exelastealer | 4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974

Analysis

max time kernel
292s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

byfron-01a570a3cd0a46f2.zip
Size

23.6MB
MD5

f37e9fe25f88bee86e868c8796ba7624
SHA1

b8b0f2969f70ac8656ca082cb4206fd1eb83ee9e
SHA256

4932535e1109fad42425fc977e09c9743b5aa904a7161b8600b4a989532d3974
SHA512

6b0238be58859276c1f3ad99e5b38642b0c5d92b4b86f6010c10590c568b5bc0b0559a8524993e587844d8f3652dbfdbf841039cc2f781905250b5d65acab5fe
SSDEEP

393216:MZwPobA50pfTb7dQyftimFEH9ALcVxq1+TtIiFg0VQxh6uUlI6uUlT:MZwPoXpfP7Gmtim62aq1QtI6yCICT

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation stealer

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4132	netsh.exe
2240	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1812	powershell.exe
2424	cmd.exe

Deletes itself 1 IoCs

pid	Process
4228	CelestialLLC.exe

Loads dropped DLL 31 IoCs

pid	Process
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe
4228	CelestialLLC.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
310	discord.com
311	discord.com
312	discord.com
313	discord.com
314	discord.com
315	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
307	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4608	cmd.exe
4140	ARP.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	chrome.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5048	tasklist.exe
1284	tasklist.exe
5000	tasklist.exe
3800	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2504	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1524	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4420	cmd.exe
4844	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3464	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
1960	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2420	ipconfig.exe
3464	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4788	systeminfo.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3952	taskkill.exe
4816	taskkill.exe
4160	taskkill.exe
4068	taskkill.exe
3420	taskkill.exe
2660	taskkill.exe
3892	taskkill.exe
2660	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133680669923821473"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3744	chrome.exe
3744	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1908	chrome.exe
1812	powershell.exe
1812	powershell.exe
1812	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe
Token: SeShutdownPrivilege	3744	chrome.exe
Token: SeCreatePagefilePrivilege	3744	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
4228	CelestialLLC.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe
3744	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 4608	3744	chrome.exe	97
PID 3744 wrote to memory of 4608	3744	chrome.exe	97
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 1948	3744	chrome.exe	98
PID 3744 wrote to memory of 2628	3744	chrome.exe	99
PID 3744 wrote to memory of 2628	3744	chrome.exe	99
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100
PID 3744 wrote to memory of 4520	3744	chrome.exe	100

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4816	attrib.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\byfron-01a570a3cd0a46f2.zip
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaa777cc40,0x7ffaa777cc4c,0x7ffaa777cc58
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2080,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1804,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4556,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4876,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5088,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5112,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4916,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5172,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3340,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4344,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=240,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5268,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3416,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5584,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5600,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5296,i,13688238119283263320,11044673782664526297,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1908

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2072

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x474
1⤵
PID:4212

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4036

C:\Users\Admin\Downloads\byfron-01a570a3cd0a46f2\byfron-01a570a3cd0a46f2\CelestialLLC.exe
"C:\Users\Admin\Downloads\byfron-01a570a3cd0a46f2\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1336
- C:\Users\Admin\Downloads\byfron-01a570a3cd0a46f2\byfron-01a570a3cd0a46f2\CelestialLLC.exe
  "C:\Users\Admin\Downloads\byfron-01a570a3cd0a46f2\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:4228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3744"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 3744
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4608"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 4608
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1948"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1948
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2628"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:388
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 2628
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4160
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4520"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4488
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 4520
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4320"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 4320
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3968"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 3968
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4928"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 4928
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:3892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3660
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:2068
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp
        5⤵
        
        PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - System Location Discovery: System Language Discovery
    PID:2424
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:4608
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4788
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      System Location Discovery: System Language Discovery
      PID:3840
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      System Location Discovery: System Language Discovery
      Collects information from the system
      PID:1960
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
  - - C:\Windows\SysWOW64\net.exe
      net localgroup
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      System Location Discovery: System Language Discovery
      PID:3260
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
  - - C:\Windows\SysWOW64\net.exe
      net user guest
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3892
  - - C:\Windows\SysWOW64\net.exe
      net user administrator
      4⤵
      System Location Discovery: System Language Discovery
      PID:4124
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:432
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:5048
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2420
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route print
      4⤵
      System Location Discovery: System Language Discovery
      PID:2296
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:4140
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      PID:3464
  - - C:\Windows\SysWOW64\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1524
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4132
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4420
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:968
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ef7ddb582cd6d67098c681059c467949

SHA1
6424106aa7232f20edf381e15270debc2c636438

SHA256
c5d0a136ebb5b17b37c272e9be9767a80cedebfda39117d08a927ef51d726db4

SHA512
6b17c4bfb6f5e3b137c8c938b792b4c64121f10076fe0f113d150b78c5914946b7baf2e295ca44b57621b176e7f6086c07d020f32d633aaa9be41a5c29d69a13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
807aef12061e7b1189ee8d167db8a86e

SHA1
8759552986fcafff193b1f85b252a70b6954e76a

SHA256
3fbe00cc47986d3ccd4a4c7c9960068192c25dc7902eb71c99284cab75ebfb14

SHA512
f572193423ac7028dd700929ca113b17920fb4433d82c5bd7c59a7a155294fadc89d562d0c997d614eb35c2aeceb47e75051d2477c2eed7b20c904f6bd1a72f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
de326fbedad4685b00c6f0112e3fa657

SHA1
7bc262293f3b59a0b970e2b9c5b64f29a53ba273

SHA256
d005a7a6bbe17e9bb84451d706f0a6c358ed86595c292ebb95e40ab4779b8daa

SHA512
f095be1ad46494cbc8e84b43d586c70779c92d2b164522b293481f6f430c48a19bff9532069a8cdde5f8af45c7d91a5820954a5cb530a0cd674efa88e1ecf21c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
faa609983281ed88d4d04b07e28e4603

SHA1
be745a9bb90d24bfa35184fe558e122b14e67e5a

SHA256
a3697ca431155088d08e759b59a10abc88c1568a80a015ebf4a4ece79352b47a

SHA512
deb4041fc57494ab6f8efc7274a13de01da159a36f4280193beebe6b59f677f8e08fdaafd7a58e576028483d7fbfd418dba22921b3ef57ab598c8f54beebea7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
689B

MD5
a712bf9afc36c994e195d177afacea1c

SHA1
8221fe007ce0d19a79772d1ea4d4c7f99330129c

SHA256
9f3f204048a2e8dceb2d6e22c514afd1e8b43e61a5989e17d19380424886746d

SHA512
a530747100dd46abcb688a0053f9afbd1434b34c6e8cd71568555e6cc6cd768c571d396a5fb767617fb1b94310e84bf814988bb6112c52ce7b75dced3138354b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
737624327624e9284b1c0353d4a1803a

SHA1
55e14ee805c1c000b9202c9555d6d28263f07d0e

SHA256
6432e0f2ec4788ce17a011ed4ac19c8b5142f680611a054e11b35eb4c641c1f6

SHA512
4bfa251ae462edbf65e94869743719f4bc3d4ece33fcb171b624e765930457f00e3b791562240d9a96d7bda94294c1e7cbf2fb91b72e30f72fbd5c73b5aeb5f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
bdda139835cb864c7ccc75be0be400b0

SHA1
969ca448bbd88df68a2eb7a5ed40f633193a2ab0

SHA256
2405d1e48e0472a284ef3039f19abebf728ac1fd5d3b752d228a6048b1e72d58

SHA512
3ebcf5454b136859160492b866b981b48ed252eb081251e7015e36ae5372818c7f5d6bcec29a39357e567b7e90f0643b7147f0c3e078218eddaf6538cc1aaab1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8e3d60adf13dd045d9869b918caf61d8

SHA1
9fcc5791434d51c150b01f19a3cd7864048fc1ae

SHA256
982c2a1800072f89c25dbb4c6e64744e53cd977bd902a207e4889c078223d4e1

SHA512
6fb05367988088fb9884b55e9878aeebc285ed5598cbe66c05a0bdbe5d685180b29a5de12a439953c2418e527282931bf914126231ebb5273f32ef105f68a5f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1c72028719a7cd337783098d045069a8

SHA1
86e2eb8ea75abb01f213dfbddbe57420dd8d5158

SHA256
e2263b57bb559c702d3667665940ac410f1b851b715455ad8a08ef9e9f9ad220

SHA512
8bacb745e1c53d22171e0bdbb2924e393ed029ebe8c858141a4b59d1626a194aa4685190e32cd43c6f2156f28c455eeb77c60e9faec9682e67c503b30309aefb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
012e7cb79e5478d599c3070a00e9c3be

SHA1
b9b63f8ca63745ade57fa41c2ca3208b9caff9a8

SHA256
0fc11a777e44f23ae5a40811a613365aa41cbe4d383b5a6f5e563ba1f189048b

SHA512
af4be576713ef8e590250ee74668818917f8de9793d2e318de471c86b15b934ee5880d0ba6e6206281360a6256c09000e77037fcbb59d9567f54ed534550acad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fc6af97567302c77f55431e02e220c54

SHA1
5347256a9ebd900ae0d76b64231eab3ad2b1b2f0

SHA256
2e8018edd1d0a51546b0fe7945133646a976555a04c1ae3c644399a525490ad2

SHA512
231a9dc1e4e79471db40663bd413881009712f0271a518625c81dcd88ecde25dbf13fd2a828eaf8ff786b00fcb7348685fc7b24de43b5b5788cb4420af64f4f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f48a2a64c4a43a93a0cffd098d6a65e4

SHA1
17dbc9f5a9a7c187f98ea1cdcbad4d379c9ab074

SHA256
dccac5c9f23d5c8392f824eb9d6e9c6f2d3999eecb383db6366c5d1351496659

SHA512
2cf45fab7629a714ef86738a9a26f202e5a1680fd994dece3a682b515cc25da49b30e92c49b0d1cdc97aca4d6677191a367bfd09786bc2d4fc736133a463ea69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a3c6bcb15359767ab6ee9c62d16c7a3e

SHA1
f0f38845ddb5f7e12325350781dba2d7f27ba851

SHA256
172bbd39c2a661500ae9aaa05513ccfcd9addaf49481b83638d3921724ab2118

SHA512
6dceccc128fd1a1e90c465dc4a62636a084ece94d53b191dfeb16ea8b687c57ed7fbfdce418c3dd6c571fd97a5c892e3908f90de7720555b86806a78054ae9dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0be5eb1a35620e35d9ac045b576b2731

SHA1
fc4dc021ef8964c168c4a165d6c479baa8a3b601

SHA256
797e9b751f801f348ba7c9c5de8924c35b9e60f23b339f14cb2f25771f4390ba

SHA512
0abcc0108b1c73361497822851d1e7d8e8058ec49758fd90b440f43c3e9d0296e1bf38874f0f164b7b754ca8f4944f2914bc9de13aab7c74254e045aea8d4533

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
931dc62d44d995e7af094b2848efad8d

SHA1
dfb61f19a95449e7ba8ba2add501a84e2d774d79

SHA256
d0b52d303834403ef1eb69d68bdd915d2fe0037577f2021e017289f4a64f6fc2

SHA512
83a2120dda3251cc04dd8c8a3e0a436ce22e28505e50286c68a2bba1582216dd97d57bf2cfd960a53a4718cf633068eabc6cdc85f43f241e020a83066e106cf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
e62b0a90051fd1260e33fcf0d6a88d08

SHA1
9e8957fe5d08c5abcd4d1273a311b60044adebd9

SHA256
06fdd5ad617efdb542987edf2450b0c10a98f347b58e678a53748203ccf66085

SHA512
c44ea7c1e7a100dc504e6854345b7d81c5cd62bf7fe574468c3189873f7dcee369a79c7db8db9ebb161529558fd01052e27f6388bb2d3b1b128c4dcea58ee208

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
158105fbf41bb1093fcaa2e6e1270e87

SHA1
e4dc0a8b1d2f2ce024363ef49b8a9957f0d2bdd1

SHA256
5a6680082ad6de9345943bb8bc40375c3ff3a39b30cfe3e312226b94e4f8d842

SHA512
eea6f5ee177f8e8708904841fa86016c33eca9f9503a6667ce9cdd8bbf4c9ccb5b885eed8287335291f5c569e8f404a6455858d35decdbde0d42fd804eb83065

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
194KB

MD5
e60ae73b8919e663cf43856e643edaa4

SHA1
8d81f6ab29f941485fb45ad312b30db622904eb7

SHA256
cbc75f1cb15e7e7175d5787cba5d24578e5c3d06226f560145fb8cd2010cc3e6

SHA512
996baf7c8c40ec18452ee83777c04cd343bfa229fec7f0906ca4eb6357890eb3455b37888421889952fe03b02f5497d938f66950aaa5e2c08773808451f27c13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
194KB

MD5
5abac59ac17815553a6e5a292aaeb807

SHA1
5d34ece9abf72c6dd7e2aa57779f2c9011e83e7d

SHA256
b301689a3131f1591dcc3654f293c481887b902c2843ed52061e4178a1272897

SHA512
dce7492a6d663e66e2935302e51d654368058a2dc6bbc6a18022ed23e8f09eca7840c5ad0f8cbde686c4d9e662d49fe2872a670804ba17708a6061ba72f59b3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\VCRUNTIME140.dll

Filesize
74KB

MD5
31ce620cb32ac950d31e019e67efc638

SHA1
eaf02a203bc11d593a1adb74c246f7a613e8ef09

SHA256
1e0f8f7f13502f5cee17232e9bebca7b44dd6ec29f1842bb61033044c65b2bbf

SHA512
603e8dceda4cb5b3317020e71f1951d01ace045468eaf118b422f4f44b8b6b2794f5002ea2e3fe9107c222e4cb55b932ed0d897a1871976d75f8ee10d5d12374

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_asyncio.pyd

Filesize
50KB

MD5
72cded1f02ea183c67cac4d2dd129417

SHA1
5d221cb76ac4f7cc85f5da4271ca8607619d3170

SHA256
d584831be60125e44bc57704164897880ee0770e44ecc9df6b7f0a68a17d4986

SHA512
1a35505e0a1d2c8f1b529bd447f51a1148c14e56ca70b901a75c0e3f449787267460f5819573ff1b84a8729720ee1abdfa5c9daff3a586b99d9af4b85868803c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_bz2.pyd

Filesize
66KB

MD5
216f736db1b110548da2f8f21c381412

SHA1
da3781dfe8f6b3bdacc92f82c330cc26248b6b5d

SHA256
ce4f48bdc1f6144b4bcb288896392867176a2b5f10efbfbc2d5454e14cde61ce

SHA512
3bea7426995833f37996468ca3d122c4c182cfcde6f6469d51c211624baa169daacd20101abb1ce8ba50b46fd9f25d1bf1f5e913ebfbea600a5d7ad557f33544

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_cffi_backend.cp310-win32.pyd

Filesize
152KB

MD5
84e1f73a3e4e6d4b6afd8d9ef10b1924

SHA1
5bd989147215f91d0fd2a17c23d02bbf9fac89bf

SHA256
ff874a41dc5d656bc24e48d5193345c09281ebfb7ef7724ef760fc9b1ff37439

SHA512
57c66bb7af04512bde04aa82f75087d2b7f5a82b67b59e860daa4a660e046891cbe62309b05305d725f71c30debfd2829068485164bc46f106355dd79bf5cdcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_ctypes.pyd

Filesize
100KB

MD5
30e16eeedd78a40498b600312d18161f

SHA1
c00f657b13e0b0ab5739abf2ee7b627238cd8055

SHA256
92ccf5b99a1f4553001e57fd58bbf8d843b6d6907057e31d236f913f0c51ab82

SHA512
76e213afcec7c06d7fe53b674b983773da8e1d32690bf8ba4ad0aa585e7517f36e7a287d9abb108a438c8937fd0c909ed6ce69658556563648cd581f12536707

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_decimal.pyd

Filesize
186KB

MD5
64075bc3bb3d8ecfb34938f24ae4077e

SHA1
9427093b25c208f7fe2d993543bf94cf25620023

SHA256
0c12e6598ce23e43fc00d34a86c6be6b49eedc33b676c5596483491a215bc670

SHA512
2fb3338a40364d390a14f0b32396378448b2c7f5a688423a98eae44d2a99ade505012949abc406a54f7b1094ca92f7dc2f5c930c81c2ed45076712edf74cb059

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_hashlib.pyd

Filesize
43KB

MD5
f9f0589c4d853060b62b1e83b3c6e8f8

SHA1
11d474d1a0006c0f8746187ed575d2923fdf3b01

SHA256
600ff18011b09cf9d49660dd7f58601ef438a921c1732054fdc5f312425c55e1

SHA512
ee3ef23cf79cd3782a84214548db2bb394e256db5f7e60d00ef6d62fad191d4654b889588ebd0da8cfbee0154ff3df362f2b1a76370e437edfcb398ba7982c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_lzma.pyd

Filesize
139KB

MD5
4a42b4f058c2e58eb3ab47e0166259cc

SHA1
4a55098dbffd59c651b862c2e610961b20f3b9da

SHA256
adddfd498ed73729af21bc139c421411aa40fa9000da1054c1ed73be6b2c8f56

SHA512
dd68e0a20a58c127a91406e7dfbb20f473635974fec15de0e678101241272c70ea7335e3e0cf990bef200d29f73adc519701989992ab55b53894c6d3133df52e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_multiprocessing.pyd

Filesize
24KB

MD5
80838bbcd5353878f3b29903e5821e99

SHA1
35f72a488bf1556f0c09a3788f4df757e063239f

SHA256
bc0c3972fa6ee51f8cad78bb1d9e71b7455a027eeb30b6d3e05bf00eef6752d7

SHA512
74a7abefcaa59d71bae4f70351f6a57d7d0cb2f5745f2f86b983bdfd3b56e4ea474407ec78db434b1494c5a018feb7e56fcf0fbb44b07524cf6898eb881521e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_overlapped.pyd

Filesize
36KB

MD5
4a1ac99a32112238eac9720b209d1b0e

SHA1
45ebcd122524e9f25671b66e988e0d33f3f0af8b

SHA256
c999ef86af630c7bfbcd924b1a19010103c2db19b4dd38df844756b6094f1fd7

SHA512
f311173ba7865c3f0629f74767a277b03cf6f029e0acab4f01c5d1820610485dee447a9b7afbffd93ffa77bc36ad8534c160b6c49444bfa743ba5b49f06e9659

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_queue.pyd

Filesize
23KB

MD5
d105039da54edcabd7b893068c86d1ce

SHA1
3ce7b89011ac1311243e1935eeb3a8e49ec8bed8

SHA256
214739fe1823ffd6c1d81be15c675743d08b69f73ad2699ff9d193589d8d47f7

SHA512
dfcb68e285957ec3f54d7205a59f295eadc495b1d6119591fd850e8c7471cddd4c3367c68f884729486ca1f9352be8f546ea06a988e9f2d2afae9394be46d5d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_socket.pyd

Filesize
63KB

MD5
c7191cfe1da82b09fbedb5ea207397c5

SHA1
894199e61d3aa786ce2f5f2e159e8a9d6ffc1f68

SHA256
006c61209b77985aae77a8883293be2ac1e3f3913d6d436e16088311135f5bc2

SHA512
c6b35f1573fdea5a51b636243f171a2021b93f29092fc46a2c0717cf2f2ce187c77598c203b3c5fa225936e01fc81d957ae684fc9b5b2ecc70bc010ef9a64f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_sqlite3.pyd

Filesize
66KB

MD5
864db9d3b9a4da476a3fb06b76263eed

SHA1
6c77e33aab6b8095822d42c6af1c992dfb3eb956

SHA256
4a208afeb6d3f8c2dbdcd710cf7670100e5244a740480f5b6991956590809b40

SHA512
a0a7e1ae4f9b568028950cc8731695b9656e7e41e3b4db57516b6916203587652e2c490d411a9a57ae2ee68788f5461c51a0bbd26d99f74e6dc0fe74ccec7013

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_ssl.pyd

Filesize
133KB

MD5
79595e0f25d0e59d8493f4e6e3c83c64

SHA1
7be5783a05a9555dfb634c58453d3422bcac2f78

SHA256
4f6f68fa2bc4a974b678737dff7ba97600bcbdda4cdc4cd83261401ffadd846c

SHA512
ac1fb03d3cfa7c72b79e0ef13fba72fa9b913e86e7ece2094e3df634a83ee7604b0797d17b3b09c4cee63a63abaab87848df527c9ca399b2d846c286f53c14f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\_uuid.pyd

Filesize
17KB

MD5
54f10c6f7f793fc393bc138c822bf918

SHA1
61a7cb976124e70c36dec56752e25f7d1efcc30c

SHA256
9de300ca515e6c7dc1518b662ccab87f8a23d86f3a387abff71ce2e9a3e0f809

SHA512
1696741d41a1d2c905cb470cb00c25c44094c121d3e93ff143b70ae49855719a723f90063e77d22b3b972f5c487bedef0238f6c2f39d5814d140c54f08013017

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\base_library.zip

Filesize
858KB

MD5
bc736d8498b38a4a566d62b239250560

SHA1
26621109ad67f26a7a26189d741ba3f0f6429c99

SHA256
b072bbc64ea956cb2d9a4bccb83073b4f112d755876f8eaa4827a7d4c077a149

SHA512
24ae29859d7fd175754c0adda9e7f718e11cd7ed30a25f06c4171810cab934b132868528141fc701c255b73b27ce19d220dd176ed8aa77fc431fd3e90d19ee93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\libcrypto-1_1.dll

Filesize
2.2MB

MD5
31c2130f39942ac41f99c77273969cd7

SHA1
540edcfcfa75d0769c94877b451f5d0133b1826c

SHA256
dd55258272eeb8f2b91a85082887463d0596e992614213730000b2dbc164bcad

SHA512
cb4e0b90ea86076bd5c904b46f6389d0fd4afffe0bd3a903c7ff0338c542797063870498e674f86d58764cdbb73b444d1df4b4aa64f69f99b224e86ddaf74bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\libffi-7.dll

Filesize
28KB

MD5
bc20614744ebf4c2b8acd28d1fe54174

SHA1
665c0acc404e13a69800fae94efd69a41bdda901

SHA256
0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57

SHA512
0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\libssl-1_1.dll

Filesize
531KB

MD5
8471e73a5594c8fbbb3a8b3df4fb7372

SHA1
488772cb5bbb50f14a4a9546051edef4ae75dd20

SHA256
380bb2c4ce42dd1ef77c33086cf95aa4fe50290a30849a3e77a18900141af793

SHA512
24025b8f0cc076a6656eba288f5850847c75f8581c9c3e36273350db475050deee903d034ad130d56d1dede20c0d33b56b567c2ef72eb518f76d887f9254b11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\multidict\_multidict.cp310-win32.pyd

Filesize
35KB

MD5
8e33902fcac5e24f9aa94df6fb8acbc0

SHA1
63ec46cdb36271b0b06408fac75a106c97f01356

SHA256
666f8c0662a085a0bd7ceec69121444fb440c5c05eed02dd4cea91a623050c87

SHA512
b5094d4e9adbae7aa8ab5c09ac73d67f062a0aaedd0734b5603fcbf5a10fec08bb19e6ffcad3abf798c1a49585c97df83eaccd61f05382618130dc74bae3101a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\pyexpat.pyd

Filesize
159KB

MD5
a90cf390c180ad0b5e04fce423a04ce5

SHA1
1977e653b274670042a0886f5314ab452e711ddc

SHA256
a76b8b926eaf4463cb39147149c0ee0a13ded0afc80cfcf2290edb54d677c7c3

SHA512
b5fef5ac63721782453a51cdf01db1ab24124e28be374563da257161241edc7831c532cff287226c1f506ecaacd53b9143a5c1f0e0b9a7a12436e83d72dc15ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\python3.DLL

Filesize
59KB

MD5
b11ef84ff83642891a77cd65eab5a0d9

SHA1
d50358e7d95ee237196ea1f3b8be9c172e5d6b6d

SHA256
517f661270d576e8c1d51b32d37920dd5d1864438fb3442769f2faa48fd9fb75

SHA512
f82adba94d2d8e41779f2c97c0a765d833d0eca75731d9311c473c4c06b7d6dbb9d162c9d87e7c93d2a9388612398c35b6c24675d37d655fb87b88813a6d2f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\python310.dll

Filesize
3.9MB

MD5
87bb8d7f9f22e11d2a3c196ee9bf36a5

SHA1
45dfcb22987f5a20a9b32410336c0d097ca91b35

SHA256
1269f15b1c8daa25af81e6ad22f9bcebfd2c76aec81c18c6d800460b7105bf98

SHA512
75bb2ae36b693e2a1e5ba003503d07ba975f9436fb3da9bf3fc4087a281cb172fa9bd13ad6fc27a62f796af6cbe0c800e2a169c65949a96bd4d0e150f4858288

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\select.pyd

Filesize
22KB

MD5
0b16458372bde0b85e84ce467cfc8c95

SHA1
a3ee99f69f0e5ffae36686af479ead1102c2a0a6

SHA256
bc9531896aee675fd8ae0fd2805524b5e9ce921dd5365145b9f32141604082db

SHA512
727cda4aa085c1af0ce3a9a3a6833057b255678666b2f00dca4f737f322a7cc02cd896ef3353bf9add02faf53b90ce6344e85860cc35da969fcee085c2f210bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\sqlite3.dll

Filesize
1.1MB

MD5
619ed191f0de16a3d0c91cd81170a75c

SHA1
b5a97b57bdcc45fb65c242e948091f6911645706

SHA256
5a374374fb7efd50e2d738909fe86196b895d7150747872a4db015572e66a6fc

SHA512
6751528304822a377f369e4c2a604d3a88bd9694bada6669abce861ff41bbeb8061b17e946dbc13df05617d871850390d4d5c18f7fabf134bac66ea12860ac21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13362\unicodedata.pyd

Filesize
1.1MB

MD5
9f0d733a0c240692270fb45ad30028df

SHA1
da06251cae9c6e4c7179ec9e9a67ac6cc1691077

SHA256
0c4342f33bd82f4840e293f5115ed0e87ec4409c5d8c78e43161fa3d60fa235a

SHA512
c72988875256eb1cea0e95a15f3731e95d847eacb52c5cb03b65e41ddc64b2591d34ea499f6e71ed203cf37f6ee09697708acf64d9e37cc4d1d37cb86de9c52b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kzcwjovl.gzy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\byfron-01a570a3cd0a46f2.zip.crdownload

Filesize
23.6MB

MD5
6a063def825e9b3140de7a48f557aeb0

SHA1
039ae9f78e5d7fba280254d1e14f893059655ffa

SHA256
1633fb0a402ffcad0b3f933263493db80c6920e2eb32f95c24f2f9b1e8c8d902

SHA512
e447717ff13242a503b672390d3a218880f700544e36ea80032110562d9064b9c9411a74e561fb79c2553a5bbd3858dac105677178c34e3294aa7a08bfe7a508

Download Submit
memory/1812-734-0x0000000002160000-0x0000000002196000-memory.dmp

Filesize
216KB

Download
memory/1812-736-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

Filesize
136KB

Download
memory/1812-737-0x0000000004C70000-0x0000000004CD6000-memory.dmp

Filesize
408KB

Download
memory/1812-738-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/1812-735-0x0000000004D10000-0x0000000005338000-memory.dmp

Filesize
6.2MB

Download
memory/1812-748-0x00000000054E0000-0x0000000005834000-memory.dmp

Filesize
3.3MB

Download
memory/1812-750-0x0000000005A80000-0x0000000005A9E000-memory.dmp

Filesize
120KB

Download
memory/1812-751-0x0000000005AC0000-0x0000000005B0C000-memory.dmp

Filesize
304KB

Download
memory/1812-753-0x0000000005FF0000-0x0000000006086000-memory.dmp

Filesize
600KB

Download
memory/1812-754-0x0000000005F70000-0x0000000005F8A000-memory.dmp

Filesize
104KB

Download
memory/1812-755-0x0000000005FC0000-0x0000000005FE2000-memory.dmp

Filesize
136KB

Download
memory/1812-756-0x0000000007360000-0x0000000007904000-memory.dmp

Filesize
5.6MB

Download
memory/1812-757-0x0000000006DB0000-0x0000000006E42000-memory.dmp

Filesize
584KB

Download