exelastealer | hxxps://mega[.]nz/folder/cm5zGRYL#tSEDmYw7_6QV4mk_K60wYw

Analysis

max time kernel
81s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/cm5zGRYL#tSEDmYw7_6QV4mk_K60wYw

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation stealer

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4992	netsh.exe
1224	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5748	cmd.exe
3236	powershell.exe

Loads dropped DLL 64 IoCs

pid	Process
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
6132	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4352	CelestialLLC.exe
4188	CelestialLLC.exe
4188	CelestialLLC.exe
4188	CelestialLLC.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
160	discord.com
153	discord.com
154	discord.com
155	discord.com
156	discord.com
159	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
150	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
6052	cmd.exe
6128	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3756	tasklist.exe
4108	tasklist.exe
5752	tasklist.exe
5144	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5524	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6092	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CelestialLLC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6088	netsh.exe
6024	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
6012	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5236	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5176	ipconfig.exe
6012	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3944	systeminfo.exe

Kills process with taskkill 11 IoCs

evasion

pid	Process
1416	taskkill.exe
5372	taskkill.exe
3380	taskkill.exe
5828	taskkill.exe
6128	taskkill.exe
4104	taskkill.exe
4744	taskkill.exe
1564	taskkill.exe
6056	taskkill.exe
5248	taskkill.exe
5140	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4784	msedge.exe
4784	msedge.exe
4348	identity_helper.exe
4348	identity_helper.exe
5732	msedge.exe
5732	msedge.exe
3236	powershell.exe
3236	powershell.exe
3236	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3744	WMIC.exe
Token: SeSecurityPrivilege	3744	WMIC.exe
Token: SeTakeOwnershipPrivilege	3744	WMIC.exe
Token: SeLoadDriverPrivilege	3744	WMIC.exe
Token: SeSystemProfilePrivilege	3744	WMIC.exe
Token: SeSystemtimePrivilege	3744	WMIC.exe
Token: SeProfSingleProcessPrivilege	3744	WMIC.exe
Token: SeIncBasePriorityPrivilege	3744	WMIC.exe
Token: SeCreatePagefilePrivilege	3744	WMIC.exe
Token: SeBackupPrivilege	3744	WMIC.exe
Token: SeRestorePrivilege	3744	WMIC.exe
Token: SeShutdownPrivilege	3744	WMIC.exe
Token: SeDebugPrivilege	3744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3744	WMIC.exe
Token: SeRemoteShutdownPrivilege	3744	WMIC.exe
Token: SeUndockPrivilege	3744	WMIC.exe
Token: SeManageVolumePrivilege	3744	WMIC.exe
Token: 33	3744	WMIC.exe
Token: 34	3744	WMIC.exe
Token: 35	3744	WMIC.exe
Token: 36	3744	WMIC.exe
Token: SeDebugPrivilege	3756	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3744	WMIC.exe
Token: SeSecurityPrivilege	3744	WMIC.exe
Token: SeTakeOwnershipPrivilege	3744	WMIC.exe
Token: SeLoadDriverPrivilege	3744	WMIC.exe
Token: SeSystemProfilePrivilege	3744	WMIC.exe
Token: SeSystemtimePrivilege	3744	WMIC.exe
Token: SeProfSingleProcessPrivilege	3744	WMIC.exe
Token: SeIncBasePriorityPrivilege	3744	WMIC.exe
Token: SeCreatePagefilePrivilege	3744	WMIC.exe
Token: SeBackupPrivilege	3744	WMIC.exe
Token: SeRestorePrivilege	3744	WMIC.exe
Token: SeShutdownPrivilege	3744	WMIC.exe
Token: SeDebugPrivilege	3744	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3744	WMIC.exe
Token: SeRemoteShutdownPrivilege	3744	WMIC.exe
Token: SeUndockPrivilege	3744	WMIC.exe
Token: SeManageVolumePrivilege	3744	WMIC.exe
Token: 33	3744	WMIC.exe
Token: 34	3744	WMIC.exe
Token: 35	3744	WMIC.exe
Token: 36	3744	WMIC.exe
Token: SeDebugPrivilege	4108	tasklist.exe
Token: SeDebugPrivilege	5828	taskkill.exe
Token: SeDebugPrivilege	6056	taskkill.exe
Token: SeDebugPrivilege	6128	taskkill.exe
Token: SeDebugPrivilege	4104	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	5248	taskkill.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	5372	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	5140	taskkill.exe
Token: SeDebugPrivilege	5752	tasklist.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeIncreaseQuotaPrivilege	5236	WMIC.exe
Token: SeSecurityPrivilege	5236	WMIC.exe
Token: SeTakeOwnershipPrivilege	5236	WMIC.exe
Token: SeLoadDriverPrivilege	5236	WMIC.exe
Token: SeSystemProfilePrivilege	5236	WMIC.exe
Token: SeSystemtimePrivilege	5236	WMIC.exe
Token: SeProfSingleProcessPrivilege	5236	WMIC.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1684	4784	msedge.exe	84
PID 4784 wrote to memory of 1684	4784	msedge.exe	84
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 632	4784	msedge.exe	85
PID 4784 wrote to memory of 4336	4784	msedge.exe	86
PID 4784 wrote to memory of 4336	4784	msedge.exe	86
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87
PID 4784 wrote to memory of 4972	4784	msedge.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5636	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/cm5zGRYL#tSEDmYw7_6QV4mk_K60wYw
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe074446f8,0x7ffe07444708,0x7ffe07444718
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,7165067354032469862,9620920043884552398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x46c
1⤵
PID:4504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5980

C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
"C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5684
- C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
  "C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4484
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    PID:5524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:5636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5468
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4784"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 4784
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1684"
    3⤵
    PID:5932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1684
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 632"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 632
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4336"
    3⤵
    PID:2720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 4336
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4972"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 4972
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2700"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 2700
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3536"
    3⤵
    PID:796
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 3536
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1828"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1828
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1032"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1032
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5712"
    3⤵
    PID:5420
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 5712
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5720"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 5720
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:5764
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5756
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp
        5⤵
        
        PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2476
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - System Location Discovery: System Language Discovery
    PID:5748
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:6052
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:3944
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious use of AdjustPrivilegeToken
      PID:5236
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      PID:5196
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
  - - C:\Windows\SysWOW64\net.exe
      net localgroup
      4⤵
      System Location Discovery: System Language Discovery
      PID:2532
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
  - - C:\Windows\SysWOW64\net.exe
      net user guest
      4⤵
      PID:4304
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:448
  - - C:\Windows\SysWOW64\net.exe
      net user administrator
      4⤵
      System Location Discovery: System Language Discovery
      PID:2936
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      System Location Discovery: System Language Discovery
      PID:5280
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:5144
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:5176
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route print
      4⤵
      System Location Discovery: System Language Discovery
      PID:3724
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:6128
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      PID:6012
  - - C:\Windows\SysWOW64\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:6092
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:4992
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6024
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5248
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      PID:1148

C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
"C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
1⤵
PID:4700
- C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
  "C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1416

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\version.txt
1⤵
PID:5524

C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
"C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5812
- C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
  "C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220

C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
"C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2264
- C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe
  "C:\Users\Admin\Desktop\byfron-01a570a3cd0a46f2\CelestialLLC.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
4888f8480e5e49950958fa51f49a4cc1

SHA1
f222f623b9e64e2cac3e8b4be7ff201fc5c965f7

SHA256
52f42382abd6f79e2aac12d7b4ebfe13ba7a469540e517b5c5af30335fc5d645

SHA512
64379a7388b22c72e559faeaa9be763dcde931d45894154ce3715107dce8402f09f67b6c6b339664dd58a51e0554bce0953815f47cd69b017d2b67414ad196b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5ab6de6ba08eacb0b51845b4dab0690

SHA1
b342305feb0b150df9c103050ce27b7b98eb83ca

SHA256
34202d73ae90fe1b9f966cc24076dbd002a2c0976ee7075eb572798b569fd893

SHA512
6db178ec530414eabfd0b13b1248839a778c80706d918f329e50025f1838d165e9e8d4ec67129126775e520e3a387a00fc1bca4c0f19485e8100f5fc900aa06c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
423923f029cf947046f427f3a136bfb2

SHA1
a8e6d67625c3f36d88810a121028e372de40f78b

SHA256
4c42bb2a2a270d6fad34bfed99645e72d891ac28bf2b42617c3bd35c21623d6b

SHA512
e195fa7d1b5d62ddafc1e03b6cb653982d1e8c586fe66b33eb52658aa9a278db94a9c770f1156fb847b5208f0b7a699aa724dc37fa72f6dfafc8909771df1a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ee48cc4ef100eac9bc4105a202f8983

SHA1
b4efcc3beb990157473d3c1cfd1e9bb6cca1df6d

SHA256
86421e52fd89c7a8e10318a7576941e9e3f39e7f76b9b69d7da041cb41146c88

SHA512
b14c925b471e5e9a9ba3cf253912b25c4e885004d215c8d7397a7c8be0396493030c5621cbc09f2b8d208e6956b1383ab088a31b7c58d12de4715e76ac66d60e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a31eea6ec603de2a3408d1b7631996e

SHA1
15d27117b81b4ffa7fce796a71a7e71a1e51250a

SHA256
88acb3ec93ec6c0994eb88e1b28aa3752a83f0f40c54d1e5d5cc453683b5c070

SHA512
4f86d8ecc852ce1da1519d78af6bdfffe17210f2d74d28ce3ecfa0f1307ed9db6051b513ef38bee850a037efedbea9c078a0fed0c62031b2310368b76d6c4028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
915926d8254730fe57e28d877009dbad

SHA1
8f928b408896c49cda3253b9994c7f67a43e49de

SHA256
146ec53f9450e4be47ea2951efbccd778a75c976e2d9139689a2095c4b975007

SHA512
3aadbb02daa2740fdc662d7ca89c500c450feea382b5c3908166384cb4736ad5fc3bea38e64d2118161adf5dffd72d002623476778742e8fd8856fde676d376c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d551.TMP

Filesize
48B

MD5
544f44f61c99bc2880b16e91d4a55304

SHA1
588fbe33d99d953a896cd619ca149c77fae991bb

SHA256
369856cc26cdf3c559f3f4aaea6d18e9da52a69f989b4c630a87549780857a38

SHA512
4740fed5c41bb298d661c87a613c644b789df271c2483b97cd2c706bc15e38db45a76d0ad49fd67ad5e0d70820bb92519048c772322fad72a057cee97be8c028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
701749542cf271da6a3c84a945d570b8

SHA1
53a8afe242c7525114192bb6b2492ed850e696ec

SHA256
f89ed8f502d3de31ab65e91df8c3c9b993facba8a1297198313fce11371a6229

SHA512
874d7121597e9d73fc2acf04f2b62d379e7b40b04150ee8040828bc449e263aa4edceb3838973b67c114051c82b6efd5c916d5a69633c27431e3791500f4f9dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a82cc65bf3a50f3164bb634d674b31d1

SHA1
e76149987d147433a9efb0a09458c5098cd9ce55

SHA256
f75a339178b3065b3aeaea5d0853efac5f72cb8c9f6594caf25db1a0df000605

SHA512
286935e254c39e68fc86afef3593c7f81f9968cc3a489d582ead47cca723aafe9526e919c8df738e2140a5f0abed9ff7cf4514e5d80e80b4c0b7173923b3fd72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\VCRUNTIME140.dll

Filesize
74KB

MD5
31ce620cb32ac950d31e019e67efc638

SHA1
eaf02a203bc11d593a1adb74c246f7a613e8ef09

SHA256
1e0f8f7f13502f5cee17232e9bebca7b44dd6ec29f1842bb61033044c65b2bbf

SHA512
603e8dceda4cb5b3317020e71f1951d01ace045468eaf118b422f4f44b8b6b2794f5002ea2e3fe9107c222e4cb55b932ed0d897a1871976d75f8ee10d5d12374

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_asyncio.pyd

Filesize
50KB

MD5
72cded1f02ea183c67cac4d2dd129417

SHA1
5d221cb76ac4f7cc85f5da4271ca8607619d3170

SHA256
d584831be60125e44bc57704164897880ee0770e44ecc9df6b7f0a68a17d4986

SHA512
1a35505e0a1d2c8f1b529bd447f51a1148c14e56ca70b901a75c0e3f449787267460f5819573ff1b84a8729720ee1abdfa5c9daff3a586b99d9af4b85868803c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_bz2.pyd

Filesize
66KB

MD5
216f736db1b110548da2f8f21c381412

SHA1
da3781dfe8f6b3bdacc92f82c330cc26248b6b5d

SHA256
ce4f48bdc1f6144b4bcb288896392867176a2b5f10efbfbc2d5454e14cde61ce

SHA512
3bea7426995833f37996468ca3d122c4c182cfcde6f6469d51c211624baa169daacd20101abb1ce8ba50b46fd9f25d1bf1f5e913ebfbea600a5d7ad557f33544

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_cffi_backend.cp310-win32.pyd

Filesize
152KB

MD5
84e1f73a3e4e6d4b6afd8d9ef10b1924

SHA1
5bd989147215f91d0fd2a17c23d02bbf9fac89bf

SHA256
ff874a41dc5d656bc24e48d5193345c09281ebfb7ef7724ef760fc9b1ff37439

SHA512
57c66bb7af04512bde04aa82f75087d2b7f5a82b67b59e860daa4a660e046891cbe62309b05305d725f71c30debfd2829068485164bc46f106355dd79bf5cdcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_ctypes.pyd

Filesize
100KB

MD5
30e16eeedd78a40498b600312d18161f

SHA1
c00f657b13e0b0ab5739abf2ee7b627238cd8055

SHA256
92ccf5b99a1f4553001e57fd58bbf8d843b6d6907057e31d236f913f0c51ab82

SHA512
76e213afcec7c06d7fe53b674b983773da8e1d32690bf8ba4ad0aa585e7517f36e7a287d9abb108a438c8937fd0c909ed6ce69658556563648cd581f12536707

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_decimal.pyd

Filesize
186KB

MD5
64075bc3bb3d8ecfb34938f24ae4077e

SHA1
9427093b25c208f7fe2d993543bf94cf25620023

SHA256
0c12e6598ce23e43fc00d34a86c6be6b49eedc33b676c5596483491a215bc670

SHA512
2fb3338a40364d390a14f0b32396378448b2c7f5a688423a98eae44d2a99ade505012949abc406a54f7b1094ca92f7dc2f5c930c81c2ed45076712edf74cb059

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_hashlib.pyd

Filesize
43KB

MD5
f9f0589c4d853060b62b1e83b3c6e8f8

SHA1
11d474d1a0006c0f8746187ed575d2923fdf3b01

SHA256
600ff18011b09cf9d49660dd7f58601ef438a921c1732054fdc5f312425c55e1

SHA512
ee3ef23cf79cd3782a84214548db2bb394e256db5f7e60d00ef6d62fad191d4654b889588ebd0da8cfbee0154ff3df362f2b1a76370e437edfcb398ba7982c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_lzma.pyd

Filesize
139KB

MD5
4a42b4f058c2e58eb3ab47e0166259cc

SHA1
4a55098dbffd59c651b862c2e610961b20f3b9da

SHA256
adddfd498ed73729af21bc139c421411aa40fa9000da1054c1ed73be6b2c8f56

SHA512
dd68e0a20a58c127a91406e7dfbb20f473635974fec15de0e678101241272c70ea7335e3e0cf990bef200d29f73adc519701989992ab55b53894c6d3133df52e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_multiprocessing.pyd

Filesize
24KB

MD5
80838bbcd5353878f3b29903e5821e99

SHA1
35f72a488bf1556f0c09a3788f4df757e063239f

SHA256
bc0c3972fa6ee51f8cad78bb1d9e71b7455a027eeb30b6d3e05bf00eef6752d7

SHA512
74a7abefcaa59d71bae4f70351f6a57d7d0cb2f5745f2f86b983bdfd3b56e4ea474407ec78db434b1494c5a018feb7e56fcf0fbb44b07524cf6898eb881521e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_overlapped.pyd

Filesize
36KB

MD5
4a1ac99a32112238eac9720b209d1b0e

SHA1
45ebcd122524e9f25671b66e988e0d33f3f0af8b

SHA256
c999ef86af630c7bfbcd924b1a19010103c2db19b4dd38df844756b6094f1fd7

SHA512
f311173ba7865c3f0629f74767a277b03cf6f029e0acab4f01c5d1820610485dee447a9b7afbffd93ffa77bc36ad8534c160b6c49444bfa743ba5b49f06e9659

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_queue.pyd

Filesize
23KB

MD5
d105039da54edcabd7b893068c86d1ce

SHA1
3ce7b89011ac1311243e1935eeb3a8e49ec8bed8

SHA256
214739fe1823ffd6c1d81be15c675743d08b69f73ad2699ff9d193589d8d47f7

SHA512
dfcb68e285957ec3f54d7205a59f295eadc495b1d6119591fd850e8c7471cddd4c3367c68f884729486ca1f9352be8f546ea06a988e9f2d2afae9394be46d5d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_socket.pyd

Filesize
63KB

MD5
c7191cfe1da82b09fbedb5ea207397c5

SHA1
894199e61d3aa786ce2f5f2e159e8a9d6ffc1f68

SHA256
006c61209b77985aae77a8883293be2ac1e3f3913d6d436e16088311135f5bc2

SHA512
c6b35f1573fdea5a51b636243f171a2021b93f29092fc46a2c0717cf2f2ce187c77598c203b3c5fa225936e01fc81d957ae684fc9b5b2ecc70bc010ef9a64f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_sqlite3.pyd

Filesize
66KB

MD5
864db9d3b9a4da476a3fb06b76263eed

SHA1
6c77e33aab6b8095822d42c6af1c992dfb3eb956

SHA256
4a208afeb6d3f8c2dbdcd710cf7670100e5244a740480f5b6991956590809b40

SHA512
a0a7e1ae4f9b568028950cc8731695b9656e7e41e3b4db57516b6916203587652e2c490d411a9a57ae2ee68788f5461c51a0bbd26d99f74e6dc0fe74ccec7013

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_ssl.pyd

Filesize
133KB

MD5
79595e0f25d0e59d8493f4e6e3c83c64

SHA1
7be5783a05a9555dfb634c58453d3422bcac2f78

SHA256
4f6f68fa2bc4a974b678737dff7ba97600bcbdda4cdc4cd83261401ffadd846c

SHA512
ac1fb03d3cfa7c72b79e0ef13fba72fa9b913e86e7ece2094e3df634a83ee7604b0797d17b3b09c4cee63a63abaab87848df527c9ca399b2d846c286f53c14f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\_uuid.pyd

Filesize
17KB

MD5
54f10c6f7f793fc393bc138c822bf918

SHA1
61a7cb976124e70c36dec56752e25f7d1efcc30c

SHA256
9de300ca515e6c7dc1518b662ccab87f8a23d86f3a387abff71ce2e9a3e0f809

SHA512
1696741d41a1d2c905cb470cb00c25c44094c121d3e93ff143b70ae49855719a723f90063e77d22b3b972f5c487bedef0238f6c2f39d5814d140c54f08013017

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\aiohttp\_helpers.cp310-win32.pyd

Filesize
45KB

MD5
7f96db3327351a9395f832d286854e9d

SHA1
bb022c24cfdcb6426511e20577a71c3279b25177

SHA256
73f7cfe152ec96acd88cf2f02ac20f2b66d0eaccee9d9312281f3efbc0633dfb

SHA512
63f3e4b2a460552eb404945b929007e38773af0713fd829a4ccc6df4c92791c29f56776ec9b7b32396b9651b32714e920d13df2a08bff98a003467ce6912ca0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\base_library.zip

Filesize
858KB

MD5
bc736d8498b38a4a566d62b239250560

SHA1
26621109ad67f26a7a26189d741ba3f0f6429c99

SHA256
b072bbc64ea956cb2d9a4bccb83073b4f112d755876f8eaa4827a7d4c077a149

SHA512
24ae29859d7fd175754c0adda9e7f718e11cd7ed30a25f06c4171810cab934b132868528141fc701c255b73b27ce19d220dd176ed8aa77fc431fd3e90d19ee93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\libcrypto-1_1.dll

Filesize
2.2MB

MD5
31c2130f39942ac41f99c77273969cd7

SHA1
540edcfcfa75d0769c94877b451f5d0133b1826c

SHA256
dd55258272eeb8f2b91a85082887463d0596e992614213730000b2dbc164bcad

SHA512
cb4e0b90ea86076bd5c904b46f6389d0fd4afffe0bd3a903c7ff0338c542797063870498e674f86d58764cdbb73b444d1df4b4aa64f69f99b224e86ddaf74bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\libffi-7.dll

Filesize
28KB

MD5
bc20614744ebf4c2b8acd28d1fe54174

SHA1
665c0acc404e13a69800fae94efd69a41bdda901

SHA256
0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57

SHA512
0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\libssl-1_1.dll

Filesize
531KB

MD5
8471e73a5594c8fbbb3a8b3df4fb7372

SHA1
488772cb5bbb50f14a4a9546051edef4ae75dd20

SHA256
380bb2c4ce42dd1ef77c33086cf95aa4fe50290a30849a3e77a18900141af793

SHA512
24025b8f0cc076a6656eba288f5850847c75f8581c9c3e36273350db475050deee903d034ad130d56d1dede20c0d33b56b567c2ef72eb518f76d887f9254b11b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\multidict\_multidict.cp310-win32.pyd

Filesize
35KB

MD5
8e33902fcac5e24f9aa94df6fb8acbc0

SHA1
63ec46cdb36271b0b06408fac75a106c97f01356

SHA256
666f8c0662a085a0bd7ceec69121444fb440c5c05eed02dd4cea91a623050c87

SHA512
b5094d4e9adbae7aa8ab5c09ac73d67f062a0aaedd0734b5603fcbf5a10fec08bb19e6ffcad3abf798c1a49585c97df83eaccd61f05382618130dc74bae3101a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\pyexpat.pyd

Filesize
159KB

MD5
a90cf390c180ad0b5e04fce423a04ce5

SHA1
1977e653b274670042a0886f5314ab452e711ddc

SHA256
a76b8b926eaf4463cb39147149c0ee0a13ded0afc80cfcf2290edb54d677c7c3

SHA512
b5fef5ac63721782453a51cdf01db1ab24124e28be374563da257161241edc7831c532cff287226c1f506ecaacd53b9143a5c1f0e0b9a7a12436e83d72dc15ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\python3.DLL

Filesize
59KB

MD5
b11ef84ff83642891a77cd65eab5a0d9

SHA1
d50358e7d95ee237196ea1f3b8be9c172e5d6b6d

SHA256
517f661270d576e8c1d51b32d37920dd5d1864438fb3442769f2faa48fd9fb75

SHA512
f82adba94d2d8e41779f2c97c0a765d833d0eca75731d9311c473c4c06b7d6dbb9d162c9d87e7c93d2a9388612398c35b6c24675d37d655fb87b88813a6d2f65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\python310.dll

Filesize
3.9MB

MD5
87bb8d7f9f22e11d2a3c196ee9bf36a5

SHA1
45dfcb22987f5a20a9b32410336c0d097ca91b35

SHA256
1269f15b1c8daa25af81e6ad22f9bcebfd2c76aec81c18c6d800460b7105bf98

SHA512
75bb2ae36b693e2a1e5ba003503d07ba975f9436fb3da9bf3fc4087a281cb172fa9bd13ad6fc27a62f796af6cbe0c800e2a169c65949a96bd4d0e150f4858288

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\select.pyd

Filesize
22KB

MD5
0b16458372bde0b85e84ce467cfc8c95

SHA1
a3ee99f69f0e5ffae36686af479ead1102c2a0a6

SHA256
bc9531896aee675fd8ae0fd2805524b5e9ce921dd5365145b9f32141604082db

SHA512
727cda4aa085c1af0ce3a9a3a6833057b255678666b2f00dca4f737f322a7cc02cd896ef3353bf9add02faf53b90ce6344e85860cc35da969fcee085c2f210bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\sqlite3.dll

Filesize
1.1MB

MD5
619ed191f0de16a3d0c91cd81170a75c

SHA1
b5a97b57bdcc45fb65c242e948091f6911645706

SHA256
5a374374fb7efd50e2d738909fe86196b895d7150747872a4db015572e66a6fc

SHA512
6751528304822a377f369e4c2a604d3a88bd9694bada6669abce861ff41bbeb8061b17e946dbc13df05617d871850390d4d5c18f7fabf134bac66ea12860ac21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\unicodedata.pyd

Filesize
1.1MB

MD5
9f0d733a0c240692270fb45ad30028df

SHA1
da06251cae9c6e4c7179ec9e9a67ac6cc1691077

SHA256
0c4342f33bd82f4840e293f5115ed0e87ec4409c5d8c78e43161fa3d60fa235a

SHA512
c72988875256eb1cea0e95a15f3731e95d847eacb52c5cb03b65e41ddc64b2591d34ea499f6e71ed203cf37f6ee09697708acf64d9e37cc4d1d37cb86de9c52b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI56842\yarl\_quoting_c.cp310-win32.pyd

Filesize
79KB

MD5
3c90bd44c0b0f796af13eabc2024aa8a

SHA1
50bd140c4439730f68782821b606c94a90616d6d

SHA256
270fa83f42ea2c7efa0ce1f2823555e14ff25b511f538108f6b8ce688182bdd0

SHA512
57a37cec664190b2eaedd770e3cb8a7f4ff7ef272bccffe204e7043b9f3d691597c4a173a86912aac84c09dd5af33700d1342ab2e0cc7a7bf92a9893f8c5c215

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI58122\attrs-24.1.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gdb4dmyo.bh4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\byfron-01a570a3cd0a46f2.zip

Filesize
23.6MB

MD5
79481d5f21cf6216769c90bb3122d2a6

SHA1
2837ed6d031d0e426f817392fa593622b3ac332d

SHA256
275126986f8d07f96ea7b6641f4fce989932be58c76cdd4c657bfe17c0a611a2

SHA512
3ab31740de3a0299da5940ecb28b56bec1c063b44eaec27beb958eb5b106efa2b4bbc84bd0084e4fb01cc1a8270d5d62edca0b305c517e546c032b57f4440b84

Download Submit
memory/3236-395-0x0000000005320000-0x0000000005342000-memory.dmp

Filesize
136KB

Download
memory/3236-396-0x0000000005B00000-0x0000000005B66000-memory.dmp

Filesize
408KB

Download
memory/3236-397-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Filesize
408KB

Download
memory/3236-394-0x0000000005420000-0x0000000005A48000-memory.dmp

Filesize
6.2MB

Download
memory/3236-407-0x0000000005CE0000-0x0000000006034000-memory.dmp

Filesize
3.3MB

Download
memory/3236-408-0x00000000061C0000-0x00000000061DE000-memory.dmp

Filesize
120KB

Download
memory/3236-409-0x0000000006210000-0x000000000625C000-memory.dmp

Filesize
304KB

Download
memory/3236-412-0x0000000006740000-0x00000000067D6000-memory.dmp

Filesize
600KB

Download
memory/3236-413-0x00000000066C0000-0x00000000066DA000-memory.dmp

Filesize
104KB

Download
memory/3236-414-0x0000000006710000-0x0000000006732000-memory.dmp

Filesize
136KB

Download
memory/3236-415-0x0000000007820000-0x0000000007DC4000-memory.dmp

Filesize
5.6MB

Download
memory/3236-416-0x0000000007310000-0x00000000073A2000-memory.dmp

Filesize
584KB

Download
memory/3236-393-0x00000000028B0000-0x00000000028E6000-memory.dmp

Filesize
216KB

Download