exelastealer | hxxps://anonfile[.]io/f/oRI-BPEN

Analysis

max time kernel
356s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2025, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://anonfile.io/f/oRI-BPEN

Score

10^/10

exelastealer collection defense_evasion discovery persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
12072	netsh.exe
12108	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
10664	powershell.exe
10408	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
7460	Velocity.exe
3552	Velocity.exe
5104	Velocity.exe
6288	Velocity.exe

Loads dropped DLL 62 IoCs

pid	Process
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
3552	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
6288	Velocity.exe
3552	Velocity.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
211	api.gofile.io
207	discord.com
208	discord.com
209	discord.com
210	api.gofile.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
200	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
10720	cmd.exe
12024	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5500	tasklist.exe
10644	tasklist.exe
11876	tasklist.exe
1564	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2648	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024bf2-5200.dat	upx
behavioral1/memory/3552-5204-0x00007FF801450000-0x00007FF801A38000-memory.dmp	upx
behavioral1/files/0x0007000000024bea-5212.dat	upx
behavioral1/files/0x0007000000024bcd-5233.dat	upx
behavioral1/files/0x0007000000024bc6-5235.dat	upx
behavioral1/memory/3552-5245-0x00007FF8255D0000-0x00007FF8255E9000-memory.dmp	upx
behavioral1/memory/3552-5246-0x00007FF8249B0000-0x00007FF8249DE000-memory.dmp	upx
behavioral1/memory/3552-5244-0x00007FF803030000-0x00007FF8031A3000-memory.dmp	upx
behavioral1/memory/3552-5247-0x00007FF802F70000-0x00007FF803028000-memory.dmp	upx
behavioral1/memory/3552-5243-0x00007FF824AD0000-0x00007FF824AF3000-memory.dmp	upx
behavioral1/memory/3552-5242-0x00007FF82B190000-0x00007FF82B19D000-memory.dmp	upx
behavioral1/memory/3552-5241-0x00007FF824C30000-0x00007FF824C5D000-memory.dmp	upx
behavioral1/memory/3552-5240-0x00007FF827260000-0x00007FF827279000-memory.dmp	upx
behavioral1/memory/3552-5248-0x00007FF801DF0000-0x00007FF802165000-memory.dmp	upx
behavioral1/files/0x0007000000024bf4-5239.dat	upx
behavioral1/memory/3552-5261-0x00007FF8169F0000-0x00007FF816A0E000-memory.dmp	upx
behavioral1/memory/3552-5262-0x00007FFFFF650000-0x00007FFFFFE4E000-memory.dmp	upx
behavioral1/memory/3552-5260-0x00007FF827250000-0x00007FF82725A000-memory.dmp	upx
behavioral1/memory/3552-5264-0x00007FF802910000-0x00007FF802947000-memory.dmp	upx
behavioral1/memory/3552-5263-0x00007FF825560000-0x00007FF825575000-memory.dmp	upx
behavioral1/memory/3552-5259-0x00007FF802F30000-0x00007FF802F62000-memory.dmp	upx
behavioral1/memory/3552-5258-0x00007FF816A10000-0x00007FF816A21000-memory.dmp	upx
behavioral1/memory/3552-5257-0x00007FF804FF0000-0x00007FF80503D000-memory.dmp	upx
behavioral1/memory/3552-5256-0x00007FF824810000-0x00007FF824828000-memory.dmp	upx
behavioral1/memory/3552-5255-0x00007FF824AB0000-0x00007FF824ACB000-memory.dmp	upx
behavioral1/memory/3552-5254-0x00007FF81F980000-0x00007FF81F9A5000-memory.dmp	upx
behavioral1/memory/3552-5253-0x00007FF801330000-0x00007FF80144C000-memory.dmp	upx
behavioral1/memory/3552-5252-0x00007FF8250E0000-0x00007FF8250F4000-memory.dmp	upx
behavioral1/memory/3552-5251-0x00007FF825170000-0x00007FF825189000-memory.dmp	upx
behavioral1/memory/3552-5250-0x00007FF825400000-0x00007FF825412000-memory.dmp	upx
behavioral1/files/0x0007000000024bcb-5238.dat	upx
behavioral1/files/0x0007000000024bf3-5237.dat	upx
behavioral1/files/0x0007000000024bca-5236.dat	upx
behavioral1/files/0x0009000000024bb8-5234.dat	upx
behavioral1/files/0x0007000000024bcc-5232.dat	upx
behavioral1/files/0x0007000000024bc9-5229.dat	upx
behavioral1/files/0x0007000000024bc8-5228.dat	upx
behavioral1/files/0x0007000000024bc7-5227.dat	upx
behavioral1/files/0x0007000000024bc5-5225.dat	upx
behavioral1/files/0x0007000000024bc4-5224.dat	upx
behavioral1/files/0x0008000000024bc2-5223.dat	upx
behavioral1/files/0x000a000000024bb6-5221.dat	upx
behavioral1/files/0x0007000000024bf5-5220.dat	upx
behavioral1/files/0x0007000000024bf0-5217.dat	upx
behavioral1/memory/3552-5267-0x00007FF801450000-0x00007FF801A38000-memory.dmp	upx
behavioral1/files/0x0007000000024beb-5216.dat	upx
behavioral1/files/0x0007000000024be9-5215.dat	upx
behavioral1/memory/3552-5214-0x00007FF82B3B0000-0x00007FF82B3BF000-memory.dmp	upx
behavioral1/memory/3552-5213-0x00007FF827280000-0x00007FF8272A4000-memory.dmp	upx
behavioral1/files/0x0007000000024bc3-5210.dat	upx
behavioral1/memory/3552-5319-0x00007FF801450000-0x00007FF801A38000-memory.dmp	upx
behavioral1/memory/3552-5320-0x00007FF827280000-0x00007FF8272A4000-memory.dmp	upx
behavioral1/memory/3552-5341-0x00007FF802F30000-0x00007FF802F62000-memory.dmp	upx
behavioral1/memory/3552-5330-0x00007FF801DF0000-0x00007FF802165000-memory.dmp	upx
behavioral1/memory/3552-5332-0x00007FF825400000-0x00007FF825412000-memory.dmp	upx
behavioral1/memory/3552-5344-0x00007FFFFF650000-0x00007FFFFFE4E000-memory.dmp	upx
behavioral1/memory/3552-5329-0x00007FF802F70000-0x00007FF803028000-memory.dmp	upx
behavioral1/memory/6288-5346-0x00007FFFFD9E0000-0x00007FFFFDFC8000-memory.dmp	upx
behavioral1/memory/3552-5347-0x00007FF801450000-0x00007FF801A38000-memory.dmp	upx
behavioral1/memory/3552-5331-0x00007FF825560000-0x00007FF825575000-memory.dmp	upx
behavioral1/memory/6288-5374-0x00007FF82CC80000-0x00007FF82CC8F000-memory.dmp	upx
behavioral1/memory/6288-5375-0x00007FF805080000-0x00007FF8050A4000-memory.dmp	upx
behavioral1/memory/6288-5379-0x00007FF802880000-0x00007FF8028A3000-memory.dmp	upx
behavioral1/memory/6288-5378-0x00007FF827240000-0x00007FF82724D000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2143162845\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2074210009\manifest.fingerprint	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4972_911819007\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_79079171\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_229489228\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2143162845\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2074210009\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2143162845\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2074210009\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2074210009\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4972_603026440\_locales\hi\messages.json	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
12060	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000024bb0-5151.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
10848	cmd.exe
10952	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
12040	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
11488	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
11984	ipconfig.exe
12040	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
10896	systeminfo.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
9556	taskkill.exe
9644	taskkill.exe
9724	taskkill.exe
9812	taskkill.exe
9892	taskkill.exe
10024	taskkill.exe
10144	taskkill.exe
8344	taskkill.exe
9368	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133890025162129728"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3342763580-2723508992-2885672917-1000\{50619C0E-1A09-4C42-9C55-26994C3A5F50}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
10664	powershell.exe
10664	powershell.exe
10664	powershell.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5004	7zG.exe
Token: 35	5004	7zG.exe
Token: SeSecurityPrivilege	5004	7zG.exe
Token: SeSecurityPrivilege	5004	7zG.exe
Token: SeIncreaseQuotaPrivilege	3800	WMIC.exe
Token: SeSecurityPrivilege	3800	WMIC.exe
Token: SeTakeOwnershipPrivilege	3800	WMIC.exe
Token: SeLoadDriverPrivilege	3800	WMIC.exe
Token: SeSystemProfilePrivilege	3800	WMIC.exe
Token: SeSystemtimePrivilege	3800	WMIC.exe
Token: SeProfSingleProcessPrivilege	3800	WMIC.exe
Token: SeIncBasePriorityPrivilege	3800	WMIC.exe
Token: SeCreatePagefilePrivilege	3800	WMIC.exe
Token: SeBackupPrivilege	3800	WMIC.exe
Token: SeRestorePrivilege	3800	WMIC.exe
Token: SeShutdownPrivilege	3800	WMIC.exe
Token: SeDebugPrivilege	3800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3800	WMIC.exe
Token: SeRemoteShutdownPrivilege	3800	WMIC.exe
Token: SeUndockPrivilege	3800	WMIC.exe
Token: SeManageVolumePrivilege	3800	WMIC.exe
Token: 33	3800	WMIC.exe
Token: 34	3800	WMIC.exe
Token: 35	3800	WMIC.exe
Token: 36	3800	WMIC.exe
Token: SeDebugPrivilege	1564	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3800	WMIC.exe
Token: SeSecurityPrivilege	3800	WMIC.exe
Token: SeTakeOwnershipPrivilege	3800	WMIC.exe
Token: SeLoadDriverPrivilege	3800	WMIC.exe
Token: SeSystemProfilePrivilege	3800	WMIC.exe
Token: SeSystemtimePrivilege	3800	WMIC.exe
Token: SeProfSingleProcessPrivilege	3800	WMIC.exe
Token: SeIncBasePriorityPrivilege	3800	WMIC.exe
Token: SeCreatePagefilePrivilege	3800	WMIC.exe
Token: SeBackupPrivilege	3800	WMIC.exe
Token: SeRestorePrivilege	3800	WMIC.exe
Token: SeShutdownPrivilege	3800	WMIC.exe
Token: SeDebugPrivilege	3800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3800	WMIC.exe
Token: SeRemoteShutdownPrivilege	3800	WMIC.exe
Token: SeUndockPrivilege	3800	WMIC.exe
Token: SeManageVolumePrivilege	3800	WMIC.exe
Token: 33	3800	WMIC.exe
Token: 34	3800	WMIC.exe
Token: 35	3800	WMIC.exe
Token: 36	3800	WMIC.exe
Token: SeDebugPrivilege	5500	tasklist.exe
Token: SeDebugPrivilege	8344	taskkill.exe
Token: SeDebugPrivilege	9368	taskkill.exe
Token: SeDebugPrivilege	9556	taskkill.exe
Token: SeDebugPrivilege	9644	taskkill.exe
Token: SeDebugPrivilege	9724	taskkill.exe
Token: SeDebugPrivilege	9812	taskkill.exe
Token: SeDebugPrivilege	9892	taskkill.exe
Token: SeDebugPrivilege	10024	taskkill.exe
Token: SeDebugPrivilege	10144	taskkill.exe
Token: SeDebugPrivilege	10644	tasklist.exe
Token: SeDebugPrivilege	10664	powershell.exe
Token: SeIncreaseQuotaPrivilege	11488	WMIC.exe
Token: SeSecurityPrivilege	11488	WMIC.exe
Token: SeTakeOwnershipPrivilege	11488	WMIC.exe
Token: SeLoadDriverPrivilege	11488	WMIC.exe
Token: SeSystemProfilePrivilege	11488	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe
11608	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1932	4972	msedge.exe	87
PID 4972 wrote to memory of 1932	4972	msedge.exe	87
PID 4972 wrote to memory of 2248	4972	msedge.exe	89
PID 4972 wrote to memory of 2248	4972	msedge.exe	89
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 4748	4972	msedge.exe	91
PID 4972 wrote to memory of 4748	4972	msedge.exe	91
PID 4972 wrote to memory of 4536	4972	msedge.exe	92
PID 4972 wrote to memory of 4536	4972	msedge.exe	92
PID 4972 wrote to memory of 4544	4972	msedge.exe	93
PID 4972 wrote to memory of 4544	4972	msedge.exe	93
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 5052	4972	msedge.exe	90
PID 4972 wrote to memory of 4748	4972	msedge.exe	91
PID 4972 wrote to memory of 4748	4972	msedge.exe	91
PID 4972 wrote to memory of 4748	4972	msedge.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4672	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://anonfile.io/f/oRI-BPEN
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ff82507f208,0x7ff82507f214,0x7ff82507f220
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1920,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:3
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3804,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3104,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3096,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1952,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5016,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4988,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5340,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5916,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5932,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6532,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6532,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6300,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4440,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4444,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6852,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5468,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6060,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=860,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5804,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5816,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5304,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5184,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6292,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6088,i,12368307661037978107,17000290736993392025,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:7976

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5284

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2508

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Velocity\" -ad -an -ai#7zMap4521:78:7zEvent15645
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
- Executes dropped EXE
PID:7460
- C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
  "C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1636
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5280
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2648
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:1040
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4972"
    3⤵
    PID:7404
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4972
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:8344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1932"
    3⤵
    PID:9284
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1932
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:9368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2248"
    3⤵
    PID:9464
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2248
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:9556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5052"
    3⤵
    PID:9592
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5052
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:9644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4748"
    3⤵
    PID:9676
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4748
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:9724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4544"
    3⤵
    PID:9756
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4544
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:9812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1104"
    3⤵
    PID:9844
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1104
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:9892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4416"
    3⤵
    PID:9936
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4416
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:10024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2460"
    3⤵
    PID:10076
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2460
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:10144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:10376
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:10576
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:10592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:10384
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:10632
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:10652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:10400
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:10644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:10408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:10664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:10720
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:10896
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:11472
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious use of AdjustPrivilegeToken
      PID:11488
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:11524
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:11540
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:11556
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:11572
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:11592
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:11616
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:11660
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:11680
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:11696
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:11752
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:11780
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:11796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:11812
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:11876
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:11984
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:12008
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:12024
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:12040
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:12060
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:12072
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:12108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:10848
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:10952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:12160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:12208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:12248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:12300

C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
"C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
1⤵
- Executes dropped EXE
PID:5104
- C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe
  "C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6864

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:11608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2074210009\manifest.json

Filesize
176B

MD5
6607494855f7b5c0348eecd49ef7ce46

SHA1
2c844dd9ea648efec08776757bc376b5a6f9eb71

SHA256
37c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd

SHA512
8cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4972_2143162845\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4972_229489228\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4972_229489228\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4972_79079171\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping4972_79079171\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
df2d1721cd4e4eff7049314710dc7c11

SHA1
f5aed0158b2c0a00302f743841188881d811637a

SHA256
ba336ffd1b01965d7ab0e5fac5415e43cb594139c76b19e4c0d9b5b3b67c1e93

SHA512
11fd520176193f284563c7d050e6a7ab4e9895bac49fdc05759bab2c8a69f224858ccc784b351fc1d3ee5d39345430f9234623c9390978d7daf6a08ff5576ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
7KB

MD5
8238e576a0f6666e3acf8be6aeb7482e

SHA1
d5833233ac32e18eb631a9c69450ae7f27f63548

SHA256
658baa9ec6c71c05c6384734f1511bae175253345f651e399e34f2d56111ed3a

SHA512
20d0b9f35096d68db7d77ec06aca6c6b473c917cfdbe92f6ff8930dabd3c730abfc0b8967a10eb4e3e2744baf9242b5b20fe12a1f834135734ecb09fbc715ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
70ce085e8d5765765a73928bd4743a4c

SHA1
5d0ce5e818d633a92db88cf2c637edb73bd221ff

SHA256
fa8b07b596d99a655b6e30628d78a9016c15203f58e47c1b1a3ec8a74fd087e2

SHA512
21e21cea6a7b4ec1a398ebad4848b3829f844087223e4f5de8862df9477e542199952cbf2f192cc0f8e6b706d1508760f1bd9348156447b95c7b22aa73491ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d4c5.TMP

Filesize
3KB

MD5
d241c379be2f4d60a7a8e923303605f1

SHA1
dd487950d5cee5f5727180e1a54661a50baf7589

SHA256
e3e42b48a8132b7d6314e8c907e02047d58b696a4c6feb57cbddd7e2d7ad6f9d

SHA512
9b9b905f4fb2d67acb2f58305781cc3e8d805f8f3674c44d8a25539bd296a96de432d1896330fdc218eba2270ffaa11d20d30e54cabb6977b0ea9a32d99469d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f5c909d8236e6de5ca9546054a033a1c

SHA1
f6ad7e17b0f7c3d58dff7c434ac19bd0c67f2a12

SHA256
3b9a562b35ffd8bd2c4bed4ddb253bc832b98fc8c75a78f4d6ab4e31d2407c55

SHA512
5b31b42254167f86451c6c6940e427deebc7a1db4e983d4925d547b16d80d7769339dcd506513ad815a136d0ae89dcefbec2cf9b4a346f87cfccfaaef7fd20aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
48db7f80d2a4fd11bdb761d81122f8fc

SHA1
c171adaa7671c22366b96bb195144972f872e57c

SHA256
43edf7be4562b08c1aae3bbf5c08f0c269e36fd59a9728777b7a1590f9563e92

SHA512
035cccc16444ff09815cba4bb1dbceb8b00be4d19e90a01adde3e21f355dbefe79b27655b241273688549e4e2c37e24235ac1c30e34b5d11d86d3d14f10e39c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2d2b8c7290fd89cc79580b08624bbcd1

SHA1
c10e6425124c15b1e23e7b0b672321c0f0f00b7a

SHA256
f9ea2b2c105f1f8b50d87cb8f833b72f558a877994944e9c208c0379e246d125

SHA512
d45a419950182d589c246362885ce54aa2f57001591b19d3007268513e13bde325e29b8275c1f8f985752aa18ba5547cceaf91189f82d0ae84630abd49e3b79a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b1336fdc4ddd21c165fb3a8d97541eb7

SHA1
4148fd15ba66630c9c37c96519e8d682c243f75c

SHA256
a275f5421751326821852d0beae21a4a9020db3c0abd4b93d05404f9ebc8dd38

SHA512
b4aa777c1727c5b959776839d64eaeb1a3d4d1276cfd6752f8c03dcef31df3277a51968a4126a94acd141e03cbc70799598577120e88d7af40a921b8e1496ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
bb6d90734bc9f4824cb1aa2bed3a918b

SHA1
34af0dda6ce11793c274d58c06cccd58d789a8b6

SHA256
d3b08e546f6f209d44b4eb4428802c453982d932135990745ec47f919dba5968

SHA512
37d0093af86931dbcef97b616bb5ee4375f1ff406660467160b612188eb1c783ebf682b48d0f3578b77e2872fe5e479569248ab583c0f0bd3e992902333b32e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
e83cd44e3a7b6423d2b322f027ba3f9d

SHA1
95db1f827ea223a7ef04b0bdc22ba625be6c395d

SHA256
84aa86be16c6aa19f041c4c4352c7a0614fb74faede490c5d3f8b5a33c4c4acc

SHA512
2c04fd205f09819322dd326b1619fa8b21529f31d62057ef1f07a6062a389c94278eb6e750b0c1f1e37cc9b47fe0f29e7eea34ffb758026d87fd35037702d64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
dac0e0ff73c647f4d14834e75a6cf806

SHA1
a6b7a4f0df11602600880cc590f9113cb9cd1e93

SHA256
3f8c69c79d433689fdf054161f768d569967764e9c2658408829faa9792959ed

SHA512
d55ad48d937be5ae98b6a20886bbe779d85c7cc7efda01c4e95cb4bb66b226b042140e0035022f4f2cc0fea8e63a30c5c0887997cf4b00924f92314ca0ac1174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672850e0-716b-4785-b971-03b7429b7632\index-dir\the-real-index

Filesize
2KB

MD5
91bed6ac657d9460f883c4b85cd1aa6a

SHA1
63fe43c8c301f6580de797702da7528b1867b20c

SHA256
b1602e07d9cd31262e14d94aed2a9c065757ae1c1fd930eec9e584413ca9ba9c

SHA512
a6ec8551a7c5991a58a6713f0e5f763e194081dc711a0815a4cb600b697d668c4cc7764adcdeb69dd5cdf88844215ef4b3c13081a15b493481ab4e39ffd734bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\672850e0-716b-4785-b971-03b7429b7632\index-dir\the-real-index~RFe5c1ff3.TMP

Filesize
2KB

MD5
767d845d21a3d1dd8b149e02686c4bb9

SHA1
318b2d570b6ade8978c791fd98f99cd146fa9a3d

SHA256
e5318469926aa546eb4211d5880566d29b7efae736234a7519e50ae15202d6a1

SHA512
fdc1a18545fb43c12cf50f1a3aa95bd84a3cec78eff69f15d6fd205c89d0403adb18f56f55487b856e2c9622100211eea441dab4a696991c75e013ad2de2da39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
027b222889133877a7c432a82ca91f67

SHA1
ba864d2c0ddb2ee21d2b82c3329e2835a5535934

SHA256
6389941ac6c21ea93841703ce097094bf3ba87ef3333f73401fe4ea7de7daaf5

SHA512
2949c481ab4f5b1f9449ffdc6820949b98c1c206c9e0f08713adb99617277713100fce6e27a41171a317751063162e17b8f02b66c3f3ac7776897f25e6d00458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
898B

MD5
4b328ab2a24f7be1c9e3a0c637f62330

SHA1
92fb3540b280a5f6366e13d1ccbb7bf2bd2aaf80

SHA256
e2dbca98e1186638334cde08088d47b18dd950c5fcd7014f325d33b36e43a349

SHA512
624b73b132d8133939e4c901051e4328dea58bfcefeff12fa3074b393758f34e9d6047901a7bd6aba6f8544d7ec410c8b1e6ef6bca04e60ef670321ba2e76b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
c6a119c99d680a5d1fc52088dde1a7a5

SHA1
e75eeb67cb4da86173f73a257eb51a8a6028bde8

SHA256
b068d147825728119ac659f116ad10e6de6911839b2c588905dab6c92a2e63eb

SHA512
f5f107898e36106549cb29bbfbf608dc3a3281172b2c8cd1418c874a65efd1e9905b6bbab9238f626dfa341184626a7ec2fc03251d9e416c8245161916e2a4fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
4d5452b422209f6050f63e3d8ff9a252

SHA1
cfdc234d71e489174d2b9917e9d90fcd9408b0e6

SHA256
a9a9f8c96dc5c8afabc2c4f0cca7ef932942d73459a7b7a8b27d8b876d1a6afc

SHA512
7d21e5b96ed57401cc08db2eb4db207e52930f2a2808577079e83bfd6c5afc5d2184b93b894c1868b49c6e8405b345fd28510b5d516eaf1e04e8effacbe05ca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
54KB

MD5
257fa60790b2acbe2b9bed1e5ca72df8

SHA1
f854a434e2c724bb2f6b2df711a0e563a123349a

SHA256
5fa774d861f3aaea0585c10096b6750f077ae43c2cf69aad81d91e1bf1562e7d

SHA512
69798dbc9bd376b8cbdfc076fbc9d4fa5502cc58da91841a4a90012250ae2759fb9ede5b2de2f914167407f5950b9b671cedd69d38f5c447b18fa46fd73bfcb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
ff9c32df9e968d8cd87c4bbd64afd882

SHA1
a22faf985a4061ec8816d9d34d5052fb3c30a378

SHA256
03e68ea10ef369080ebb11fd83af893b08ac9c99a807809df747b0b944cbc14a

SHA512
57646e3eae7ce47ab79edfdb64f1f9c27a9dc1992f4efd1c12233be469a984941ed923d15a6864d12f7a1d213b4b38652a7a074f56a9817ae61ec733fb8b297a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
49cc7b42a9b4f52ac16a69e9636dd27a

SHA1
67defb2dd2e2f40c8fa8006f9f596061de43e067

SHA256
be52aedd69fdd067b480244d28ca689bef708c0f7c70ded9d5109256f326b18b

SHA512
e41a26eaeb6b3aa8a91aec32b79f12bad98389107b9e3b51998113d164092d3abb2bccd528eca7e976dea627e5d65e1d00167b6b4912f33ca6244682e5848067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
2d252603b304c771ae2a1cf10ff47688

SHA1
77cf853e73606186c26915dd34d8f4d361d87ccc

SHA256
3b85636d943087b88cb01dc048f45938c4710dafb427467fe87f0b337f25d651

SHA512
3c7caee00ce3a3bd4441a20e526f06d5c4b645fe98355bc938bb07876ae6bc517fc47d6e72146cebd7ec33b740dced597b071390bdeca0a86f0feb1dd309bbc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
53445c1f5ec0b3900447b5296f5ff492

SHA1
f5b8af8211d347e030a4556f0170604c208c95d6

SHA256
daaa56176473c0421a3b0334294f89403355f56bdb61584e2d4617a24a8a0f0e

SHA512
96a8aeb343f73a00eb0e9e190ec371ef48c8ca8e2dfb849a67d4c733f8be2a9a88023a1d47cc70c8b59852b0c3aa0fb10ac4ee7149c01644742aa49a85250573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
4cfdc55ff8b6893bb4ac4a160ef1b304

SHA1
a8a4004f171de31a7583550f71669e1748466075

SHA256
fbf98527fbc0c6545154e5048f0f0788ce1f87b480e36d8dc8ef4871eed6e464

SHA512
43cdffffcf529cacde523856200da1284d2021f168dc20a66dfbd297e9225cf32f0707e96d67842764fbfcabb9445c49b51f769729cb50964869e6231b492bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
66f74906afeb2692be3ce3386c542722

SHA1
9dcc283945f909057846bc2e138b5188f8cf472a

SHA256
e748fdf7de071a9209ff8e5dbdc3b76af3afa2e13dfd47556de7d3862be9bf9c

SHA512
1b7bfc584478a6896998b6cbe6fb150dd55ab2e1f05e3626b0bf4867b69a03164fd8bdcaff36bf118783be5d7398eaba0714da2e5fc613cdbf3b7c82459862e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
b1e3dab0c8777f6f284770b842b14511

SHA1
0c12346ca091138adcbf4b0098717ee2ef402824

SHA256
a0d4bea1cf8b3290aa25a812e7714e0b24309ba7bda81ddb5a2f7f1b654e36a7

SHA512
fcd8f95ce164a2a62db14b10387a48ccedb57f405abaa41baf9258f1c89e3f39f266f2b9164462008eb0fd7872b9a6c6447d9c0a80e584a7edb7f3004ed76696

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_asyncio.pyd

Filesize
34KB

MD5
1b8ce772a230a5da8cbdccd8914080a5

SHA1
40d4faf1308d1af6ef9f3856a4f743046fd0ead5

SHA256
fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f

SHA512
d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_bz2.pyd

Filesize
46KB

MD5
80c69a1d87f0c82d6c4268e5a8213b78

SHA1
bae059da91d48eaac4f1bb45ca6feee2c89a2c06

SHA256
307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87

SHA512
542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
0f0f1c4e1d043f212b00473a81c012a3

SHA1
ff9ff3c257dceefc74551e4e2bacde0faaef5aec

SHA256
fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b

SHA512
fcfa42f417e319bddf721f298587d1b26e6974e5d7589dfe6ddd2b013bc554a53db3725741fbc4941f34079ed8cb96f05934f3c2b933cda6a7e19cda315591a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_ctypes.pyd

Filesize
57KB

MD5
b4c41a4a46e1d08206c109ce547480c7

SHA1
9588387007a49ec2304160f27376aedca5bc854d

SHA256
9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9

SHA512
30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_decimal.pyd

Filesize
104KB

MD5
e9501519a447b13dcca19e09140c9e84

SHA1
472b1aa072454d065dfe415a05036ffd8804c181

SHA256
6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c

SHA512
ef481e0e4f9b277642652cd090634e1c04702df789e2267a87205e0fe12b00f1de6cdd4fafb51da01efa726606c0b57fcb2ea373533c772983fc4777dc0acc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_hashlib.pyd

Filesize
33KB

MD5
0629bdb5ff24ce5e88a2ddcede608aee

SHA1
47323370992b80dafb6f210b0d0229665b063afb

SHA256
f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8

SHA512
3faeff1a19893257c17571b89963af37534c189421585ea03dd6a3017d28803e9d08b0e4daceee01ffeda21da60e68d10083fe7dbdbbde313a6b489a40e70952

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_lzma.pyd

Filesize
84KB

MD5
bfca96ed7647b31dd2919bedebb856b8

SHA1
7d802d5788784f8b6bfbb8be491c1f06600737ac

SHA256
032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e

SHA512
3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_multiprocessing.pyd

Filesize
25KB

MD5
849b4203c5f9092db9022732d8247c97

SHA1
ed7bd0d6dcdcfa07f754b98acf44a7cfe5dcb353

SHA256
45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807

SHA512
cc618b4fc918b423e5dbdcbc45206653133df16bf2125fd53bafef8f7850d2403564cf80f8a5d4abb4a8928ff1262f80f23c633ea109a18556d1871aff81cd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_overlapped.pyd

Filesize
30KB

MD5
97a40f53a81c39469cc7c8dd00f51b5d

SHA1
6c3916fe42e7977d8a6b53bfbc5a579abcf22a83

SHA256
11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f

SHA512
02af654ab73b6c8bf15a81c0e9071c8faf064c529b1439a2ab476e1026c860cf7d01472945112d4583e5da8e4c57f1df2700331440be80066dbb6a7e89e1c5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_queue.pyd

Filesize
24KB

MD5
0614691624f99748ef1d971419bdb80d

SHA1
39c52450ed7e31e935b5b0e49d03330f2057747d

SHA256
ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d

SHA512
184bc172c7bb8a1fb55c4c23950cbe5e0b5a3c96c1c555ed8476edf79c5c729ed297112ee01b45d771e5c0055d2dc402b566967d1900b5abf683ee8e668c5b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_socket.pyd

Filesize
41KB

MD5
04e7eb0b6861495233247ac5bb33a89a

SHA1
c4d43474e0b378a00845cca044f68e224455612a

SHA256
7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383

SHA512
d4ea0484363edf284ac08a1c3356cc3112d410dd80fe5010c1777acf88dbd830e9f668b593e252033d657a3431a79f7b68d09eb071d0c2ceb51632dbe9b8ed97

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_sqlite3.pyd

Filesize
54KB

MD5
d9eeeeacc3a586cf2dbf6df366f6029e

SHA1
4ff9fb2842a13e9371ce7894ec4fe331b6af9219

SHA256
67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29

SHA512
0b9f1d80fb92c796682dba94a75fbce0e4fbeaedccd50e21d42d4b9366463a830109a8cd4300aa62b41910655f8ca96ecc609ea8a1b84236250b6fd08c965830

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_ssl.pyd

Filesize
60KB

MD5
fd0f4aed22736098dc146936cbf0ad1d

SHA1
e520def83b8efdbca9dd4b384a15880b036ee0cf

SHA256
50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892

SHA512
c8f3c04d87da19041f28e1d474c8eb052fe8c03ffd88f0681ef4a2ffe29755cfd5b9c100a1b1d2fdb233cb0f70e367af500cbd3cd4ce77475f441f2b2aa0ab8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\_uuid.pyd

Filesize
21KB

MD5
3377ae26c2987cfee095dff160f2c86c

SHA1
0ca6aa60618950e6d91a7dea530a65a1cdf16625

SHA256
9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b

SHA512
8e408b84e2130ff48b8004154d1bdf6a08109d0b40f9fafb6f55e9f215e418e05dca819f411c802792a9d9936a55d6b90460121583e5568579a0fda6935852ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\base_library.zip

Filesize
1.4MB

MD5
e7d6f0152abb8465705e5dbccaa35ae0

SHA1
79595cdb390e7e3f91fc2687c5c3de9c7666a3c5

SHA256
c5977a9aca6a2a7e6607fe4fac0fc4f7860bade5a0f90d15b3c51be74ea48b0d

SHA512
d6a33457a2b9735ff1abaf7b9c46e4bceeb9d81712af1ce71edefc4e155bb6f6fc4692fe9e4ca8a6b8649874fa10a974c1219c141ba13b3bf1ac22a8bb2ac7bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\libffi-8.dll

Filesize
24KB

MD5
decbba3add4c2246928ab385fb16a21e

SHA1
5f019eff11de3122ffa67a06d52d446a3448b75e

SHA256
4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d

SHA512
760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\pyexpat.pyd

Filesize
86KB

MD5
fe0e32bfe3764ed5321454e1a01c81ec

SHA1
7690690df0a73bdcc54f0f04b674fc8a9a8f45fb

SHA256
b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92

SHA512
d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\python3.dll

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\select.pyd

Filesize
24KB

MD5
c39459806c712b3b3242f8376218c1e1

SHA1
85d254fb6cc5d6ed20a04026bff1158c8fd0a530

SHA256
7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9

SHA512
b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\sqlite3.dll

Filesize
608KB

MD5
895f001ae969364432372329caf08b6a

SHA1
4567fc6672501648b277fe83e6b468a7a2155ddf

SHA256
f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7

SHA512
05b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI74602\unicodedata.pyd

Filesize
293KB

MD5
06a5e52caf03426218f0c08fc02cc6b8

SHA1
ae232c63620546716fbb97452d73948ebfd06b35

SHA256
118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a

SHA512
546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzxzeq4i.qon.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\css\crimson_editor-1.png

Filesize
76B

MD5
9bc83b60dee463f4182d57868baceb1b

SHA1
593326965a042d82d5fa7bf616322917f6900fb1

SHA256
1a020e872a95cde139d1be39a9c9a4905fdf67e9bd7fa53e72d6e83218cdabf6

SHA512
2bf484dbbffe37a3b01969c5de9e27fbb5ef3a5509cb9063eca15642169d86b5c61cf490432de789c099358fd4ae0b7bad54a3f0fc93ca5f6697fc6afb24e815

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\css\tomorrow_night-1.png

Filesize
75B

MD5
9513d0d1311abdd61f6de9088e9a2d75

SHA1
f63d92a8e7e7a2ec7bbd07a32681a764cf7f4bbc

SHA256
a69279bcce72286b42ab0f71b84fb94f58f0a933819f653042753e4cf115e7e4

SHA512
d4466d267f75a49595dc9f3f849f7b35c6ad11d95cab35ad6418a08becf2e307b7b1119ecf1bf76c780c1fe78c402e8bf11df00a4e1f9680b8ced5c82297c8f0

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min-noconflict\mode-csound_score.js

Filesize
7KB

MD5
42d49ff849c55ac60900222de04d77b7

SHA1
9666827190d978369349c1d170b07ce63e17952c

SHA256
2b6773da78bff166fee80419f60b5e448b922699cfee1a20facf4fada44c3cc7

SHA512
e2bde407a9d34bc5a87a0471f3a1d0f2d12603a9d1737282245755dc2ea432ba49241366bb48c818736d0c397fb39f4c8a7f06a455b0f4e50bcefcf2d6b1e1b5

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min-noconflict\mode-django.js

Filesize
60KB

MD5
ed144289d5ad392d11966860c48c67cf

SHA1
5081286b48660de6e3feb1b89ce950fbf67e6d59

SHA256
8605f1416156018f7598d530216bf969b5bdc1944e1983199cc15d72d07e22b9

SHA512
bdc6b67de853f8bcac16a396063b18ad18bac22bd74d5ec3546e231fce86e6b401f17677adae8c298e0095eea66aa5f96db90650ab7966573a2172981570926e

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min-noconflict\mode-ftl.js

Filesize
32KB

MD5
eb54ef6e809142904345efb5ca3b3e9f

SHA1
5136b90f693db13a6a4f9f56dbc35220340747e9

SHA256
18b4316c6ab0c22640a729ed984fb76f7019356c7ba04f2b79e5fca1b5d8f40c

SHA512
f4816177a5b3048007720fcfb42d10a6b42e5c8949d9bd564b4aa9d7b5a007640fa600c56f39aca43b3f094888344764ca3ddd898e93cd551c67af9c310957ec

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min-noconflict\mode-glsl.js

Filesize
13KB

MD5
c7dc2c244bcfc6a9da43612a930e3b0e

SHA1
32ab43578d38683987c8ac66bf3205c7b9cbbff8

SHA256
1541585f8c6723846e9a01d54c6a16d9e6f31db5e2164df982d8c87badca3520

SHA512
7732ebb54198f5a4821b1b31966aa45e7f7a261d97e4e567a8fc25c532c9bf95d164fffeb0072361f36b72b3c1bc471879bf4ec28889f92d78cbd5288537281f

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min-noconflict\worker-json.js

Filesize
23KB

MD5
4dbf2b40140398816efb310205ce9887

SHA1
21a5f9ddf052f2a372160bd8fd5e055b92c2228c

SHA256
fee35a0413b7a4fc9d44b30ed1f8ffbbde78e6226f3c3ab1b48b642b7dc7bd53

SHA512
b6a41c6ba5a4828e6116ff0bd90f70a6ced5f854168967ab86ba8d0f61581af4f4b24b8ed5c50d36d829d7c59b4b6251b4156798e931beb72092775581ea6804

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min-noconflict\worker-xml.js

Filesize
45KB

MD5
1028c8cbfbf27b3242f66ea35531eaa4

SHA1
70f8265f6789abc77b1019bc541e4c98202248a2

SHA256
32fd826ad410172b2823373844707fdc51fdc2799d0a787da396f5bf64dcbb0c

SHA512
0903ba64c53645d0522af100d2ed25d828c6fe5690e87c263c3b04613e162e01ff21d7b829fbf23d3cda81a21cbcd26995f354635b0a15b9f29b6b1c16d30169

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min\mode-csound_score.js

Filesize
7KB

MD5
f7cef2f9f7649b762153a72d2809c2e1

SHA1
10e463588bea7d6aa26cee991095701dbfe95dd5

SHA256
d025758adc6b84e08096c383a0c1066fe6b5c2964452e01b30473dc1d02c566f

SHA512
a881ac93e883f23bf28166a6244f613caac07295ee6df9cc889c89cd1cb970498f6ab02e5f24f9b1ceb65fdd3bacabf4f834f81b487bb56c6d7de9ab29854b58

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min\mode-django.js

Filesize
60KB

MD5
3a34e4eb86f5513708bf2a94f10c1e75

SHA1
1e8480d0bbab17c5dc144fb1426baaf9f288e44b

SHA256
453979480a565d2bc987385b92ee28a39f2d0f1d4e4ba228934296b5e65e5aad

SHA512
0dcbd79dd4dbc87208bf9d1728ccef7d796554b449acdef4e5e26f35ce5de27ef4516fb566357368d1c33c8e63711684fd33ccf7fa6f6a0fd8798fc4dce3a1f7

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min\mode-ftl.js

Filesize
32KB

MD5
4274ce56cbadca6dafdcf143fbaebdcb

SHA1
68ad7a1e4d3f4a669504b97bac7f4e294fbd60a6

SHA256
e66e62d7ff7dd4a22e3833cf4d06fa07adcd86723064fcbff9704eab2e215477

SHA512
6acea6ceec7fef5c8fa9f5477ac5ffdeadc9f4e438ba73cc7a9ad150fa2dada5b730b0d56397ef52fbb9e3bfac0c6497318da6ba92a2c270be121b3cf226792c

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min\mode-glsl.js

Filesize
13KB

MD5
9c1221db1662af597b8309dbc93b9164

SHA1
858c5d681961d447ec82f3cb1cbc24971a20031c

SHA256
4bda9d6e477df0deff63a41ca6c32ef8fffa4353dda28fbdb9d6a248053252ba

SHA512
154646ca713caf69db9e265a9a69fb0ccaeb9e620209b016ce7a0e34e21e994dc6e0e1d3e8f49b42f3abb5d8caca80a4f077ab717877685658f2a4f24ee27b54

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min\worker-json.js

Filesize
23KB

MD5
7a0290b60a913f93da54941c02bb6870

SHA1
a2f468f35dfcf8085ce3b3e2bdfcc6876f7aec36

SHA256
d356f92f38ab1a27c9bde38b56a15b02816fd4501074842dc3e590fa5e7650fe

SHA512
387d0626dd71761646405681a0a7c3f4326d4853e6c44177caa9c8a9173c05bcdcd652c95a4faa00d5576095e7881b86a05872a59473944b2023bc994880d84b

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-min\worker-xml.js

Filesize
45KB

MD5
5e4031661447a63bcd01d6e38e8b68e8

SHA1
c23fff513c5ddebd2ca94baa509d4a80376988f6

SHA256
51c4711efe6cd12d7f1c8d70bf48c8bd848b8e204996ec6277bfb4b799e7052b

SHA512
ba5eae65abdfcd7e2672e9c27afb8471d72396c65b985abe3a58c6a90e42175ff2023efb038e8ce077567de6c6c53e15dbf29071e3e5907b4b3895e7bf160ba7

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-noconflict\ext-emmet.js

Filesize
47KB

MD5
d04b75913eb7152475e4db038e643095

SHA1
395f55854e31262db8f07682303bf29de0a1e38b

SHA256
1eb90ffe09ba3babbc94b257ca9a1db1c3816d28be9a2a1a74ec74c1a46318e8

SHA512
6f95367aafe2a724f666326e29595dd17e0084a4835dbe5d17a4447be22e5e6706cea5e482dbf27336067831936e9f6feb5023428daf748bd6835145af5ac017

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-noconflict\ext-options.js

Filesize
25KB

MD5
fec3aac3927127c9a1f87afece26a030

SHA1
26d4ec1f6ab33b63fcb4c889a20668ea4e7a55ce

SHA256
5fb7a7e03aa498142c55bb3f048f5363ba7641f33aa860611a52adb4724dac97

SHA512
8aafc3d4ffc079bdf96b765d8ad2341dbb35969ecfe8ad6ce39e17b1f4c32a09231e242df36b1ee62aa3bfe78865abff7363ee08edf0a5a8f50541e669c7da21

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-noconflict\mode-csound_score.js

Filesize
14KB

MD5
be267e990e45f420b52971b942b6cd36

SHA1
1b70ed227c81f56c0dcaaaba498ce90924b7d6ee

SHA256
4fc512616eef8137763716f7525892b581addf5083cf81d442b9b9ac0693faed

SHA512
c85bb0161945a7b74e805082641adfb7c33b9b0b55cc7c694c234b404ae4af9970201d127bb9e3218af57058fc4f3546449c417bcf93eb4cb5de880b891e0ca7

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-noconflict\mode-django.js

Filesize
101KB

MD5
b111a00f8f22708140c6fdbc26963155

SHA1
d08861923e2c92c5792f7008aa064786e985bada

SHA256
6c0547987cb0584975542e8cc7743d3c0f54c610e3dea80d508ad087c12b2743

SHA512
446ff447ad313663bdbb83df5b13ae0187f017b4119df2a8d3c388271a9f34238a55ff4307069e96ae07c71321f92c9d15c71a37c15d5296393b153140bdf497

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-noconflict\mode-ftl.js

Filesize
50KB

MD5
2839e845bd0cf60f35f3a8ca90a5ee22

SHA1
442de4854ddfec1e463b7de930d7f8060aa9dd61

SHA256
867e010091132f3ae726724d3a5fa71473159ad7db58b95fe974da1d86d216fc

SHA512
70679ef84bf92040e5f664de8e1ea4aba21fb1cfd49b82d45f44c4fc0df52ed64b72fb44a76c1a7445fb51bbfbe14a4736477154960c6f2721af6db6ad479d64

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-noconflict\mode-glsl.js

Filesize
22KB

MD5
5a8b5a01cd9dadacb661063269f44c66

SHA1
dd19eacf393b6664164ef8f6b9d3e733977ca107

SHA256
1bd2d4f7c88f28ea8e8e801cd5b786308be1d015f86e85747b2676912206a415

SHA512
d9fcd80598d8943ceafef7d9f6c636928ca65b6744670b892eb91c3687ebbbc05a20cc6b4977d0e04a0a0d71206256f94f484249b8bcfbbc846cbc04a98b5133

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src-noconflict\mode-sh.js

Filesize
14KB

MD5
167a62ec377adafbeb4bbb1cef73250d

SHA1
d42adeb7c14124e5202a70444b6613139507c82c

SHA256
0a9afda3b62e7265a0b4b0865b55f6b31557c98cd86e4ee23539cd5eff01181f

SHA512
eec03ba981047bd3f2e7a0a04f0a9eef4c65cdbe735f7358b912a00b679b5110e8b9d69ff55a5e086837177febcfac84ccb062649bbfa34075848954aeadacb1

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src\mode-csound_score.js

Filesize
14KB

MD5
f1a2b95b65de10a9d9f3d393d2641e48

SHA1
c2cb02ac6a078668eaa9dea0118e528053c14247

SHA256
fa994ac0fa96acdb3a323dace3b59768f35fe114a4a48d94c386b727d41c1307

SHA512
d91841472efd8f74069e6d55da2ab89fc4d8a3604fc06ac2e0a10dfa205478c2defaa90ee70cd5c27a77c646b6ee2d79bf704b4f858e44f9b9eb425f38880968

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src\mode-django.js

Filesize
101KB

MD5
f35de187177b0165615f713868e14448

SHA1
918a10274d31f09a0fc96b1b5d0dd35d6c0f136a

SHA256
624dcb5438d0d5bf3c630e938da5f0bd2d8bd904fe4316afea82ce8b7f25d56d

SHA512
fec3ec6a120729367801800ed585971ece19c032ff03bad38074d2ff0f4310ea872a48dadd80c9d9be7fcde07fbacf8b67ccc4052dddabcb4f38a1398fbb84a5

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src\mode-ftl.js

Filesize
50KB

MD5
71451c50ed393d0071d352ddb2e56330

SHA1
cbfc8767bb4baceab37805257997c84f4264bbea

SHA256
2437cbce03f95681d4d31f50d2c5079ed35289bba9f13b1f62da20c73c3f06e2

SHA512
219f6d3deee708706ac4e8fdf4f7161a3cf4b6b719763680783e385d9525c0553fe4bba46157a5610e434c8fb40d88e46e54688705925710c4be782f80986fb4

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src\mode-glsl.js

Filesize
21KB

MD5
73f43575491756b6dc78ea515d926cae

SHA1
68361ce457969d88e095f52537d7da80e2aedc54

SHA256
c5e4973d257bb599c78beef87b367e96b2bfc16e09ca548827a813d87d51b987

SHA512
edd6cca4e40edce8d84c7d9592cb5ca964c4f5680cf54542b52c5af872724521a7e865fa03fb3758368055b996a9ff2ce38a272eb2a8dee80f158ee92bf07096

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Bin\ace-editor\src\mode-sh.js

Filesize
14KB

MD5
37f7cf0e0a639840d67e81e0a3d257dc

SHA1
4e59399b4b5dd9275ba58fc5c7640822af8891c2

SHA256
61f9a37f096997d0f8a4de024358c443943e8eecb2a8d023dba992212e3d1534

SHA512
f4940712bd359338eef2498b5658938a1e3cdbc967e1b17bdd13b6136e6661785abad4537daa2136274b8628cc622035e7447c0fa986f0db77f58f7d1ea56588

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\Velocity.exe

Filesize
11.0MB

MD5
449f80738c85bfc44b5bb23c43d46040

SHA1
6c912e058cb722285d60d50a99416e3cc7afbea2

SHA256
525928c5b67971a716839fda26a5c7fd0a9af780b29c52500c662df63a34288c

SHA512
38f202a3dd2e36f0eb8f40475e47f4ac9785154dfdb5555294c9073bc3412b2a642b30aa2eb0449e4b95acd8bf98c5e15e6dfaf25b03d01985d3ce7c61b32487

Download Submit
C:\Users\Admin\Downloads\Velocity\Velocity\assets\ace-editor\src-noconflict\worker-css.js

Filesize
306KB

MD5
219db9db1df39ce8cf197c72cb643801

SHA1
d32946e9818af21c6e9bd581526f428872e54681

SHA256
9bd84ad6e4df96148f97e4763dccdba3787f78d14cfb784366b3dc4b0dd72f54

SHA512
94ef0a82e9cb8b52d52b134474d50cf2a3308b58cc6680a203ddea7056b3ad4138712fcc41b3e9dac16b3cd3f6af296b4f25df365972084250437acd17aece04

Download Submit
memory/3552-5251-0x00007FF825170000-0x00007FF825189000-memory.dmp

Filesize
100KB

Download
memory/3552-5263-0x00007FF825560000-0x00007FF825575000-memory.dmp

Filesize
84KB

Download
memory/3552-5241-0x00007FF824C30000-0x00007FF824C5D000-memory.dmp

Filesize
180KB

Download
memory/3552-5242-0x00007FF82B190000-0x00007FF82B19D000-memory.dmp

Filesize
52KB

Download
memory/3552-5243-0x00007FF824AD0000-0x00007FF824AF3000-memory.dmp

Filesize
140KB

Download
memory/3552-5247-0x00007FF802F70000-0x00007FF803028000-memory.dmp

Filesize
736KB

Download
memory/3552-5244-0x00007FF803030000-0x00007FF8031A3000-memory.dmp

Filesize
1.4MB

Download
memory/3552-5246-0x00007FF8249B0000-0x00007FF8249DE000-memory.dmp

Filesize
184KB

Download
memory/3552-5245-0x00007FF8255D0000-0x00007FF8255E9000-memory.dmp

Filesize
100KB

Download
memory/3552-5204-0x00007FF801450000-0x00007FF801A38000-memory.dmp

Filesize
5.9MB

Download
memory/3552-5250-0x00007FF825400000-0x00007FF825412000-memory.dmp

Filesize
72KB

Download
memory/3552-5248-0x00007FF801DF0000-0x00007FF802165000-memory.dmp

Filesize
3.5MB

Download
memory/3552-5252-0x00007FF8250E0000-0x00007FF8250F4000-memory.dmp

Filesize
80KB

Download
memory/3552-5253-0x00007FF801330000-0x00007FF80144C000-memory.dmp

Filesize
1.1MB

Download
memory/3552-5254-0x00007FF81F980000-0x00007FF81F9A5000-memory.dmp

Filesize
148KB

Download
memory/3552-5255-0x00007FF824AB0000-0x00007FF824ACB000-memory.dmp

Filesize
108KB

Download
memory/3552-5267-0x00007FF801450000-0x00007FF801A38000-memory.dmp

Filesize
5.9MB

Download
memory/3552-5256-0x00007FF824810000-0x00007FF824828000-memory.dmp

Filesize
96KB

Download
memory/3552-5257-0x00007FF804FF0000-0x00007FF80503D000-memory.dmp

Filesize
308KB

Download
memory/3552-5214-0x00007FF82B3B0000-0x00007FF82B3BF000-memory.dmp

Filesize
60KB

Download
memory/3552-5213-0x00007FF827280000-0x00007FF8272A4000-memory.dmp

Filesize
144KB

Download
memory/3552-5258-0x00007FF816A10000-0x00007FF816A21000-memory.dmp

Filesize
68KB

Download
memory/3552-5259-0x00007FF802F30000-0x00007FF802F62000-memory.dmp

Filesize
200KB

Download
memory/3552-5249-0x00000205CFED0000-0x00000205D0245000-memory.dmp

Filesize
3.5MB

Download
memory/3552-5319-0x00007FF801450000-0x00007FF801A38000-memory.dmp

Filesize
5.9MB

Download
memory/3552-5320-0x00007FF827280000-0x00007FF8272A4000-memory.dmp

Filesize
144KB

Download
memory/3552-5341-0x00007FF802F30000-0x00007FF802F62000-memory.dmp

Filesize
200KB

Download
memory/3552-5330-0x00007FF801DF0000-0x00007FF802165000-memory.dmp

Filesize
3.5MB

Download
memory/3552-5332-0x00007FF825400000-0x00007FF825412000-memory.dmp

Filesize
72KB

Download
memory/3552-5344-0x00007FFFFF650000-0x00007FFFFFE4E000-memory.dmp

Filesize
8.0MB

Download
memory/3552-5329-0x00007FF802F70000-0x00007FF803028000-memory.dmp

Filesize
736KB

Download
memory/3552-5998-0x00007FF8255D0000-0x00007FF8255E9000-memory.dmp

Filesize
100KB

Download
memory/3552-5347-0x00007FF801450000-0x00007FF801A38000-memory.dmp

Filesize
5.9MB

Download
memory/3552-5331-0x00007FF825560000-0x00007FF825575000-memory.dmp

Filesize
84KB

Download
memory/3552-5999-0x00007FF827280000-0x00007FF8272A4000-memory.dmp

Filesize
144KB

Download
memory/3552-5911-0x00007FF82CC80000-0x00007FF82CC8D000-memory.dmp

Filesize
52KB

Download
memory/3552-5264-0x00007FF802910000-0x00007FF802947000-memory.dmp

Filesize
220KB

Download
memory/3552-5843-0x00007FF82CC80000-0x00007FF82CC8D000-memory.dmp

Filesize
52KB

Download
memory/3552-5260-0x00007FF827250000-0x00007FF82725A000-memory.dmp

Filesize
40KB

Download
memory/3552-5262-0x00007FFFFF650000-0x00007FFFFFE4E000-memory.dmp

Filesize
8.0MB

Download
memory/3552-5261-0x00007FF8169F0000-0x00007FF816A0E000-memory.dmp

Filesize
120KB

Download
memory/3552-5240-0x00007FF827260000-0x00007FF827279000-memory.dmp

Filesize
100KB

Download
memory/3552-5328-0x00007FF8249B0000-0x00007FF8249DE000-memory.dmp

Filesize
184KB

Download
memory/3552-5324-0x00007FF8255D0000-0x00007FF8255E9000-memory.dmp

Filesize
100KB

Download
memory/3552-5396-0x00000205CFED0000-0x00000205D0245000-memory.dmp

Filesize
3.5MB

Download
memory/3552-5326-0x00007FF824AD0000-0x00007FF824AF3000-memory.dmp

Filesize
140KB

Download
memory/3552-5327-0x00007FF803030000-0x00007FF8031A3000-memory.dmp

Filesize
1.4MB

Download
memory/6288-5430-0x00007FF825270000-0x00007FF82528B000-memory.dmp

Filesize
108KB

Download
memory/6288-5715-0x00007FF802880000-0x00007FF8028A3000-memory.dmp

Filesize
140KB

Download
memory/6288-5427-0x00007FFFFFED0000-0x00007FFFFFFEC000-memory.dmp

Filesize
1.1MB

Download
memory/6288-5426-0x00007FF800CF0000-0x00007FF800D04000-memory.dmp

Filesize
80KB

Download
memory/6288-5391-0x00007FF802850000-0x00007FF80287E000-memory.dmp

Filesize
184KB

Download
memory/6288-5382-0x00007FFFFD9E0000-0x00007FFFFDFC8000-memory.dmp

Filesize
5.9MB

Download
memory/6288-5389-0x00007FF802880000-0x00007FF8028A3000-memory.dmp

Filesize
140KB

Download
memory/6288-5377-0x00007FF804ED0000-0x00007FF804EE9000-memory.dmp

Filesize
100KB

Download
memory/6288-5376-0x00007FF805050000-0x00007FF80507D000-memory.dmp

Filesize
180KB

Download
memory/6288-5429-0x00007FF8258F0000-0x00007FF825915000-memory.dmp

Filesize
148KB

Download
memory/6288-5425-0x00007FF8011E0000-0x00007FF8011F9000-memory.dmp

Filesize
100KB

Download
memory/6288-5397-0x00007FF8012F0000-0x00007FF801302000-memory.dmp

Filesize
72KB

Download
memory/6288-5395-0x00007FF800100000-0x00007FF800475000-memory.dmp

Filesize
3.5MB

Download
memory/6288-5394-0x00007FF801C80000-0x00007FF801D38000-memory.dmp

Filesize
736KB

Download
memory/6288-5504-0x00007FFFFD9E0000-0x00007FFFFDFC8000-memory.dmp

Filesize
5.9MB

Download
memory/6288-5393-0x00007FF801C80000-0x00007FF801D38000-memory.dmp

Filesize
736KB

Download
memory/6288-5537-0x00007FF800480000-0x00007FF8005F3000-memory.dmp

Filesize
1.4MB

Download
memory/6288-5536-0x00007FF804ED0000-0x00007FF804EE9000-memory.dmp

Filesize
100KB

Download
memory/6288-5538-0x00007FF802850000-0x00007FF80287E000-memory.dmp

Filesize
184KB

Download
memory/6288-5540-0x00007FF800100000-0x00007FF800475000-memory.dmp

Filesize
3.5MB

Download
memory/6288-5539-0x00007FF801C80000-0x00007FF801D38000-memory.dmp

Filesize
736KB

Download
memory/6288-5579-0x00007FF800CD0000-0x00007FF800CE1000-memory.dmp

Filesize
68KB

Download
memory/6288-5577-0x00007FF825250000-0x00007FF825268000-memory.dmp

Filesize
96KB

Download
memory/6288-5581-0x00007FF825610000-0x00007FF82561A000-memory.dmp

Filesize
40KB

Download
memory/6288-5580-0x00007FF800960000-0x00007FF800992000-memory.dmp

Filesize
200KB

Download
memory/6288-5578-0x00007FF8009A0000-0x00007FF8009ED000-memory.dmp

Filesize
308KB

Download
memory/6288-5583-0x00007FFFFEE50000-0x00007FFFFF64E000-memory.dmp

Filesize
8.0MB

Download
memory/6288-5652-0x00007FF8258F0000-0x00007FF825915000-memory.dmp

Filesize
148KB

Download
memory/6288-5651-0x00007FF800900000-0x00007FF800937000-memory.dmp

Filesize
220KB

Download
memory/6288-5650-0x00007FF800940000-0x00007FF80095E000-memory.dmp

Filesize
120KB

Download
memory/6288-5381-0x00007FF8258D0000-0x00007FF8258E9000-memory.dmp

Filesize
100KB

Download
memory/6288-5380-0x00007FF800480000-0x00007FF8005F3000-memory.dmp

Filesize
1.4MB

Download
memory/6288-5680-0x00007FF825270000-0x00007FF82528B000-memory.dmp

Filesize
108KB

Download
memory/6288-5428-0x00007FF801310000-0x00007FF801325000-memory.dmp

Filesize
84KB

Download
memory/6288-5714-0x00007FF827240000-0x00007FF82724D000-memory.dmp

Filesize
52KB

Download
memory/6288-5713-0x00007FF804ED0000-0x00007FF804EE9000-memory.dmp

Filesize
100KB

Download
memory/6288-5712-0x00007FF805050000-0x00007FF80507D000-memory.dmp

Filesize
180KB

Download
memory/6288-5711-0x00007FF82CC80000-0x00007FF82CC8F000-memory.dmp

Filesize
60KB

Download
memory/6288-5710-0x00007FF801310000-0x00007FF801325000-memory.dmp

Filesize
84KB

Download
memory/6288-5709-0x00007FF8258D0000-0x00007FF8258E9000-memory.dmp

Filesize
100KB

Download
memory/6288-5767-0x00007FF801C80000-0x00007FF801D38000-memory.dmp

Filesize
736KB

Download
memory/6288-5770-0x00007FF800CD0000-0x00007FF800CE1000-memory.dmp

Filesize
68KB

Download
memory/6288-5772-0x00007FF825610000-0x00007FF82561A000-memory.dmp

Filesize
40KB

Download
memory/6288-5780-0x00007FF825270000-0x00007FF82528B000-memory.dmp

Filesize
108KB

Download
memory/6288-5781-0x00007FF800100000-0x00007FF800475000-memory.dmp

Filesize
3.5MB

Download
memory/6288-5779-0x00007FF8011E0000-0x00007FF8011F9000-memory.dmp

Filesize
100KB

Download
memory/6288-5778-0x00007FFFFFED0000-0x00007FFFFFFEC000-memory.dmp

Filesize
1.1MB

Download
memory/6288-5777-0x00007FF800CF0000-0x00007FF800D04000-memory.dmp

Filesize
80KB

Download
memory/6288-5776-0x00007FF8258F0000-0x00007FF825915000-memory.dmp

Filesize
148KB

Download
memory/6288-5775-0x00007FF8012F0000-0x00007FF801302000-memory.dmp

Filesize
72KB

Download
memory/6288-5774-0x00007FF800900000-0x00007FF800937000-memory.dmp

Filesize
220KB

Download
memory/6288-5773-0x00007FFFFEE50000-0x00007FFFFF64E000-memory.dmp

Filesize
8.0MB

Download
memory/6288-5771-0x00007FF800960000-0x00007FF800992000-memory.dmp

Filesize
200KB

Download
memory/6288-5769-0x00007FF8009A0000-0x00007FF8009ED000-memory.dmp

Filesize
308KB

Download
memory/6288-5768-0x00007FFFFD9E0000-0x00007FFFFDFC8000-memory.dmp

Filesize
5.9MB

Download
memory/6288-5766-0x00007FF825250000-0x00007FF825268000-memory.dmp

Filesize
96KB

Download
memory/6288-5765-0x00007FF800940000-0x00007FF80095E000-memory.dmp

Filesize
120KB

Download
memory/6288-5764-0x00007FF802850000-0x00007FF80287E000-memory.dmp

Filesize
184KB

Download
memory/6288-5727-0x00007FF800480000-0x00007FF8005F3000-memory.dmp

Filesize
1.4MB

Download
memory/6288-5708-0x00007FF805080000-0x00007FF8050A4000-memory.dmp

Filesize
144KB

Download
memory/6288-5378-0x00007FF827240000-0x00007FF82724D000-memory.dmp

Filesize
52KB

Download
memory/6288-5379-0x00007FF802880000-0x00007FF8028A3000-memory.dmp

Filesize
140KB

Download
memory/6288-5346-0x00007FFFFD9E0000-0x00007FFFFDFC8000-memory.dmp

Filesize
5.9MB

Download
memory/6288-5375-0x00007FF805080000-0x00007FF8050A4000-memory.dmp

Filesize
144KB

Download
memory/6288-5374-0x00007FF82CC80000-0x00007FF82CC8F000-memory.dmp

Filesize
60KB

Download
memory/10664-5854-0x000002B03E3F0000-0x000002B03E412000-memory.dmp

Filesize
136KB

Download