552KB

MD5
dc018c8a59c7b6f58f2f40fcd2fbc3b5

SHA1
be17b0ebca6d8c238645178809a501cb140ab1bc

SHA256
0ab6385d6c80962b8f68982a3f2839403aaaf660911d8a299aca6361afeb1d32

SHA512
e7ea043cfa9deb3352fee95c851f59f37f743c283e7690d205a4a498922c377fdf855588cfb8cb9fa2190ecc47c9178e74bb1bcd44aebb0b4b7a7386618251f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_asyncio.pyd

Filesize
36KB

MD5
c2da8c02c14c1539c9e1ac4e928d60b0

SHA1
74f98ce6b84acbd91fb7acead1c3385e90e20bb9

SHA256
bcd230ff2ce48f416a78d67486b5bdd4bf06dce89c9821205d448772d4becd0b

SHA512
86003c5970e49d39a26c8cf41549502e19696bd30b4a8738b81e4b86eec6b8d67dd734026ce55241b0dd6aa80f759ae20261bf82aa877c1652437422be2723d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_bz2.pyd

Filesize
48KB

MD5
f807854b836ab1e84fcdb11560216929

SHA1
627ef83ca0611d9cb267c72dfccf2f0a30297d7c

SHA256
5847649160f3f1564e26cba88e70bd159cc5cea08a1bf07ecd5b7796a49d259e

SHA512
85c28890f2fa4ea6d4f295d41ffc11109d217449cd6f77ea4a901d3f681c67f1abf59fdc5dead503db99ba766d1c51ee5505e456a3b605374b00e3ff832add1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
0f0f1c4e1d043f212b00473a81c012a3

SHA1
ff9ff3c257dceefc74551e4e2bacde0faaef5aec

SHA256
fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b

SHA512
fcfa42f417e319bddf721f298587d1b26e6974e5d7589dfe6ddd2b013bc554a53db3725741fbc4941f34079ed8cb96f05934f3c2b933cda6a7e19cda315591a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_ctypes.pyd

Filesize
58KB

MD5
955a3624921b140bf6acaba5fca4ac3b

SHA1
027e0af89a1dbf5ef235bd4293595bbc12639c28

SHA256
ea07594b2eede262d038de13a64b76301edfbda11f885afa581917b1fb969238

SHA512
b115e83061c11aaf0a0f1131a18be5b520c5cbc3975f5b7a1e9cea06b0aff7a2815165fcd1f09ba1efcf7c185e37e84a0b6ad4eefea3049a369bdf46ed3d2cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_decimal.pyd

Filesize
106KB

MD5
d967bea935300a9da0cd50bf5359a6ea

SHA1
4c2fd9a31aabc90172d41979fb64385fda79c028

SHA256
4b312a03c3a95bd301f095ab4201e2998a3c05e52fcd16c62ab1e51341f54af2

SHA512
7baa39a35bead863833efd7519c761e8cd4e15b35825427cf654181534f41c9abcdd85e017daeb9afefe291d6c2741505bf7eef30d4d25d53ada82646857f356

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_hashlib.pyd

Filesize
35KB

MD5
beac22863ee05d291190b6abf45463c0

SHA1
94cc19e31e550d7fd9743bbd74bfe0217cdde7f9

SHA256
c1c3856ee8e86c8e5cf2b436c1426067f99a40c0da4cbea4e0b52582cd7b6b5b

SHA512
8ae651b912c0f9f2c431a4d3f1c769746f787bdd70ce53626106c903cb3f364cb1bae7e6e2476868420abd849a990c5604c533bc64b0eba149f6bc36514a6f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_lzma.pyd

Filesize
85KB

MD5
872fea740d2ae4d8b9bb2ac95059f52b

SHA1
22274e636e2ef57ad16ccf0eb49a2ff3e37ba080

SHA256
c9a4162df80a99e4723dd60bdf34b8fefc4005f7865dc3e6d86833d84fa25da2

SHA512
f85d1b6602826b21f12a873176f7a5c857c3213ae329ed7a0b8f7d9b1a791edc5549d8fce3c5d2305ce40a4d8a57d9845b2956d42d374de78d5324703d5dfa03

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_multiprocessing.pyd

Filesize
26KB

MD5
eaaadf40dd833d09bc92d6222aeb2f14

SHA1
cfe29566262367fcf7822de328af95b386d96a2d

SHA256
f7d615c6fc3ac5201ab2b369fd7e0443967dc132ee5fc981acb07bf8dc4697cb

SHA512
8216324a30cc66b7bc51c4a96ce0b8f5ad563025e59cf1bf457a84076dc8e8a0291c8a6fce6dc19ec3877d2dbaa9bbaf5cc1d34553fd3423a258b51ea4d40f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_overlapped.pyd

Filesize
32KB

MD5
dbe30ce23b5f19e1b6516653bc6692fc

SHA1
9e46ea221793eab9256e7425c8143323640259e1

SHA256
67d476307c3ae5ffd221c67f26fc76ce2cf5b97b91f32028a7549d131e33454a

SHA512
2b0f9e2e0dce0e87e240acf874e0399249c6baa35382d50d2f68989942e81d038d5bb9b734b313339c9f2df175a8319683671ea58997097aec667597024e2338

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_queue.pyd

Filesize
25KB

MD5
c3cea46d675e3f2a00f7af212521c423

SHA1
0a7c76039e0ed61e3853c4c553bb6cfc9cbd2c7c

SHA256
02b62aee4867505e3d12a3abd0288cf7a75658ac908d06f5b24fdb178094e29d

SHA512
8d9af1d88a2a9528096388db3bd4ff8add480ef94689e851fa4c5a68ec9b97c561b2edfc7e34061beb7bcc26b884a0a06af196008d8705d0284b22878c95289e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_socket.pyd

Filesize
43KB

MD5
9505afe166eb419f5a1d33ff1254722e

SHA1
f343d7b444eb58033086de5376725deda5e0e418

SHA256
af42a1c35155eb989332c25a81d6e2ed08d8e33718d18d32ba5b00092f2a0f21

SHA512
46b7c86d3384db9adb8f1f52b83aaac398547ab86bc07800b0eb87e9abeb9d97e24fb8a70f01224d7c4e8a2a532d9353ad1c1f91d0416b429b87ee0ebe1daec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_sqlite3.pyd

Filesize
56KB

MD5
83d8256bc4b9f1fa9fe3b79196166074

SHA1
2f05420a7c663855f5290fb88cc20a15a7870090

SHA256
f63e3bcad55ef5f5e42076e12730f51bc5b4f3890eb0632a36d2755c5457a57a

SHA512
a2e55d4a1a7ca4239e20faad4cbb9591c91e245c0d8fccb01b898df1c5c4d28010d378b00ec3abbf973d87f874bb77c02fe0f5d471d47d513a93a4d3c54c94a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_ssl.pyd

Filesize
65KB

MD5
d8567f88c0c935c77d2258c7c9db4ca4

SHA1
1decc299b3e58f8401264354f3874dd2f0d7cd0a

SHA256
9a7e02cf4c66cc6be6b2bf03282b4d88f16d12eb10ea78f36cdce0776f6a6289

SHA512
faa5067c4ed2143d316abf96ae096a1229b7450c9d3a850c496b484794897b246c59716f096806982d9c74cb3799a94c8ddce646eb990ca89086f8d16d4c5ea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\_uuid.pyd

Filesize
24KB

MD5
3a09b6db7e4d6ff0f74c292649e4ba96

SHA1
1a515f98946a4dccc50579cbcedf959017f3a23c

SHA256
fc09e40e569f472dd4ba2ea93da48220a6b0387ec62bb0f41f13ef8fab215413

SHA512
8d5ea9f7eee3d75f0673cc7821a94c50f753299128f3d623e7a9c262788c91c267827c859c5d46314a42310c27699af5cdfc6f7821dd38bf03c0b35873d9730f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\base_library.zip

Filesize
1.4MB

MD5
ddfc1831fd727cc1750c619e30bee1fe

SHA1
ccfb67344a6558c2c59c3da5a6ba90073253d96b

SHA256
a88ee7594f01ba09d12842fd566a8ba11e528c36654707d406a91de0e4502a64

SHA512
7a6199389174e658873fe6429ad0aa1ef6d8047285fcc542a746f14198fe86620cd753fe6ac7851701cfac50e635094be02ee50c4bc35d2e5738f7b58c810bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\libcrypto-3.dll

Filesize
1.6MB

MD5
f3fdbbd6c6ea0abe779151ae92c25321

SHA1
0e62e32666ba5f041b5369b36470295a1916cb4e

SHA256
9000e335744818665b87a16a71da5b622b5052b5341f1d6ce08ff8346d2bf3e4

SHA512
e8a363042a05868acc693b5d313f52ffc95b8f6b764a77ff477b0ce2288787dd275478ddbe33d6dbd87636ba9ff0243d2e447a161e2f9cc2f3dba0746f219e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\libffi-8.dll

Filesize
29KB

MD5
0d1c6b92d091cef3142e32ac4e0cc12e

SHA1
440dad5af38035cb0984a973e1f266deff2bd7fc

SHA256
11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6

SHA512
5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\libssl-3.dll

Filesize
223KB

MD5
f9bc28708c1628ef647a17d77c4f5f1a

SHA1
032a8576487ad26f04d31628f833ef9534942da6

SHA256
49ba508dc66c46b9e904bb5fe50cf924465eff803a9f1e4260e752b0231efcc1

SHA512
e33fd00bcf73aab8bce260eda995a1513930b832ea881c5a8ce1a151be3576f3369ac0b794fdd93806157bb9f4fe4eba38a25f4fdc512a6f3640647b8b447387

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
5587c32d9bf7f76e1a9565df8b1b649f

SHA1
52ae204a65c15a09ecc73e7031e3ac5c3dcb71b2

SHA256
7075185db068e3c8f1b7db75e5aa5c500fc76ed8270c6abc6f49681d7119a782

SHA512
f21d0530389138457d6fdcdb3487a3c8b030338c569b2742f9e691e43af1d9e779c98426bad81b152f343b324a9375fe1322ef74030b1c8f8ba606d19e562e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\pyexpat.pyd

Filesize
87KB

MD5
ec28105660f702c7a4a19d2265a48b43

SHA1
2603a0d5467b920ed36fef76d1176c83953846bc

SHA256
b546bf126f066a6645ae109d6d08df911fb77301cc5e6d39434cd24475822af5

SHA512
a388a7a5072d34b3477c5bb872f6e1242128bddb09d87ceac840615d80f0315ec60ff443ca5fab590332e43c4bf3d4ce5d3cc63eaca40945110c1888d2a69dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\python3.DLL

Filesize
65KB

MD5
d8ba00c1d9fcc7c0abbffb5c214da647

SHA1
5fa9d5700b42a83bfcc125d1c45e0111b9d62035

SHA256
e45452efa356db874f2e5ff08c9cc0fe22528609e5d341f8fb67ba48885ab77d

SHA512
df1b714494856f618a742791eefbf470b2eee07b51d983256e4386ea7d48da5c7b1e896f222ea55a748c9413203886cde3a65ef9e7ea069014fa626f81d79cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\python311.dll

Filesize
1.6MB

MD5
affa456007f359e9f8c5d2931d966cb9

SHA1
9b06d6cb7d7f1a7c2fa9e7f62d339b9f2813e80f

SHA256
4bab2e402a02c8b2b0542246d9ef54027a739121b4b0760f08cd2e7c643ed866

SHA512
7c357f43dd272e1d595ccde87c13fd2cdf4123b20af6855576bfba15afd814a95886cebbe96bb7781b916f9db3c3ee02d381036ddbf62095de3ee43a7f94d156

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\select.pyd

Filesize
25KB

MD5
a74e10b7401ea044a8983d01012f3103

SHA1
cdd0afa6ae1dcebc9ccfec17e23c6770a9abfb8f

SHA256
78a4b12d7da7e67b1dc90646b269c3e8dfea5dc24e5eef4787fffd4325fe39d8

SHA512
a080050b5d966303d2a27cafca8cbf83777329a54ca00bbb16eb547eef4262c9fdf7c828cadb02e952aeb631ec560d1dce3cf91f387a96de9e82037f1c3ac47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\sqlite3.dll

Filesize
622KB

MD5
7219d265a3204344ce216344de464920

SHA1
13e7b7980e17ed5a225b93ffb393f1bc7419ac2e

SHA256
5821d8bd76212b57eee95b7ecb5a8381d2fe24ae31164be03f0f8bf13d5b86d4

SHA512
d554c881073417dd03334521ca0afc95716b1a9788e9ee1a0540ce3d7e53132f4ee511c10b05ab090909002294d9648d1d65e994c8d105bff7142cdcce1d4b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI17442\unicodedata.pyd

Filesize
295KB

MD5
660ef38d6de71eb7e06c555b38c675b5

SHA1
944ec04d9b67d3f25d3fb448973c7ad180222be3

SHA256
fd746987ab1ea02b6568091040e8c5204fb599288977f8077a7b9ecefdc5edb4

SHA512
26ac7d56e4fb02e43e049c9055979fc6e0e16fab8f08f619233e12b278f300faa5ffabac1d9b71091571a89cdf9acfeb3478508fba96ef2e647327215be6e9d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pklslyup.41e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 141904.crdownload

Filesize
11.3MB

MD5
9b11eb7455b83abcdc1a03d28a5f4b01

SHA1
2051d620cb4b9107c267e998261442fbe139f30c

SHA256
2c49b69847ccdc8c421ea884a4adfe4c5c73218ae7fd3e2a2373fe188f0a0331

SHA512
5dda42ece1b61681246cf1f8e2974ebdd4755d3d39e86e5fadb0139cb8e1cf1b5581a08f1bca8a358f141b3bd88c5a9d5c967e916c0bbdb798c635631b153d5f

Download Submit
memory/232-334-0x0000021B27290000-0x0000021B272B2000-memory.dmp

Filesize
136KB

Download
memory/1228-272-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-277-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-278-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-279-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-280-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-276-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-281-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-282-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-270-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/1228-271-0x000001E3015D0000-0x000001E3015D1000-memory.dmp

Filesize
4KB

Download
memory/2548-240-0x00007FFD886F0000-0x00007FFD88723000-memory.dmp

Filesize
204KB

Download
memory/2548-250-0x00007FFD87650000-0x00007FFD87E4B000-memory.dmp

Filesize
8.0MB

Download
memory/2548-251-0x00007FFD872E0000-0x00007FFD87317000-memory.dmp

Filesize
220KB

Download
memory/2548-255-0x00007FFD88040000-0x00007FFD88062000-memory.dmp

Filesize
136KB

Download
memory/2548-259-0x00007FFD87F20000-0x00007FFD8803C000-memory.dmp

Filesize
1.1MB

Download
memory/2548-267-0x00007FFD87F00000-0x00007FFD87F1B000-memory.dmp

Filesize
108KB

Download
memory/2548-245-0x00007FFD880F0000-0x00007FFD88612000-memory.dmp

Filesize
5.1MB

Download
memory/2548-246-0x00007FFD9BC50000-0x00007FFD9BC61000-memory.dmp

Filesize
68KB

Download
memory/2548-247-0x00007FFD87E70000-0x00007FFD87EA2000-memory.dmp

Filesize
200KB

Download
memory/2548-248-0x00007FFD880D0000-0x00007FFD880E5000-memory.dmp

Filesize
84KB

Download
memory/2548-249-0x00007FFD87E50000-0x00007FFD87E6E000-memory.dmp

Filesize
120KB

Download
memory/2548-243-0x0000018D3E5C0000-0x0000018D3EAE2000-memory.dmp

Filesize
5.1MB

Download
memory/2548-244-0x00007FFD87EB0000-0x00007FFD87EFD000-memory.dmp

Filesize
308KB

Download
memory/2548-241-0x00007FFD9BC70000-0x00007FFD9BC89000-memory.dmp

Filesize
100KB

Download
memory/2548-242-0x00007FFD88620000-0x00007FFD886ED000-memory.dmp

Filesize
820KB

Download
memory/2548-238-0x00007FFD88730000-0x00007FFD888A7000-memory.dmp

Filesize
1.5MB

Download
memory/2548-289-0x00007FFD87EB0000-0x00007FFD87EFD000-memory.dmp

Filesize
308KB

Download
memory/2548-326-0x00007FFDA1F50000-0x00007FFDA1F5D000-memory.dmp

Filesize
52KB

Download
memory/2548-239-0x00007FFD87F00000-0x00007FFD87F1B000-memory.dmp

Filesize
108KB

Download
memory/2548-236-0x00007FFD888B0000-0x00007FFD888D3000-memory.dmp

Filesize
140KB

Download
memory/2548-370-0x00007FFD87E70000-0x00007FFD87EA2000-memory.dmp

Filesize
200KB

Download
memory/2548-363-0x00007FFD87EB0000-0x00007FFD87EFD000-memory.dmp

Filesize
308KB

Download
memory/2548-362-0x00007FFD9BC70000-0x00007FFD9BC89000-memory.dmp

Filesize
100KB

Download
memory/2548-354-0x00007FFD880F0000-0x00007FFD88612000-memory.dmp

Filesize
5.1MB

Download
memory/2548-353-0x00007FFD88620000-0x00007FFD886ED000-memory.dmp

Filesize
820KB

Download
memory/2548-352-0x00007FFD886F0000-0x00007FFD88723000-memory.dmp

Filesize
204KB

Download
memory/2548-343-0x00007FFD888E0000-0x00007FFD88EC9000-memory.dmp

Filesize
5.9MB

Download
memory/2548-368-0x00007FFD872E0000-0x00007FFD87317000-memory.dmp

Filesize
220KB

Download
memory/2548-356-0x00007FFD880B0000-0x00007FFD880C2000-memory.dmp

Filesize
72KB

Download
memory/2548-355-0x00007FFD880D0000-0x00007FFD880E5000-memory.dmp

Filesize
84KB

Download
memory/2548-351-0x00007FFD88730000-0x00007FFD888A7000-memory.dmp

Filesize
1.5MB

Download
memory/2548-344-0x00007FFD9CA40000-0x00007FFD9CA63000-memory.dmp

Filesize
140KB

Download
memory/2548-367-0x00007FFD87650000-0x00007FFD87E4B000-memory.dmp

Filesize
8.0MB

Download
memory/2548-237-0x00007FFD87F20000-0x00007FFD8803C000-memory.dmp

Filesize
1.1MB

Download
memory/2548-235-0x00007FFD88040000-0x00007FFD88062000-memory.dmp

Filesize
136KB

Download
memory/2548-232-0x00007FFD89010000-0x00007FFD89029000-memory.dmp

Filesize
100KB

Download
memory/2548-233-0x00007FFD88FE0000-0x00007FFD8900D000-memory.dmp

Filesize
180KB

Download
memory/2548-234-0x00007FFD88070000-0x00007FFD88084000-memory.dmp

Filesize
80KB

Download
memory/2548-230-0x00007FFD88090000-0x00007FFD880A4000-memory.dmp

Filesize
80KB

Download
memory/2548-226-0x00007FFD891E0000-0x00007FFD891F9000-memory.dmp

Filesize
100KB

Download
memory/2548-227-0x00007FFD880B0000-0x00007FFD880C2000-memory.dmp

Filesize
72KB

Download
memory/2548-224-0x00007FFD880D0000-0x00007FFD880E5000-memory.dmp

Filesize
84KB

Download
memory/2548-221-0x00007FFD880F0000-0x00007FFD88612000-memory.dmp

Filesize
5.1MB

Download
memory/2548-222-0x00007FFD9CA40000-0x00007FFD9CA63000-memory.dmp

Filesize
140KB

Download
memory/2548-220-0x0000018D3E5C0000-0x0000018D3EAE2000-memory.dmp

Filesize
5.1MB

Download
memory/2548-218-0x00007FFD888E0000-0x00007FFD88EC9000-memory.dmp

Filesize
5.9MB

Download
memory/2548-493-0x00007FFD888E0000-0x00007FFD88EC9000-memory.dmp

Filesize
5.9MB

Download
memory/2548-513-0x00007FFD87EB0000-0x00007FFD87EFD000-memory.dmp

Filesize
308KB

Download
memory/2548-219-0x00007FFD88620000-0x00007FFD886ED000-memory.dmp

Filesize
820KB

Download
memory/2548-214-0x00007FFD886F0000-0x00007FFD88723000-memory.dmp

Filesize
204KB

Download
memory/2548-211-0x00007FFD888B0000-0x00007FFD888D3000-memory.dmp

Filesize
140KB

Download
memory/2548-212-0x00007FFD88730000-0x00007FFD888A7000-memory.dmp

Filesize
1.5MB

Download
memory/2548-208-0x00007FFD88FE0000-0x00007FFD8900D000-memory.dmp

Filesize
180KB

Download
memory/2548-512-0x00007FFD9BC70000-0x00007FFD9BC89000-memory.dmp

Filesize
100KB

Download
memory/2548-505-0x00007FFD880D0000-0x00007FFD880E5000-memory.dmp

Filesize
84KB

Download
memory/2548-504-0x00007FFD880F0000-0x00007FFD88612000-memory.dmp

Filesize
5.1MB

Download
memory/2548-502-0x00007FFD886F0000-0x00007FFD88723000-memory.dmp

Filesize
204KB

Download
memory/2548-206-0x00007FFD89010000-0x00007FFD89029000-memory.dmp

Filesize
100KB

Download
memory/2548-204-0x00007FFD9D320000-0x00007FFD9D32D000-memory.dmp

Filesize
52KB

Download
memory/2548-202-0x00007FFD891E0000-0x00007FFD891F9000-memory.dmp

Filesize
100KB

Download
memory/2548-179-0x00007FFD9CA40000-0x00007FFD9CA63000-memory.dmp

Filesize
140KB

Download
memory/2548-193-0x00007FFDA1DF0000-0x00007FFDA1DFF000-memory.dmp

Filesize
60KB

Download
memory/2548-171-0x00007FFD888E0000-0x00007FFD88EC9000-memory.dmp

Filesize
5.9MB

Download