exelastealer | hxxps://github[.]com/quicaxd/Exela-V2[.]0

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
19	camo.githubusercontent.com
78	discord.com
16	camo.githubusercontent.com
18	camo.githubusercontent.com
13	camo.githubusercontent.com
13	discord.com
79	discord.com
81	discord.com
14	camo.githubusercontent.com
15	camo.githubusercontent.com
17	camo.githubusercontent.com
80	discord.com
82	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

pid	Process
964	ARP.EXE
4792	cmd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF	chrome.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

persistence privilege_escalation

Process Discovery

T1057

pid	Process
5468	tasklist.exe
1060	tasklist.exe
4620	tasklist.exe
5792	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4924	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF9E59BC01A920082F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{77410D41-B964-4F48-BD1F-DDD073DE11DD}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF34A3AF6259AE7FD6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE24F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5610.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF227FE3F507B4EF4B.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDAC0B8A76CE434E3.TMP	msiexec.exe
File created	C:\Windows\Installer\e5e448c.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8F32AE04A5B40A96.TMP	msiexec.exe
File created	C:\Windows\Installer\e5e44dc.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E31B07434F86E66.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4F4BA9EB452EB5DC.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8B7C3CBCC1B26FF9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF845A4011280DCF94.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5e4483.msi	msiexec.exe
File created	C:\Windows\Installer\e5e4491.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D8F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5e44c8.msi	msiexec.exe
File created	C:\Windows\Installer\e5e44e1.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0D8459AB-4636-4CD5-A41B-569D7CE159B8}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{63BD7E57-1243-473E-8490-719A49951D8E}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7B10AAA3-2BE3-4697-BFED-AB6FDBA103CD}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCFC5F8C7ECE47FB9.TMP	msiexec.exe
File created	C:\Windows\Installer\e5e44c9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF765E42373B4227BD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF040D9EF055E2EBCD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5e449c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE1B2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0FE9A1F231941E04.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4E3.tmp	msiexec.exe
File created	C:\Windows\Installer\e5e44bf.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA11CC387F6EE7BB5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5e44e2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE232E64DF98B844D.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5e4492.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA077F54DDE01F169.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3DB2CEE57D497EC9.TMP	msiexec.exe
File created	C:\Windows\Installer\e5e44d2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF46012E0804B88E88.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF374A4A8581B44199.TMP	msiexec.exe
File created	C:\Windows\Installer\e5e44d7.msi	msiexec.exe
File created	C:\Windows\Installer\e5e4483.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5e448d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA312F92E439797EA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF83487CE6BAAB290A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA26AD3B9BA5631C.TMP	msiexec.exe
File created	C:\Windows\Installer\e5e449c.msi	msiexec.exe
File created	C:\Windows\Installer\e5e44a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5e44b0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI48EF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFC5BD77483189B1E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8714440D1F7FEB70.TMP	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Installer\e5e4479.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3473E96806691575.TMP	msiexec.exe
File created	C:\Windows\Installer\e5e44b0.msi	msiexec.exe
File created	C:\Windows\Installer\e5e44d8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8AF0CFDB838BD020.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF76F06B2037AA995F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CB7E1801-9FB8-4763-A369-1D7F290AB24D}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3AF5783CA985D987.TMP	msiexec.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5768	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\python-3.11.0-amd64.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000400000002e614-37005.dat	pyinstaller
behavioral1/files/0x000400000002e615-37062.dat	pyinstaller
behavioral1/files/0x000700000002e615-37092.dat	pyinstaller

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x000100000002e5fc-36783.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.11.0-amd64.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
4224	cmd.exe
688	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

System Network Connections Discovery

T1049

pid	Process
2288	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004fbc8ede2bb95e8f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004fbc8ede0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004fbc8ede000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4fbc8ede000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004fbc8ede00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3384	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
3048	ipconfig.exe
2288	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
2688	systeminfo.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
1752	taskkill.exe
1120	taskkill.exe
5428	taskkill.exe
328	taskkill.exe
764	taskkill.exe
2856	taskkill.exe
816	taskkill.exe
2412	taskkill.exe
5892	taskkill.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674774049255693"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{BD29D023-6B95-47FE-B480-598840EB9A28}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\DefaultIcon\ = "\"C:\\Windows\\py.exe\",3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{6FA26412-5DFC-4262-944D-8103624989E4}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{6FBFD1F4-0412-4DBB-AA00-F71278CAB664}\DisplayName = "Python 3.11.0 Tcl/Tk Support (64-bit)"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit311\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CE0A86B13DD4431548E03758B480361F	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{63BD7E57-1243-473E-8490-719A49951D8E}\ = "{63BD7E57-1243-473E-8490-719A49951D8E}"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{7B10AAA3-2BE3-4697-BFED-AB6FDBA103CD}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Python.File\Shell\editwithidle\shell\edit311	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{D3773C88-43C6-46CD-AE5F-627FF6C6E5D4}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}\DisplayName = "Python 3.11.0 Test Suite (64-bit)"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{77410D41-B964-4F48-BD1F-DDD073DE11DD}\DisplayName = "Python 3.11.0 Test Suite (64-bit debug)"	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyw	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{BD29D023-6B95-47FE-B480-598840EB9A28}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{CB7E1801-9FB8-4763-A369-1D7F290AB24D}	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CAEE6E03194F2C47B2D67B1723CD5C7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{0E6EEAC9-4913-4C2F-B7D2-761B27C35D7C}v3.11.7966.0\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{6FA26412-5DFC-4262-944D-8103624989E4}\ = "{6FA26412-5DFC-4262-944D-8103624989E4}"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{6FA26412-5DFC-4262-944D-8103624989E4}\DisplayName = "Python 3.11.0 Core Interpreter (64-bit symbols)"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}\ = "{0D8459AB-4636-4CD5-A41B-569D7CE159B8}"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{A21FFC19-3CA0-4988-9AE8-93F7FDC5C223}\Dependents	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{60530AE6-E818-4774-846B-AD05305C6104}\Dependents	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{EF3414CD-2C55-436E-ACCA-E7FB0C8DC49E}\Dependents	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{2339AAC3-7F9E-4724-B38C-66C10C42C89A}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{6FA26412-5DFC-4262-944D-8103624989E4}	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CAEE6E03194F2C47B2D67B1723CD5C7\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{D4A2E83A-3BD5-4E0D-9577-7F8CA74B876B}\DisplayName = "Python 3.11.0 Test Suite (64-bit)"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer	python-3.11.0-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open\command\ = "\"C:\\Windows\\pyw.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\ = "Python File (no console)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}\DisplayName = "Python 3.11.0 Development Libraries (64-bit)"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{EF3414CD-2C55-436E-ACCA-E7FB0C8DC49E}	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{0D8459AB-4636-4CD5-A41B-569D7CE159B8}\Dependents\{7f8381ad-2e42-4432-8de5-c7beebe1009f}	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{1ED03561-12AC-4A6A-AA85-583281BF0121}\Version = "3.11.150.0"	python-3.11.0-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Installer\Dependencies\{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}\ = "{74A2D2BF-BD4F-4D82-812F-EDEB21EA443F}"	python-3.11.0-amd64.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\python-3.11.0-amd64.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Exela-V2.0-main.zip:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2840	chrome.exe
2840	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
1480	chrome.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
2668	msiexec.exe
4572	powershell.exe
4572	powershell.exe
3168	chrome.exe
3168	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe
896	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe
Token: SeShutdownPrivilege	2840	chrome.exe
Token: SeCreatePagefilePrivilege	2840	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2556	python-3.11.0-amd64.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2096	python-3.11.0-amd64.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
2840	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe
3168	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 4380	2840	chrome.exe	81
PID 2840 wrote to memory of 4380	2840	chrome.exe	81
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1124	2840	chrome.exe	82
PID 2840 wrote to memory of 1884	2840	chrome.exe	83
PID 2840 wrote to memory of 1884	2840	chrome.exe	83
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84
PID 2840 wrote to memory of 860	2840	chrome.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1480	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/quicaxd/Exela-V2.0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb5b3cc40,0x7ffbb5b3cc4c,0x7ffbb5b3cc58
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1940,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1808,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3056,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3088,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=740,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2704,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1416,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5216,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5252,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4080,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4284
- C:\Users\Admin\Downloads\python-3.11.0-amd64.exe
  "C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3052
- - C:\Windows\Temp\{69732803-E2BD-4F03-8BCE-0558D93B8CF5}\.cr\python-3.11.0-amd64.exe
    "C:\Windows\Temp\{69732803-E2BD-4F03-8BCE-0558D93B8CF5}\.cr\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.0-amd64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2556
  - - C:\Windows\Temp\{8D586114-C259-434A-961A-95994A4CC872}\.be\python-3.11.0-amd64.exe
      "C:\Windows\Temp\{8D586114-C259-434A-961A-95994A4CC872}\.be\python-3.11.0-amd64.exe" -q -burn.elevated BurnPipe.{678E42A9-9F86-4531-B761-206AA905A032} {EFC8A1C1-D559-44C1-887F-C2FF34C4A90D} 2556
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6056,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - NTFS ADS
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4848,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=6032,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3488,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5928,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6224,i,7114172827652185891,5259496382246992367,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1428 /prefetch:1
  2⤵
  PID:5088

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1308

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2732

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C588FB7C0E43EA642169B0B31C3AF650
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4548
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4296
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpzum9ye1p\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpzum9ye1p\\pip-22.3-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpzum9ye1p', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\install.bat" "
1⤵
PID:5288
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python --version
  2⤵
  PID:5480
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import cryptography"
  2⤵
  PID:5820
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install cryptography
  2⤵
  PID:5904
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import aiohttp"
  2⤵
  PID:6008
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install aiohttp
  2⤵
  PID:2024
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import PyInstaller"
  2⤵
  PID:3060
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install pyinstaller
  2⤵
  PID:5884
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python builder.py
  2⤵
  PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\install.bat" "
1⤵
PID:6104
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python --version
  2⤵
  PID:2976
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import cryptography"
  2⤵
  PID:3864
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install cryptography
  2⤵
  PID:6088
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import aiohttp"
  2⤵
  PID:2004
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install aiohttp
  2⤵
  PID:6060
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import PyInstaller"
  2⤵
  PID:4924
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install pyinstaller
  2⤵
  PID:464
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python builder.py
  2⤵
  PID:5356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\install.bat" "
1⤵
PID:4916
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python --version
  2⤵
  PID:1120
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import cryptography"
  2⤵
  PID:248
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install cryptography
  2⤵
  PID:4804
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import aiohttp"
  2⤵
  PID:4332
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install aiohttp
  2⤵
  PID:5312
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -c "import PyInstaller"
  2⤵
  PID:4832
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python -m pip install pyinstaller
  2⤵
  PID:3140
- C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
  python builder.py
  2⤵
  PID:2300

C:\Users\Admin\Downloads\python-3.11.0-amd64.exe
"C:\Users\Admin\Downloads\python-3.11.0-amd64.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1068
- C:\Windows\Temp\{ACAB0CF5-AE46-465F-A879-5EC51C54E273}\.cr\python-3.11.0-amd64.exe
  "C:\Windows\Temp\{ACAB0CF5-AE46-465F-A879-5EC51C54E273}\.cr\python-3.11.0-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.0-amd64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=724
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:2096
- - C:\Users\Admin\AppData\Local\Package Cache\B94FE66FE9D00703FE878D72EA5C07370EA5BF11\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\B94FE66FE9D00703FE878D72EA5C07370EA5BF11\py.exe" -3.11 -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib"
    3⤵
    - Executes dropped EXE
    PID:4932
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5136
- - C:\Users\Admin\AppData\Local\Package Cache\B94FE66FE9D00703FE878D72EA5C07370EA5BF11\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\B94FE66FE9D00703FE878D72EA5C07370EA5BF11\py.exe" -3.11 -O -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib"
    3⤵
    - Executes dropped EXE
    PID:4180
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -O -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5024
- - C:\Users\Admin\AppData\Local\Package Cache\B94FE66FE9D00703FE878D72EA5C07370EA5BF11\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\B94FE66FE9D00703FE878D72EA5C07370EA5BF11\py.exe" -3.11 -OO -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib"
    3⤵
    - Executes dropped EXE
    PID:5860
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -OO -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\install.bat" "
1⤵
PID:5680
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5256
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python -c "import cryptography"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6048
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python -m pip install cryptography
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5904
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python -c "import aiohttp"
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python -m pip install aiohttp
  2⤵
  - Executes dropped EXE
  PID:1368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1064
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python -c "import PyInstaller"
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python -m pip install pyinstaller
  2⤵
  - Executes dropped EXE
  PID:240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4548
- C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
  python builder.py
  2⤵
  - Executes dropped EXE
  PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c python "C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\Obfuscator\obf.py" "Stub.py" stub.py
    3⤵
    PID:4608
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      python "C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\Obfuscator\obf.py" "Stub.py" stub.py
      4⤵
      Executes dropped EXE
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c pyinstaller --onefile --noconsole --clean --noconfirm --upx-dir UPX --version-file AssemblyFile\version.txt --icon=NONE stub.py
    3⤵
    PID:2900
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pyinstaller.exe
      pyinstaller --onefile --noconsole --clean --noconfirm --upx-dir UPX --version-file AssemblyFile\version.txt --icon=NONE stub.py
      4⤵
      Executes dropped EXE
      PID:4672
    - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" "C:\Users\Admin\AppData\Local\Programs\Python\Python311\Scripts\pyinstaller.exe" --onefile --noconsole --clean --noconfirm --upx-dir UPX --version-file AssemblyFile\version.txt --icon=NONE stub.py
        5⤵
        Executes dropped EXE
        
        PID:5280
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:8
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:2488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 440 420
        6⤵
        Executes dropped EXE
        
        PID:2716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:556
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx -V
        6⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 644 432
        6⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:6060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 644 356
        6⤵
        Executes dropped EXE
        
        PID:896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:2940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 356 160
        6⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:1916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 160 348
        6⤵
        Executes dropped EXE
        
        PID:5252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:1432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 348 296
        6⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:4560
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:4604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:488
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 160 300
        6⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:5932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:1444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 300 640
        6⤵
        Executes dropped EXE
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 640 160
        6⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:6136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:4004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 160 644
        6⤵
        Executes dropped EXE
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 644 348
        6⤵
        Executes dropped EXE
        
        PID:5776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:1928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:3412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 348 304
        6⤵
        Executes dropped EXE
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
        
        C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe C:\Users\Admin\AppData\Local\Programs\Python\Python311\Lib\site-packages\PyInstaller\isolated\_child.py 304 620
        6⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:1712
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\python311.dll
        6⤵
        
        PID:4620
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\select.pyd
        6⤵
        
        PID:5628
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\pyexpat.pyd
        6⤵
        
        PID:5160
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_lzma.pyd
        6⤵
        
        PID:2476
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_bz2.pyd
        6⤵
        
        PID:1904
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_ssl.pyd
        6⤵
        
        PID:5924
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_hashlib.pyd
        6⤵
        
        PID:4728
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\unicodedata.pyd
        6⤵
        
        PID:5960
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_decimal.pyd
        6⤵
        
        PID:6128
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_multiprocessing.pyd
        6⤵
        
        PID:4288
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_socket.pyd
        6⤵
        
        PID:5600
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_queue.pyd
        6⤵
        
        PID:3628
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_cffi_backend.cp311-win_amd64.pyd
        6⤵
        
        PID:1960
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\cryptography\hazmat\bindings\_rust.pyd
        6⤵
        
        PID:1256
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\yarl\_quoting_c.cp311-win_amd64.pyd
        6⤵
        
        PID:5116
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\multidict\_multidict.cp311-win_amd64.pyd
        6⤵
        
        PID:6012
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_asyncio.pyd
        6⤵
        
        PID:2776
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\aiohttp\_http_writer.cp311-win_amd64.pyd
        6⤵
        
        PID:5884
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\aiohttp\_http_parser.cp311-win_amd64.pyd
        6⤵
        
        PID:3368
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\frozenlist\_frozenlist.cp311-win_amd64.pyd
        6⤵
        
        PID:5192
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\aiohttp\_helpers.cp311-win_amd64.pyd
        6⤵
        
        PID:2320
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\aiohttp\_websocket.cp311-win_amd64.pyd
        6⤵
        
        PID:6080
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_uuid.pyd
        6⤵
        
        PID:5540
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_overlapped.pyd
        6⤵
        
        PID:5548
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_sqlite3.pyd
        6⤵
        
        PID:5320
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\_ctypes.pyd
        6⤵
        
        PID:2596
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\libcrypto-1_1.dll
        6⤵
        
        PID:556
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\libssl-1_1.dll
        6⤵
        
        PID:1752
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\python3.dll
        6⤵
        
        PID:2940
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\sqlite3.dll
        6⤵
        
        PID:828
      - C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\UPX\upx.exe
        
        UPX\upx --compress-icons=0 --lzma -q --strip-loadconf C:\Users\Admin\AppData\Local\pyinstaller\bincache01py31164bit\libffi-8.dll
        6⤵
        
        PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c start .
    3⤵
    - Modifies registry class
    PID:3568

C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\Exela.exe
"C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\Exela.exe"
1⤵
- Executes dropped EXE
PID:2684
- C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\Exela.exe
  "C:\Users\Admin\Downloads\Exela-V2.0-main\Exela-V2.0-main\Exela.exe"
  2⤵
  - Executes dropped EXE
  PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4180
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:568
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4924
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:1220
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1688
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2840"
    3⤵
    PID:6016
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2840
      4⤵
      Kills process with taskkill
      PID:5428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4380"
    3⤵
    PID:1136
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4380
      4⤵
      Kills process with taskkill
      PID:328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1124"
    3⤵
    PID:4032
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1124
      4⤵
      Kills process with taskkill
      PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1884"
    3⤵
    PID:4992
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1884
      4⤵
      Kills process with taskkill
      PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 860"
    3⤵
    PID:720
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 860
      4⤵
      Kills process with taskkill
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1000"
    3⤵
    PID:1564
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1000
      4⤵
      Kills process with taskkill
      PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4312"
    3⤵
    PID:2988
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4312
      4⤵
      Kills process with taskkill
      PID:764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6116"
    3⤵
    PID:5988
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6116
      4⤵
      Kills process with taskkill
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5088"
    3⤵
    PID:2124
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5088
      4⤵
      Kills process with taskkill
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:5484
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:6068
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2424
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5532
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:780
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4792
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2688
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4336
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:3384
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:4288
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3188
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:3208
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:6028
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:4376
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:1496
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:2008
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:5788
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:2336
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:4844
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:1940
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:3348
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:3996
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5792
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3048
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:5152
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:964
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:2288
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:5768
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1200
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4224
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:200
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3304
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb5b3cc40,0x7ffbb5b3cc4c,0x7ffbb5b3cc58
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2012 /prefetch:3
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1848,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2228 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3808,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4788,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4828,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3756,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4472,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3256,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3336,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4476,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4388,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5180,i,9658025198903145088,9969896337557499990,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:896

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E4
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

System Information Discovery