exelastealer | 18bceeea48251454474ca1c5d96a41babe319330b4623b36bd1429ec7e653ecd

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UB.GG Permanent Serial Changer (2).exe
Size

11.3MB
MD5

5bb6842a2f4784dbe7bde5684ffc2ced
SHA1

2ff9a23569009a890e85a86693bd7e2d063ea90c
SHA256

18bceeea48251454474ca1c5d96a41babe319330b4623b36bd1429ec7e653ecd
SHA512

4b9d2203de15d7db76a51477fe18e31305cb59dabbff878f40245f26d3e23931b53752e4ac102fdb2d5cd263ebc6deb1d4b71458a20e7f7f07f49765686079aa
SSDEEP

196608:M2tOT4CIYDbx0z3civNm1E8giq1g9mJLjv+bhqNVob0Uh8mAIv9PuTzEM8Hgo9o9:5tOT4DOF0z3ci1m1NqvL+9qzGxII8zBB

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4736	netsh.exe
4060	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1872	powershell.exe
1768	cmd.exe

Loads dropped DLL 32 IoCs

pid	Process
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe
624	UB.GG Permanent Serial Changer (2).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
33	discord.com
66	discord.com
71	discord.com
29	discord.com
31	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4860	cmd.exe
3532	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
552	tasklist.exe
2188	tasklist.exe
5044	tasklist.exe
2948	tasklist.exe
4824	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
224	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023ce4-46.dat	upx
behavioral2/memory/624-50-0x00007FF81EF10000-0x00007FF81F4F9000-memory.dmp	upx
behavioral2/files/0x0007000000023cdc-57.dat	upx
behavioral2/memory/624-79-0x00007FF834460000-0x00007FF83446F000-memory.dmp	upx
behavioral2/files/0x0007000000023cbb-76.dat	upx
behavioral2/files/0x0007000000023cba-75.dat	upx
behavioral2/files/0x0007000000023cb9-74.dat	upx
behavioral2/files/0x0007000000023cb8-73.dat	upx
behavioral2/files/0x0007000000023cb7-72.dat	upx
behavioral2/files/0x0007000000023cb6-71.dat	upx
behavioral2/files/0x0007000000023cb5-70.dat	upx
behavioral2/files/0x0007000000023cb4-69.dat	upx
behavioral2/files/0x0007000000023cb3-68.dat	upx
behavioral2/files/0x0007000000023cb1-67.dat	upx
behavioral2/files/0x0007000000023cb0-66.dat	upx
behavioral2/files/0x0007000000023caf-65.dat	upx
behavioral2/files/0x0007000000023ce7-64.dat	upx
behavioral2/files/0x0007000000023ce6-63.dat	upx
behavioral2/files/0x0007000000023ce5-62.dat	upx
behavioral2/files/0x0007000000023ce2-61.dat	upx
behavioral2/files/0x0007000000023cdd-60.dat	upx
behavioral2/files/0x0007000000023cdb-59.dat	upx
behavioral2/memory/624-78-0x00007FF833490000-0x00007FF8334B3000-memory.dmp	upx
behavioral2/files/0x0007000000023cb2-56.dat	upx
behavioral2/memory/624-83-0x00007FF833460000-0x00007FF83346D000-memory.dmp	upx
behavioral2/memory/624-81-0x00007FF833470000-0x00007FF833489000-memory.dmp	upx
behavioral2/memory/624-85-0x00007FF833440000-0x00007FF833459000-memory.dmp	upx
behavioral2/memory/624-87-0x00007FF8332B0000-0x00007FF8332DD000-memory.dmp	upx
behavioral2/memory/624-89-0x00007FF82E760000-0x00007FF82E783000-memory.dmp	upx
behavioral2/memory/624-91-0x00007FF82DDE0000-0x00007FF82DF57000-memory.dmp	upx
behavioral2/memory/624-93-0x00007FF82E720000-0x00007FF82E753000-memory.dmp	upx
behavioral2/memory/624-99-0x00007FF82E590000-0x00007FF82E65D000-memory.dmp	upx
behavioral2/memory/624-100-0x00007FF81E9E0000-0x00007FF81EF02000-memory.dmp	upx
behavioral2/memory/624-98-0x00007FF833490000-0x00007FF8334B3000-memory.dmp	upx
behavioral2/memory/624-97-0x00007FF81EF10000-0x00007FF81F4F9000-memory.dmp	upx
behavioral2/memory/624-106-0x00007FF833470000-0x00007FF833489000-memory.dmp	upx
behavioral2/memory/624-113-0x00007FF82AC40000-0x00007FF82AC54000-memory.dmp	upx
behavioral2/memory/624-112-0x00007FF833440000-0x00007FF833459000-memory.dmp	upx
behavioral2/memory/624-109-0x00007FF82AC60000-0x00007FF82AC74000-memory.dmp	upx
behavioral2/files/0x0007000000023ce9-111.dat	upx
behavioral2/memory/624-115-0x00007FF829FB0000-0x00007FF829FD2000-memory.dmp	upx
behavioral2/memory/624-117-0x00007FF82E760000-0x00007FF82E783000-memory.dmp	upx
behavioral2/memory/624-118-0x00007FF81E550000-0x00007FF81E66C000-memory.dmp	upx
behavioral2/files/0x0007000000023cdf-108.dat	upx
behavioral2/memory/624-107-0x00007FF82DCF0000-0x00007FF82DD02000-memory.dmp	upx
behavioral2/memory/624-103-0x00007FF82DD10000-0x00007FF82DD25000-memory.dmp	upx
behavioral2/files/0x0007000000023ce1-119.dat	upx
behavioral2/memory/624-122-0x00007FF829640000-0x00007FF82965B000-memory.dmp	upx
behavioral2/memory/624-121-0x00007FF82DDE0000-0x00007FF82DF57000-memory.dmp	upx
behavioral2/files/0x0007000000023cbf-123.dat	upx
behavioral2/memory/624-126-0x00007FF82E720000-0x00007FF82E753000-memory.dmp	upx
behavioral2/files/0x0007000000023cbe-125.dat	upx
behavioral2/files/0x0007000000023cc1-129.dat	upx
behavioral2/memory/624-130-0x00007FF833420000-0x00007FF833439000-memory.dmp	upx
behavioral2/files/0x0007000000023cc2-131.dat	upx
behavioral2/memory/624-132-0x00007FF82E590000-0x00007FF82E65D000-memory.dmp	upx
behavioral2/memory/624-134-0x00007FF829720000-0x00007FF82976D000-memory.dmp	upx
behavioral2/memory/624-136-0x00007FF829700000-0x00007FF829711000-memory.dmp	upx
behavioral2/memory/624-139-0x00007FF8296C0000-0x00007FF8296F2000-memory.dmp	upx
behavioral2/files/0x0007000000023cda-140.dat	upx
behavioral2/memory/624-143-0x00007FF8296A0000-0x00007FF8296BE000-memory.dmp	upx
behavioral2/memory/624-142-0x00007FF82DD10000-0x00007FF82DD25000-memory.dmp	upx
behavioral2/memory/624-135-0x00007FF81E9E0000-0x00007FF81EF02000-memory.dmp	upx
behavioral2/files/0x0007000000023cd8-144.dat	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4120	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4924	cmd.exe
5100	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2032	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4052	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3504	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2056	ipconfig.exe
2032	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
468	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1872	powershell.exe
1872	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	516	WMIC.exe
Token: SeSecurityPrivilege	516	WMIC.exe
Token: SeTakeOwnershipPrivilege	516	WMIC.exe
Token: SeLoadDriverPrivilege	516	WMIC.exe
Token: SeSystemProfilePrivilege	516	WMIC.exe
Token: SeSystemtimePrivilege	516	WMIC.exe
Token: SeProfSingleProcessPrivilege	516	WMIC.exe
Token: SeIncBasePriorityPrivilege	516	WMIC.exe
Token: SeCreatePagefilePrivilege	516	WMIC.exe
Token: SeBackupPrivilege	516	WMIC.exe
Token: SeRestorePrivilege	516	WMIC.exe
Token: SeShutdownPrivilege	516	WMIC.exe
Token: SeDebugPrivilege	516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	516	WMIC.exe
Token: SeRemoteShutdownPrivilege	516	WMIC.exe
Token: SeUndockPrivilege	516	WMIC.exe
Token: SeManageVolumePrivilege	516	WMIC.exe
Token: 33	516	WMIC.exe
Token: 34	516	WMIC.exe
Token: 35	516	WMIC.exe
Token: 36	516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3504	WMIC.exe
Token: SeSecurityPrivilege	3504	WMIC.exe
Token: SeTakeOwnershipPrivilege	3504	WMIC.exe
Token: SeLoadDriverPrivilege	3504	WMIC.exe
Token: SeSystemProfilePrivilege	3504	WMIC.exe
Token: SeSystemtimePrivilege	3504	WMIC.exe
Token: SeProfSingleProcessPrivilege	3504	WMIC.exe
Token: SeIncBasePriorityPrivilege	3504	WMIC.exe
Token: SeCreatePagefilePrivilege	3504	WMIC.exe
Token: SeBackupPrivilege	3504	WMIC.exe
Token: SeRestorePrivilege	3504	WMIC.exe
Token: SeShutdownPrivilege	3504	WMIC.exe
Token: SeDebugPrivilege	3504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3504	WMIC.exe
Token: SeRemoteShutdownPrivilege	3504	WMIC.exe
Token: SeUndockPrivilege	3504	WMIC.exe
Token: SeManageVolumePrivilege	3504	WMIC.exe
Token: 33	3504	WMIC.exe
Token: 34	3504	WMIC.exe
Token: 35	3504	WMIC.exe
Token: 36	3504	WMIC.exe
Token: SeDebugPrivilege	4824	tasklist.exe
Token: SeIncreaseQuotaPrivilege	516	WMIC.exe
Token: SeSecurityPrivilege	516	WMIC.exe
Token: SeTakeOwnershipPrivilege	516	WMIC.exe
Token: SeLoadDriverPrivilege	516	WMIC.exe
Token: SeSystemProfilePrivilege	516	WMIC.exe
Token: SeSystemtimePrivilege	516	WMIC.exe
Token: SeProfSingleProcessPrivilege	516	WMIC.exe
Token: SeIncBasePriorityPrivilege	516	WMIC.exe
Token: SeCreatePagefilePrivilege	516	WMIC.exe
Token: SeBackupPrivilege	516	WMIC.exe
Token: SeRestorePrivilege	516	WMIC.exe
Token: SeShutdownPrivilege	516	WMIC.exe
Token: SeDebugPrivilege	516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	516	WMIC.exe
Token: SeRemoteShutdownPrivilege	516	WMIC.exe
Token: SeUndockPrivilege	516	WMIC.exe
Token: SeManageVolumePrivilege	516	WMIC.exe
Token: 33	516	WMIC.exe
Token: 34	516	WMIC.exe
Token: 35	516	WMIC.exe
Token: 36	516	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 624	2400	UB.GG Permanent Serial Changer (2).exe	84
PID 2400 wrote to memory of 624	2400	UB.GG Permanent Serial Changer (2).exe	84
PID 624 wrote to memory of 1204	624	UB.GG Permanent Serial Changer (2).exe	85
PID 624 wrote to memory of 1204	624	UB.GG Permanent Serial Changer (2).exe	85
PID 624 wrote to memory of 2036	624	UB.GG Permanent Serial Changer (2).exe	87
PID 624 wrote to memory of 2036	624	UB.GG Permanent Serial Changer (2).exe	87
PID 624 wrote to memory of 4084	624	UB.GG Permanent Serial Changer (2).exe	88
PID 624 wrote to memory of 4084	624	UB.GG Permanent Serial Changer (2).exe	88
PID 624 wrote to memory of 1756	624	UB.GG Permanent Serial Changer (2).exe	91
PID 624 wrote to memory of 1756	624	UB.GG Permanent Serial Changer (2).exe	91
PID 624 wrote to memory of 1368	624	UB.GG Permanent Serial Changer (2).exe	92
PID 624 wrote to memory of 1368	624	UB.GG Permanent Serial Changer (2).exe	92
PID 4084 wrote to memory of 516	4084	cmd.exe	95
PID 4084 wrote to memory of 516	4084	cmd.exe	95
PID 2036 wrote to memory of 3504	2036	cmd.exe	96
PID 2036 wrote to memory of 3504	2036	cmd.exe	96
PID 1368 wrote to memory of 4824	1368	cmd.exe	97
PID 1368 wrote to memory of 4824	1368	cmd.exe	97
PID 624 wrote to memory of 1528	624	UB.GG Permanent Serial Changer (2).exe	99
PID 624 wrote to memory of 1528	624	UB.GG Permanent Serial Changer (2).exe	99
PID 1528 wrote to memory of 1668	1528	cmd.exe	101
PID 1528 wrote to memory of 1668	1528	cmd.exe	101
PID 624 wrote to memory of 3812	624	UB.GG Permanent Serial Changer (2).exe	102
PID 624 wrote to memory of 3812	624	UB.GG Permanent Serial Changer (2).exe	102
PID 624 wrote to memory of 2404	624	UB.GG Permanent Serial Changer (2).exe	103
PID 624 wrote to memory of 2404	624	UB.GG Permanent Serial Changer (2).exe	103
PID 3812 wrote to memory of 996	3812	cmd.exe	106
PID 3812 wrote to memory of 996	3812	cmd.exe	106
PID 2404 wrote to memory of 552	2404	cmd.exe	107
PID 2404 wrote to memory of 552	2404	cmd.exe	107
PID 624 wrote to memory of 224	624	UB.GG Permanent Serial Changer (2).exe	108
PID 624 wrote to memory of 224	624	UB.GG Permanent Serial Changer (2).exe	108
PID 224 wrote to memory of 2620	224	cmd.exe	110
PID 224 wrote to memory of 2620	224	cmd.exe	110
PID 624 wrote to memory of 4580	624	UB.GG Permanent Serial Changer (2).exe	111
PID 624 wrote to memory of 4580	624	UB.GG Permanent Serial Changer (2).exe	111
PID 4580 wrote to memory of 1976	4580	cmd.exe	113
PID 4580 wrote to memory of 1976	4580	cmd.exe	113
PID 624 wrote to memory of 5028	624	UB.GG Permanent Serial Changer (2).exe	114
PID 624 wrote to memory of 5028	624	UB.GG Permanent Serial Changer (2).exe	114
PID 624 wrote to memory of 4120	624	UB.GG Permanent Serial Changer (2).exe	115
PID 624 wrote to memory of 4120	624	UB.GG Permanent Serial Changer (2).exe	115
PID 4120 wrote to memory of 2188	4120	cmd.exe	118
PID 4120 wrote to memory of 2188	4120	cmd.exe	118
PID 5028 wrote to memory of 1096	5028	cmd.exe	119
PID 5028 wrote to memory of 1096	5028	cmd.exe	119
PID 624 wrote to memory of 2364	624	UB.GG Permanent Serial Changer (2).exe	120
PID 624 wrote to memory of 2364	624	UB.GG Permanent Serial Changer (2).exe	120
PID 624 wrote to memory of 376	624	UB.GG Permanent Serial Changer (2).exe	121
PID 624 wrote to memory of 376	624	UB.GG Permanent Serial Changer (2).exe	121
PID 624 wrote to memory of 4708	624	UB.GG Permanent Serial Changer (2).exe	122
PID 624 wrote to memory of 4708	624	UB.GG Permanent Serial Changer (2).exe	122
PID 624 wrote to memory of 1768	624	UB.GG Permanent Serial Changer (2).exe	124
PID 624 wrote to memory of 1768	624	UB.GG Permanent Serial Changer (2).exe	124
PID 1768 wrote to memory of 1872	1768	cmd.exe	128
PID 1768 wrote to memory of 1872	1768	cmd.exe	128
PID 2364 wrote to memory of 2352	2364	cmd.exe	129
PID 2364 wrote to memory of 2352	2364	cmd.exe	129
PID 2352 wrote to memory of 2720	2352	cmd.exe	130
PID 2352 wrote to memory of 2720	2352	cmd.exe	130
PID 4708 wrote to memory of 5044	4708	cmd.exe	131
PID 4708 wrote to memory of 5044	4708	cmd.exe	131
PID 376 wrote to memory of 2800	376	cmd.exe	132
PID 376 wrote to memory of 2800	376	cmd.exe	132

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2620	attrib.exe

C:\Users\Admin\AppData\Local\Temp\UB.GG Permanent Serial Changer (2).exe
"C:\Users\Admin\AppData\Local\Temp\UB.GG Permanent Serial Changer (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\UB.GG Permanent Serial Changer (2).exe
  "C:\Users\Admin\AppData\Local\Temp\UB.GG Permanent Serial Changer (2).exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:1756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:224
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
      4⤵
      Adds Run key to start application
      PID:1976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:1096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:376
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:2800
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4860
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:468
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:688
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4052
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:1712
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3808
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:2380
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:532
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:1992
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:4824
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:2960
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:2172
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:3544
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:1052
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:996
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:3740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:1500
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:2948
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2056
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2868
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:3532
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:2032
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:4120
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4736
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4924
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4204
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConvertToCompress.xlsx

Filesize
11KB

MD5
52bbc5acdded4334d4e845665d892858

SHA1
a6239dfa0cc55d4501af7e9f2d3675d0c5d89b1a

SHA256
cbf4048760b2d4cd66d1a6c4c68788c555382ff0089fcf26aa96715ee5d9d62b

SHA512
8566a0ee72adb26bcc2b3f874e7543b87f834cfaa557b6c6e33f41ab196b89c8493dcea85cf243d5b876e03af0100e8bbdc9f1447cd0813c548908dac46a0ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\InstallPublish.docx

Filesize
12KB

MD5
259215f15b2a191021e6073992b34d2c

SHA1
9d8f9a0f9563ce71e39fbc1c48da3d4130bde5ea

SHA256
0147a5642074bd61fb3ad6ee02cf4cc26b3066e8d74966ddd856905acf92b1a9

SHA512
018224dd72ef866379b54ca291e2635dad096b04a89e8d81f5acd77fdcd058666f7f3a32f4ad32fa3527e877b8320626bc8c21db7839e0460ae9031d393be1b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RedoSuspend.doc

Filesize
177KB

MD5
fa04f696241a8dc50e35e44ce695418b

SHA1
c160e25737b77c228c2424466bc24ac4cb7b7738

SHA256
96e9c3bfbdd0a97cc8f423477def52782b3d726205c306f4a99ec003f619297a

SHA512
e681e7555d9c34b5d356ef8a577144d358f8af4f263e673e55059efdec4c79a723fd6fd32aa3230a75b1f6d208cf8eff678ae465a543a76c05dddf846e3dffdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\TraceRestart.docx

Filesize
13KB

MD5
2e657f874199eeda1a26fabdec21e1c1

SHA1
3419c6c12dab42831326801f50f773c5c5ee3b9b

SHA256
e0934e40d2580418b8d48cd9baed5e4ba7ceddc1fe07f298f92c5e73383d0a86

SHA512
d7fa420ec33df3bae4a53c3127797823e13857508b436df995a2e80f8ff4f28d5d2cebfbc42a6caa92cf6d84195cc21e1346722edfdad47eff4e31acec37a106

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UnlockUpdate.xlsx

Filesize
9KB

MD5
59fbac550443dcea8de8e711f1e14e29

SHA1
587501bf84c3768d11d1b7c5c59e188126a1d8b9

SHA256
005cf47962329012975bc76df6897eff1dd64b514bfb9f6ee6fd0c8bd44f7155

SHA512
7a5177853ea749204f0ff53b3aa86e8538293ea73bb504c2e1dba9c0d89b605dd29009f5b5eee27183ad126f631448f354616e831e2c50066d80d00f4dcce9b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\DismountConfirm.txt

Filesize
368KB

MD5
4950c3baeb5654fc4d512ca24f6c4f40

SHA1
1b683b33dc4e90fe99fa028b713150f8053e8bef

SHA256
cd38ea3b6240737f76adffa2331569f94bf1c4370dcaff76607791a22a884b2d

SHA512
6244e0484f75a3129bffc3dd00c53dd8b76c37956a3768fb8a0325794b8f60a92e521059cc7a8f2a420ba132bf92f80283cb4efc64d967589c9d8889a1fe998f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\InvokeReceive.xlsx

Filesize
9KB

MD5
cce5ec92508f223409396ea7fb5eb3f1

SHA1
6cc83215eb59dea1a4243667a7a3962efea66180

SHA256
ccded4f22046e26d45373bfcf3d43d0e7193c7822c521a39a7c41e9cd8c28c41

SHA512
74b7ab8f2cf56250e1f048983495d6852a59534a3c1d82f6a0ba77a312d8756d5e021bafb527b3157c4171365cb5f1b2a1530d81e13aeb26202e13f7492fe128

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OutWait.docx

Filesize
17KB

MD5
097809c13e03775d124531b94dace057

SHA1
805e1fb8fc2c0b84ccbe7e08fa0caade8d64df2e

SHA256
79593cd9ab27cda78a22b672eb701e54dd7626648d1cfb4625e73735af83d490

SHA512
99a1a44ac9e3f40bee1868497bb3d2b3a7c0e2b85e45df3de86062d405e9d4bcbe10078274f2f910d501a8278992bfb4bf470a224d0f8343b6fd28c5de00d272

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RepairBlock.xlsx

Filesize
11KB

MD5
a70df941743908b22b7426c916d19c6f

SHA1
68ba9da74d403130e88961aed2db53423559884e

SHA256
b1b81c73e98f9051ba16f3448a9293c37f5d48f1e95a8aa16875c3054b20abe3

SHA512
0efb3aec2d5a4d614c18a1ea1a94c505239c5d605c595094355937ce08d43e85bee4399e538a74ae58d7ca1f68db3592f954558dc95f7e2c851e058d28ee7224

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ResolveSplit.docx

Filesize
516KB

MD5
59405674a5330c5483aa82fe9e19c675

SHA1
fe87e5275e3dabb8fcbe989deeea1a3e0129e206

SHA256
7c50ac49f3784f5c4207213ae9422f13e798ca327493c292d0503ecd0cb36b16

SHA512
c94954a68b4a57660bf8163e5042a666f40da2199e5018648ca9ee300edcfb9dc75ff4c4d5ad050e1b057232488e3898a22534cf54274a0aaa7210da9edf8702

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RestoreExpand.docx

Filesize
13KB

MD5
64dbd1e8a1d11ff6034d5d152bcce539

SHA1
911d404569931ead67b5837c3bfb3d55ca6fa444

SHA256
f4d6f1a3236973e04c976138b2b654a99f24c9635e70848350751a196bf4de0b

SHA512
4753e4381db42efa7b3ce02c017744913cdffb751e2ed34de479ca3c27a714de1169f11342477b56c8d5e59b8ebe92e5759651b36ac6d1debae19da013408621

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ResumeCopy.docx

Filesize
15KB

MD5
ebb0745f6fc56e414982ed572730b16c

SHA1
91a2db154a0d154b93b2cff7201adf2f89223d32

SHA256
0c5f3ec1aa0436bcac0b98a6a8177ddd98d522565a5fb04d652fde23044fb193

SHA512
d993e115145e8b039dd55c8adec84776693d14f2c34f80dad1f3a69c283cf2f7c235a30b385e95089ee348f4d2d421305f632a2ff0db2d0ff43624a462ec00b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\MeasureUse.csv

Filesize
902KB

MD5
9aa269f4fe0728e14fc639ee18a01ab4

SHA1
d3ee8dc1d1ee3db57786482f4b3c003943f4ca08

SHA256
b9369760accee5b64bb936a44575481fb734ed2f36ef728d5b9f7710db7422a4

SHA512
9943c0a0d7dc23045cae2be61cebbcf109e3ae3de2f9c785d6a97691031e25635a9d11ec0502505f0552e1f4ec81551e0806129c773dba9b48cbd5dde4850f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnblockOut.docx

Filesize
621KB

MD5
d78bd7cc984ffb7e3c5612d33605f635

SHA1
62a74193a902a8503bf3dbc789cc91a3dc71fd9e

SHA256
04acadfc1488639af879a055c581ec84f0a66a4b3d6f5074f9d64723b62b7309

SHA512
531446af6fed1d7e8e2831f5b04ae1fb05cd5d597110fb88956179f421d661f3f4cad71931d3b99f7bace99ad2db0e201889f2efaea450b631be5f533fece763

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UndoPing.pdf

Filesize
597KB

MD5
4df7280fea7f6e4f87f37cd5d9ca78d4

SHA1
7dded4688ef6aca26cf19101bfa2fcf0a2e28bda

SHA256
bf7f5e56b12fb0901674767bf1de9e78f3920adbd649bbcf2f07e7db8d9eaf5d

SHA512
1b2bb02bc3c4703c8f0da425a3cfe1e319004f451f6b78caca98de26d1feb116ba749c67df53ebd5b4add9bab1e47c7d5c393474aa2a0281f99d6100498124b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ApproveBackup.au3

Filesize
690KB

MD5
9b7edc9c222f323bb46bbb1d2085ad86

SHA1
f55f45cdc8053d2ce2ef160f6c2844245b5669c8

SHA256
ff83bfc769493a23246b740975ba7e8b9a0cfdff708086f29696d883955c7164

SHA512
b9f5da387534ee4e714189e7c0082a37e541c062b734aa4bb83d7c7102b0b340686eeb3d7c9f7980bff72449d605b4b14b48206809ce2bff411c8ded0491c39d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\GrantConvertTo.mp4

Filesize
809KB

MD5
612179f27c5b4d8b871d391a4f4f2999

SHA1
65526732f7e5211442d4898ceb2646a589f5eeb5

SHA256
5f8e491f57487c6d394b188f5e70050d8a46332f9b811cb7e29e4e7827141581

SHA512
73962de5933aae8fa29805569d77ce620009511382cc1cbcc0905c3401fec5f237275a8d0a85976a0976c3b4e85460e1a65bc6d19b735432bbfcb502c7605960

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ApproveBackup.tiff

Filesize
494KB

MD5
084a94ccb2fef3a8a187f79716369243

SHA1
2b72f4d3a08d83d318d68b00cfcd6a832644cf00

SHA256
8493f3fbec53dee0d7fe96fac53934e7ffabe271441b6117f9955684ca5e1d40

SHA512
165dd394d16e385e24baaad279bce1ca9125986e82b14f1ba1080a43f4191da653fe3007da1c352da200ecb41ac8624e5ea4d5a6ae7b736e3f44fd889259708e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\AssertImport.jpeg

Filesize
230KB

MD5
7241c9dacbf63bb541654aedb11aed49

SHA1
152a637bd27c7eff2a0f9588343a618e4d8ef6c0

SHA256
135169e389685aa961e207a4023d17a4df627bf6c0ddb3c4e9442f26eeecc0b7

SHA512
2d5b818fb39f4b579be3d94b4487b42b39644eb94ebc8f8a79bce0999bc963d6bda384a7b20372e2972ad3e8f41617ea3d28784ae6c03cb55ad39ee6b13f5c53

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\EnterRemove.png

Filesize
306KB

MD5
04dd148d836828e9966d7d692c99020f

SHA1
521b44bb5471f0fdfc0e76172ab2e9e0f94f7be5

SHA256
0cf683423b9a88fb1362c94829019c64d41b642c722a3d6a61572609e391365d

SHA512
0bc5380e54a9a37488603dbf3ba604dfac2e7dcac9fb6399ec12a21e70eaa1e74fc4f4f060f7b0ae7bb67a04cce3b512b85213f71f929e4a67149a238969afae

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\HideSend.png

Filesize
391KB

MD5
74983492a11cfbe2e6142c58b1aced8e

SHA1
1334c052d2808d0167c2ed90d9dbec97e545dfa5

SHA256
b82e04d78ccf7d65acb0787192634407c32c41c2fea69aa7105aba7f486ae70f

SHA512
31e2165beef24d45959fee59556773e5fb75bd339f44555679ede51d2546cafd3ed5f84ac8f164bdde7c2e180d1bf30ee316ce07ac7b110c23a90d4374c34502

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_asyncio.pyd

Filesize
36KB

MD5
c2da8c02c14c1539c9e1ac4e928d60b0

SHA1
74f98ce6b84acbd91fb7acead1c3385e90e20bb9

SHA256
bcd230ff2ce48f416a78d67486b5bdd4bf06dce89c9821205d448772d4becd0b

SHA512
86003c5970e49d39a26c8cf41549502e19696bd30b4a8738b81e4b86eec6b8d67dd734026ce55241b0dd6aa80f759ae20261bf82aa877c1652437422be2723d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_bz2.pyd

Filesize
48KB

MD5
f807854b836ab1e84fcdb11560216929

SHA1
627ef83ca0611d9cb267c72dfccf2f0a30297d7c

SHA256
5847649160f3f1564e26cba88e70bd159cc5cea08a1bf07ecd5b7796a49d259e

SHA512
85c28890f2fa4ea6d4f295d41ffc11109d217449cd6f77ea4a901d3f681c67f1abf59fdc5dead503db99ba766d1c51ee5505e456a3b605374b00e3ff832add1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
0f0f1c4e1d043f212b00473a81c012a3

SHA1
ff9ff3c257dceefc74551e4e2bacde0faaef5aec

SHA256
fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b

SHA512
fcfa42f417e319bddf721f298587d1b26e6974e5d7589dfe6ddd2b013bc554a53db3725741fbc4941f34079ed8cb96f05934f3c2b933cda6a7e19cda315591a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_ctypes.pyd

Filesize
58KB

MD5
955a3624921b140bf6acaba5fca4ac3b

SHA1
027e0af89a1dbf5ef235bd4293595bbc12639c28

SHA256
ea07594b2eede262d038de13a64b76301edfbda11f885afa581917b1fb969238

SHA512
b115e83061c11aaf0a0f1131a18be5b520c5cbc3975f5b7a1e9cea06b0aff7a2815165fcd1f09ba1efcf7c185e37e84a0b6ad4eefea3049a369bdf46ed3d2cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_decimal.pyd

Filesize
106KB

MD5
d967bea935300a9da0cd50bf5359a6ea

SHA1
4c2fd9a31aabc90172d41979fb64385fda79c028

SHA256
4b312a03c3a95bd301f095ab4201e2998a3c05e52fcd16c62ab1e51341f54af2

SHA512
7baa39a35bead863833efd7519c761e8cd4e15b35825427cf654181534f41c9abcdd85e017daeb9afefe291d6c2741505bf7eef30d4d25d53ada82646857f356

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_hashlib.pyd

Filesize
35KB

MD5
beac22863ee05d291190b6abf45463c0

SHA1
94cc19e31e550d7fd9743bbd74bfe0217cdde7f9

SHA256
c1c3856ee8e86c8e5cf2b436c1426067f99a40c0da4cbea4e0b52582cd7b6b5b

SHA512
8ae651b912c0f9f2c431a4d3f1c769746f787bdd70ce53626106c903cb3f364cb1bae7e6e2476868420abd849a990c5604c533bc64b0eba149f6bc36514a6f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_lzma.pyd

Filesize
85KB

MD5
872fea740d2ae4d8b9bb2ac95059f52b

SHA1
22274e636e2ef57ad16ccf0eb49a2ff3e37ba080

SHA256
c9a4162df80a99e4723dd60bdf34b8fefc4005f7865dc3e6d86833d84fa25da2

SHA512
f85d1b6602826b21f12a873176f7a5c857c3213ae329ed7a0b8f7d9b1a791edc5549d8fce3c5d2305ce40a4d8a57d9845b2956d42d374de78d5324703d5dfa03

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_multiprocessing.pyd

Filesize
26KB

MD5
eaaadf40dd833d09bc92d6222aeb2f14

SHA1
cfe29566262367fcf7822de328af95b386d96a2d

SHA256
f7d615c6fc3ac5201ab2b369fd7e0443967dc132ee5fc981acb07bf8dc4697cb

SHA512
8216324a30cc66b7bc51c4a96ce0b8f5ad563025e59cf1bf457a84076dc8e8a0291c8a6fce6dc19ec3877d2dbaa9bbaf5cc1d34553fd3423a258b51ea4d40f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_overlapped.pyd

Filesize
32KB

MD5
dbe30ce23b5f19e1b6516653bc6692fc

SHA1
9e46ea221793eab9256e7425c8143323640259e1

SHA256
67d476307c3ae5ffd221c67f26fc76ce2cf5b97b91f32028a7549d131e33454a

SHA512
2b0f9e2e0dce0e87e240acf874e0399249c6baa35382d50d2f68989942e81d038d5bb9b734b313339c9f2df175a8319683671ea58997097aec667597024e2338

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_queue.pyd

Filesize
25KB

MD5
c3cea46d675e3f2a00f7af212521c423

SHA1
0a7c76039e0ed61e3853c4c553bb6cfc9cbd2c7c

SHA256
02b62aee4867505e3d12a3abd0288cf7a75658ac908d06f5b24fdb178094e29d

SHA512
8d9af1d88a2a9528096388db3bd4ff8add480ef94689e851fa4c5a68ec9b97c561b2edfc7e34061beb7bcc26b884a0a06af196008d8705d0284b22878c95289e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_socket.pyd

Filesize
43KB

MD5
9505afe166eb419f5a1d33ff1254722e

SHA1
f343d7b444eb58033086de5376725deda5e0e418

SHA256
af42a1c35155eb989332c25a81d6e2ed08d8e33718d18d32ba5b00092f2a0f21

SHA512
46b7c86d3384db9adb8f1f52b83aaac398547ab86bc07800b0eb87e9abeb9d97e24fb8a70f01224d7c4e8a2a532d9353ad1c1f91d0416b429b87ee0ebe1daec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_sqlite3.pyd

Filesize
56KB

MD5
83d8256bc4b9f1fa9fe3b79196166074

SHA1
2f05420a7c663855f5290fb88cc20a15a7870090

SHA256
f63e3bcad55ef5f5e42076e12730f51bc5b4f3890eb0632a36d2755c5457a57a

SHA512
a2e55d4a1a7ca4239e20faad4cbb9591c91e245c0d8fccb01b898df1c5c4d28010d378b00ec3abbf973d87f874bb77c02fe0f5d471d47d513a93a4d3c54c94a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_ssl.pyd

Filesize
65KB

MD5
d8567f88c0c935c77d2258c7c9db4ca4

SHA1
1decc299b3e58f8401264354f3874dd2f0d7cd0a

SHA256
9a7e02cf4c66cc6be6b2bf03282b4d88f16d12eb10ea78f36cdce0776f6a6289

SHA512
faa5067c4ed2143d316abf96ae096a1229b7450c9d3a850c496b484794897b246c59716f096806982d9c74cb3799a94c8ddce646eb990ca89086f8d16d4c5ea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_uuid.pyd

Filesize
24KB

MD5
3a09b6db7e4d6ff0f74c292649e4ba96

SHA1
1a515f98946a4dccc50579cbcedf959017f3a23c

SHA256
fc09e40e569f472dd4ba2ea93da48220a6b0387ec62bb0f41f13ef8fab215413

SHA512
8d5ea9f7eee3d75f0673cc7821a94c50f753299128f3d623e7a9c262788c91c267827c859c5d46314a42310c27699af5cdfc6f7821dd38bf03c0b35873d9730f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\aiohttp\_http_parser.cp311-win_amd64.pyd

Filesize
81KB

MD5
d0015cdc0b5784fd149496e288c92b12

SHA1
df08b6934096525334803f0553200b571eb409d8

SHA256
53b2b23a54a04ba3166a703f95f66f97b480c5e292ba132dea1c5aa27a5b79fc

SHA512
a0bce0570b47c4b903cfb02a9525d179d9dcc1ac72e8f399c4d68eba8bbfe1aa7ed5a479c792371e7fbc3d5e83d6367ee88753c032f0699f4a596e258924aaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\aiohttp\_http_writer.cp311-win_amd64.pyd

Filesize
24KB

MD5
01ad6d465ae412a90ffc4182859c6ed3

SHA1
3507f55ac173a3c7d79abed35751c7e0b8657d9e

SHA256
a265bc3961a251f72fa6517fc63fa776a23906a042b273d0b6237296dfe8d85f

SHA512
838b849b4d5f4881a6718a18470654050f78d48624bd480a8721e9f478d91497f60b75c61edc8bf356270e39597fe0f8ff61b2a518ef41a5565712b8885cc1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\aiohttp\_websocket\mask.cp311-win_amd64.pyd

Filesize
19KB

MD5
986372efcb4a82c018492e96c9555acb

SHA1
8bee8140632511694cf79e932f41fe34a7057d4e

SHA256
8eff46f03756da5183fde6aacaeaaff8a503545fb2142e449db42dc0d9be7480

SHA512
f696fd1c75015bbd784c47e900b16c3234992c781287f71cf98f47b5994e1c2898cc5e63c2f02594ccc41f7173873699a10aa01fd23f3abc76d65fb6230087f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\aiohttp\_websocket\reader_c.cp311-win_amd64.pyd

Filesize
61KB

MD5
eef1b62d99dbbbf17a0df939a91186f1

SHA1
ac142397a477d62850ff638318b0e9d36c2245b8

SHA256
44d8861eddf16b8346655e05cf9ae82fc41ce58e38aff6e88f0ab9564e03bf98

SHA512
fe9f86107f667467f1e5b71812b571a023cc6c7e9a835afcc2d302a8373d6b690713518ee8bf201fecf382c40d154c2f8bd6dc60fad115aae65eb4a488a96b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\base_library.zip

Filesize
1.4MB

MD5
ddfc1831fd727cc1750c619e30bee1fe

SHA1
ccfb67344a6558c2c59c3da5a6ba90073253d96b

SHA256
a88ee7594f01ba09d12842fd566a8ba11e528c36654707d406a91de0e4502a64

SHA512
7a6199389174e658873fe6429ad0aa1ef6d8047285fcc542a746f14198fe86620cd753fe6ac7851701cfac50e635094be02ee50c4bc35d2e5738f7b58c810bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.0MB

MD5
606a84af5a9cf8ad3cb0314e77fb7209

SHA1
6de88d8554488ffe3e48c9b14886da16d1703a69

SHA256
0693ffa4990fa8c1664485f3d2a41b581eac0b340d07d62242052a67bf2ed5c3

SHA512
97d451f025aefb487c5cea568eb430356adfe23908321f1c04f8fa4c03df87507eda8d9612c944be4fa733df4cec38a0e37bffd8865088064b749244d4321b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\frozenlist\_frozenlist.cp311-win_amd64.pyd

Filesize
36KB

MD5
4958b93afcea376c56d67eb2d70645bc

SHA1
a5b31435c2925b585a14666cb23682bcba38a576

SHA256
bfeb41b7d1aeae29992a44dc992fd7c752b87b0f87d67cf452eba15e85341cbe

SHA512
be32abe68cef6c8e396de42f2b5adaff4373172b5b980e1bfff0944330f1bfad92b58cf00997f072da129522cd14b54d48b8a39dba1d3e0798ad863d7ba32a39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\libcrypto-3.dll

Filesize
1.6MB

MD5
f3fdbbd6c6ea0abe779151ae92c25321

SHA1
0e62e32666ba5f041b5369b36470295a1916cb4e

SHA256
9000e335744818665b87a16a71da5b622b5052b5341f1d6ce08ff8346d2bf3e4

SHA512
e8a363042a05868acc693b5d313f52ffc95b8f6b764a77ff477b0ce2288787dd275478ddbe33d6dbd87636ba9ff0243d2e447a161e2f9cc2f3dba0746f219e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\libffi-8.dll

Filesize
29KB

MD5
0d1c6b92d091cef3142e32ac4e0cc12e

SHA1
440dad5af38035cb0984a973e1f266deff2bd7fc

SHA256
11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6

SHA512
5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\libssl-3.dll

Filesize
223KB

MD5
f9bc28708c1628ef647a17d77c4f5f1a

SHA1
032a8576487ad26f04d31628f833ef9534942da6

SHA256
49ba508dc66c46b9e904bb5fe50cf924465eff803a9f1e4260e752b0231efcc1

SHA512
e33fd00bcf73aab8bce260eda995a1513930b832ea881c5a8ce1a151be3576f3369ac0b794fdd93806157bb9f4fe4eba38a25f4fdc512a6f3640647b8b447387

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
5587c32d9bf7f76e1a9565df8b1b649f

SHA1
52ae204a65c15a09ecc73e7031e3ac5c3dcb71b2

SHA256
7075185db068e3c8f1b7db75e5aa5c500fc76ed8270c6abc6f49681d7119a782

SHA512
f21d0530389138457d6fdcdb3487a3c8b030338c569b2742f9e691e43af1d9e779c98426bad81b152f343b324a9375fe1322ef74030b1c8f8ba606d19e562e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\propcache\_helpers_c.cp311-win_amd64.pyd

Filesize
31KB

MD5
51f012d736c71a681948623455617995

SHA1
e6b5954870c90a81da9bf274df6ceac62d471ad8

SHA256
b495db6bac375f948efa2830073bf1b4496086e2b572b5353ebd07bcd07e200f

SHA512
a409f3ef69887761620403ca4bd2ebfbb8f3648139dd654d5da47f4fa61ff6d3e73557b3a19aefe59eb7ab9eb39d59048115c0bc2046bc09b3fdc7108b91dc3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\pyexpat.pyd

Filesize
87KB

MD5
ec28105660f702c7a4a19d2265a48b43

SHA1
2603a0d5467b920ed36fef76d1176c83953846bc

SHA256
b546bf126f066a6645ae109d6d08df911fb77301cc5e6d39434cd24475822af5

SHA512
a388a7a5072d34b3477c5bb872f6e1242128bddb09d87ceac840615d80f0315ec60ff443ca5fab590332e43c4bf3d4ce5d3cc63eaca40945110c1888d2a69dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\python3.dll

Filesize
65KB

MD5
d8ba00c1d9fcc7c0abbffb5c214da647

SHA1
5fa9d5700b42a83bfcc125d1c45e0111b9d62035

SHA256
e45452efa356db874f2e5ff08c9cc0fe22528609e5d341f8fb67ba48885ab77d

SHA512
df1b714494856f618a742791eefbf470b2eee07b51d983256e4386ea7d48da5c7b1e896f222ea55a748c9413203886cde3a65ef9e7ea069014fa626f81d79cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\python311.dll

Filesize
1.6MB

MD5
affa456007f359e9f8c5d2931d966cb9

SHA1
9b06d6cb7d7f1a7c2fa9e7f62d339b9f2813e80f

SHA256
4bab2e402a02c8b2b0542246d9ef54027a739121b4b0760f08cd2e7c643ed866

SHA512
7c357f43dd272e1d595ccde87c13fd2cdf4123b20af6855576bfba15afd814a95886cebbe96bb7781b916f9db3c3ee02d381036ddbf62095de3ee43a7f94d156

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\select.pyd

Filesize
25KB

MD5
a74e10b7401ea044a8983d01012f3103

SHA1
cdd0afa6ae1dcebc9ccfec17e23c6770a9abfb8f

SHA256
78a4b12d7da7e67b1dc90646b269c3e8dfea5dc24e5eef4787fffd4325fe39d8

SHA512
a080050b5d966303d2a27cafca8cbf83777329a54ca00bbb16eb547eef4262c9fdf7c828cadb02e952aeb631ec560d1dce3cf91f387a96de9e82037f1c3ac47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\sqlite3.dll

Filesize
622KB

MD5
7219d265a3204344ce216344de464920

SHA1
13e7b7980e17ed5a225b93ffb393f1bc7419ac2e

SHA256
5821d8bd76212b57eee95b7ecb5a8381d2fe24ae31164be03f0f8bf13d5b86d4

SHA512
d554c881073417dd03334521ca0afc95716b1a9788e9ee1a0540ce3d7e53132f4ee511c10b05ab090909002294d9648d1d65e994c8d105bff7142cdcce1d4b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\unicodedata.pyd

Filesize
295KB

MD5
660ef38d6de71eb7e06c555b38c675b5

SHA1
944ec04d9b67d3f25d3fb448973c7ad180222be3

SHA256
fd746987ab1ea02b6568091040e8c5204fb599288977f8077a7b9ecefdc5edb4

SHA512
26ac7d56e4fb02e43e049c9055979fc6e0e16fab8f08f619233e12b278f300faa5ffabac1d9b71091571a89cdf9acfeb3478508fba96ef2e647327215be6e9d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
41KB

MD5
99569b47d3a55086013a5760a28ac6af

SHA1
9e5017979fb646b00c98f4fe2cf8c8f7d5dd3664

SHA256
469f039bfa377890b95c9d3413ece8ca296d156ad4ec194d8ec78d6b81a9d0b6

SHA512
8425d38d3b69472e5e41e4ece08ba2dbdd2d871c1bf083d859edec006a4ee9441796d53f1373f030c8ccf32b74bdaee2a9b3a32457cc53024d15322e5920895e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uvpb1mtc.znm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/624-101-0x00000272700D0000-0x00000272705F2000-memory.dmp

Filesize
5.1MB

Download
memory/624-109-0x00007FF82AC60000-0x00007FF82AC74000-memory.dmp

Filesize
80KB

Download
memory/624-126-0x00007FF82E720000-0x00007FF82E753000-memory.dmp

Filesize
204KB

Download
memory/624-132-0x00007FF82E590000-0x00007FF82E65D000-memory.dmp

Filesize
820KB

Download
memory/624-134-0x00007FF829720000-0x00007FF82976D000-memory.dmp

Filesize
308KB

Download
memory/624-136-0x00007FF829700000-0x00007FF829711000-memory.dmp

Filesize
68KB

Download
memory/624-139-0x00007FF8296C0000-0x00007FF8296F2000-memory.dmp

Filesize
200KB

Download
memory/624-121-0x00007FF82DDE0000-0x00007FF82DF57000-memory.dmp

Filesize
1.5MB

Download
memory/624-143-0x00007FF8296A0000-0x00007FF8296BE000-memory.dmp

Filesize
120KB

Download
memory/624-142-0x00007FF82DD10000-0x00007FF82DD25000-memory.dmp

Filesize
84KB

Download
memory/624-138-0x00000272700D0000-0x00000272705F2000-memory.dmp

Filesize
5.1MB

Download
memory/624-135-0x00007FF81E9E0000-0x00007FF81EF02000-memory.dmp

Filesize
5.1MB

Download
memory/624-122-0x00007FF829640000-0x00007FF82965B000-memory.dmp

Filesize
108KB

Download
memory/624-146-0x00007FF81D5D0000-0x00007FF81DDCB000-memory.dmp

Filesize
8.0MB

Download
memory/624-147-0x00007FF829660000-0x00007FF829697000-memory.dmp

Filesize
220KB

Download
memory/624-160-0x00007FF829FB0000-0x00007FF829FD2000-memory.dmp

Filesize
136KB

Download
memory/624-197-0x00007FF829640000-0x00007FF82965B000-memory.dmp

Filesize
108KB

Download
memory/624-198-0x00007FF82D070000-0x00007FF82D07D000-memory.dmp

Filesize
52KB

Download
memory/624-196-0x00007FF81E550000-0x00007FF81E66C000-memory.dmp

Filesize
1.1MB

Download
memory/624-103-0x00007FF82DD10000-0x00007FF82DD25000-memory.dmp

Filesize
84KB

Download
memory/624-630-0x00007FF834460000-0x00007FF83446F000-memory.dmp

Filesize
60KB

Download
memory/624-216-0x00007FF829720000-0x00007FF82976D000-memory.dmp

Filesize
308KB

Download
memory/624-215-0x00007FF833420000-0x00007FF833439000-memory.dmp

Filesize
100KB

Download
memory/624-225-0x00007FF82DDE0000-0x00007FF82DF57000-memory.dmp

Filesize
1.5MB

Download
memory/624-226-0x00007FF82E720000-0x00007FF82E753000-memory.dmp

Filesize
204KB

Download
memory/624-244-0x00007FF8296C0000-0x00007FF8296F2000-memory.dmp

Filesize
200KB

Download
memory/624-230-0x00007FF82DCF0000-0x00007FF82DD02000-memory.dmp

Filesize
72KB

Download
memory/624-229-0x00007FF82DD10000-0x00007FF82DD25000-memory.dmp

Filesize
84KB

Download
memory/624-228-0x00007FF81E9E0000-0x00007FF81EF02000-memory.dmp

Filesize
5.1MB

Download
memory/624-227-0x00007FF82E590000-0x00007FF82E65D000-memory.dmp

Filesize
820KB

Download
memory/624-217-0x00007FF81EF10000-0x00007FF81F4F9000-memory.dmp

Filesize
5.9MB

Download
memory/624-218-0x00007FF833490000-0x00007FF8334B3000-memory.dmp

Filesize
140KB

Download
memory/624-241-0x00007FF81D5D0000-0x00007FF81DDCB000-memory.dmp

Filesize
8.0MB

Download
memory/624-242-0x00007FF829660000-0x00007FF829697000-memory.dmp

Filesize
220KB

Download
memory/624-274-0x00007FF833420000-0x00007FF833439000-memory.dmp

Filesize
100KB

Download
memory/624-267-0x00007FF82DD10000-0x00007FF82DD25000-memory.dmp

Filesize
84KB

Download
memory/624-264-0x00007FF82E720000-0x00007FF82E753000-memory.dmp

Filesize
204KB

Download
memory/624-266-0x00007FF81E9E0000-0x00007FF81EF02000-memory.dmp

Filesize
5.1MB

Download
memory/624-255-0x00007FF81EF10000-0x00007FF81F4F9000-memory.dmp

Filesize
5.9MB

Download
memory/624-107-0x00007FF82DCF0000-0x00007FF82DD02000-memory.dmp

Filesize
72KB

Download
memory/624-118-0x00007FF81E550000-0x00007FF81E66C000-memory.dmp

Filesize
1.1MB

Download
memory/624-117-0x00007FF82E760000-0x00007FF82E783000-memory.dmp

Filesize
140KB

Download
memory/624-115-0x00007FF829FB0000-0x00007FF829FD2000-memory.dmp

Filesize
136KB

Download
memory/624-130-0x00007FF833420000-0x00007FF833439000-memory.dmp

Filesize
100KB

Download
memory/624-112-0x00007FF833440000-0x00007FF833459000-memory.dmp

Filesize
100KB

Download
memory/624-113-0x00007FF82AC40000-0x00007FF82AC54000-memory.dmp

Filesize
80KB

Download
memory/624-106-0x00007FF833470000-0x00007FF833489000-memory.dmp

Filesize
100KB

Download
memory/624-97-0x00007FF81EF10000-0x00007FF81F4F9000-memory.dmp

Filesize
5.9MB

Download
memory/624-98-0x00007FF833490000-0x00007FF8334B3000-memory.dmp

Filesize
140KB

Download
memory/624-100-0x00007FF81E9E0000-0x00007FF81EF02000-memory.dmp

Filesize
5.1MB

Download
memory/624-99-0x00007FF82E590000-0x00007FF82E65D000-memory.dmp

Filesize
820KB

Download
memory/624-93-0x00007FF82E720000-0x00007FF82E753000-memory.dmp

Filesize
204KB

Download
memory/624-91-0x00007FF82DDE0000-0x00007FF82DF57000-memory.dmp

Filesize
1.5MB

Download
memory/624-89-0x00007FF82E760000-0x00007FF82E783000-memory.dmp

Filesize
140KB

Download
memory/624-87-0x00007FF8332B0000-0x00007FF8332DD000-memory.dmp

Filesize
180KB

Download
memory/624-85-0x00007FF833440000-0x00007FF833459000-memory.dmp

Filesize
100KB

Download
memory/624-81-0x00007FF833470000-0x00007FF833489000-memory.dmp

Filesize
100KB

Download
memory/624-83-0x00007FF833460000-0x00007FF83346D000-memory.dmp

Filesize
52KB

Download
memory/624-78-0x00007FF833490000-0x00007FF8334B3000-memory.dmp

Filesize
140KB

Download
memory/624-79-0x00007FF834460000-0x00007FF83446F000-memory.dmp

Filesize
60KB

Download
memory/624-50-0x00007FF81EF10000-0x00007FF81F4F9000-memory.dmp

Filesize
5.9MB

Download
memory/624-634-0x00007FF833440000-0x00007FF833459000-memory.dmp

Filesize
100KB

Download
memory/624-639-0x00007FF8296C0000-0x00007FF8296F2000-memory.dmp

Filesize
200KB

Download
memory/624-640-0x00007FF81E9E0000-0x00007FF81EF02000-memory.dmp

Filesize
5.1MB

Download
memory/624-638-0x00007FF82E720000-0x00007FF82E753000-memory.dmp

Filesize
204KB

Download
memory/624-656-0x00007FF82D070000-0x00007FF82D07D000-memory.dmp

Filesize
52KB

Download
memory/624-655-0x00007FF829660000-0x00007FF829697000-memory.dmp

Filesize
220KB

Download
memory/624-654-0x00007FF81D5D0000-0x00007FF81DDCB000-memory.dmp

Filesize
8.0MB

Download
memory/624-653-0x00007FF8296A0000-0x00007FF8296BE000-memory.dmp

Filesize
120KB

Download
memory/624-652-0x00007FF829720000-0x00007FF82976D000-memory.dmp

Filesize
308KB

Download
memory/624-651-0x00007FF829640000-0x00007FF82965B000-memory.dmp

Filesize
108KB

Download
memory/624-650-0x00007FF82E590000-0x00007FF82E65D000-memory.dmp

Filesize
820KB

Download
memory/624-649-0x00007FF833420000-0x00007FF833439000-memory.dmp

Filesize
100KB

Download
memory/624-648-0x00007FF829700000-0x00007FF829711000-memory.dmp

Filesize
68KB

Download
memory/624-647-0x00007FF81E550000-0x00007FF81E66C000-memory.dmp

Filesize
1.1MB

Download
memory/624-646-0x00007FF829FB0000-0x00007FF829FD2000-memory.dmp

Filesize
136KB

Download
memory/624-645-0x00007FF82AC40000-0x00007FF82AC54000-memory.dmp

Filesize
80KB

Download
memory/624-644-0x00007FF82AC60000-0x00007FF82AC74000-memory.dmp

Filesize
80KB

Download
memory/624-643-0x00007FF82DCF0000-0x00007FF82DD02000-memory.dmp

Filesize
72KB

Download
memory/624-642-0x00007FF82DD10000-0x00007FF82DD25000-memory.dmp

Filesize
84KB

Download
memory/624-641-0x00007FF81EF10000-0x00007FF81F4F9000-memory.dmp

Filesize
5.9MB

Download
memory/624-637-0x00007FF82DDE0000-0x00007FF82DF57000-memory.dmp

Filesize
1.5MB

Download
memory/624-636-0x00007FF82E760000-0x00007FF82E783000-memory.dmp

Filesize
140KB

Download
memory/624-635-0x00007FF8332B0000-0x00007FF8332DD000-memory.dmp

Filesize
180KB

Download
memory/624-633-0x00007FF833460000-0x00007FF83346D000-memory.dmp

Filesize
52KB

Download
memory/624-632-0x00007FF833470000-0x00007FF833489000-memory.dmp

Filesize
100KB

Download
memory/624-631-0x00007FF833490000-0x00007FF8334B3000-memory.dmp

Filesize
140KB

Download
memory/1872-207-0x000001DA070B0000-0x000001DA070D2000-memory.dmp

Filesize
136KB

Download