exelastealer | hxxps://github[.]com/boostrapperx/boostrapper/releases/download/vypix/Boostrapper[.]exe

Analysis

max time kernel
145s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-10-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/boostrapperx/boostrapper/releases/download/vypix/Boostrapper.exe

Score

10^/10

exelastealer collection defense_evasion discovery evasion execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4892	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2092	netsh.exe
412	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
6676	cmd.exe
6828	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4540	Boostrapper (1).exe
3468	Boostrapper (1).exe
6984	Boostrapper (1).exe
7080	Boostrapper (1).exe
1832	bound.exe
5232	bound.exe

Loads dropped DLL 64 IoCs

pid	Process
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe
7080	Boostrapper (1).exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	discord.com
39	discord.com
40	discord.com
52	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
7040	cmd.exe
4460	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
3320	tasklist.exe
5432	tasklist.exe
5716	tasklist.exe
5820	tasklist.exe
1440	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002b072-864.dat	upx
behavioral1/memory/3468-868-0x00007FFAE3F80000-0x00007FFAE4568000-memory.dmp	upx
behavioral1/files/0x001900000002ac0e-870.dat	upx
behavioral1/memory/3468-878-0x00007FFAFC8E0000-0x00007FFAFC8EF000-memory.dmp	upx
behavioral1/files/0x001c00000002ac40-877.dat	upx
behavioral1/memory/3468-876-0x00007FFAF8C90000-0x00007FFAF8CB4000-memory.dmp	upx
behavioral1/files/0x001900000002ac11-882.dat	upx
behavioral1/files/0x001900000002ac0a-880.dat	upx
behavioral1/files/0x001900000002ac1c-904.dat	upx
behavioral1/files/0x001c00000002ac1b-903.dat	upx
behavioral1/files/0x001900000002ac1a-902.dat	upx
behavioral1/memory/3468-901-0x00007FFAF5000000-0x00007FFAF502D000-memory.dmp	upx
behavioral1/files/0x001900000002ac17-900.dat	upx
behavioral1/files/0x001900000002ac16-899.dat	upx
behavioral1/files/0x001c00000002ac15-898.dat	upx
behavioral1/files/0x001900000002ac14-897.dat	upx
behavioral1/files/0x001900000002ac10-896.dat	upx
behavioral1/files/0x001c00000002ac0f-895.dat	upx
behavioral1/files/0x001900000002ac0b-894.dat	upx
behavioral1/files/0x001900000002ac08-893.dat	upx
behavioral1/files/0x001900000002b081-891.dat	upx
behavioral1/memory/3468-890-0x00007FFAF64F0000-0x00007FFAF6509000-memory.dmp	upx
behavioral1/files/0x001900000002b080-889.dat	upx
behavioral1/files/0x001900000002b076-888.dat	upx
behavioral1/files/0x001900000002b070-887.dat	upx
behavioral1/files/0x001900000002ac41-885.dat	upx
behavioral1/files/0x001900000002ac3f-884.dat	upx
behavioral1/memory/3468-922-0x00007FFAF9B10000-0x00007FFAF9B1D000-memory.dmp	upx
behavioral1/memory/3468-924-0x00007FFAE3F50000-0x00007FFAE3F7D000-memory.dmp	upx
behavioral1/files/0x001900000002b075-923.dat	upx
behavioral1/memory/3468-921-0x00007FFAF9CC0000-0x00007FFAF9CCD000-memory.dmp	upx
behavioral1/memory/3468-920-0x00007FFAEDEA0000-0x00007FFAEDEB9000-memory.dmp	upx
behavioral1/memory/3468-919-0x00007FFAF4CD0000-0x00007FFAF4D05000-memory.dmp	upx
behavioral1/files/0x001900000002b074-926.dat	upx
behavioral1/memory/3468-928-0x00007FFAE3E90000-0x00007FFAE3F4B000-memory.dmp	upx
behavioral1/files/0x001900000002b084-930.dat	upx
behavioral1/memory/3468-931-0x00007FFAE3E60000-0x00007FFAE3E8A000-memory.dmp	upx
behavioral1/memory/3468-933-0x00007FFAE3F80000-0x00007FFAE4568000-memory.dmp	upx
behavioral1/memory/3468-934-0x00007FFAE3A90000-0x00007FFAE3BAC000-memory.dmp	upx
behavioral1/memory/3468-935-0x00007FFAF8C90000-0x00007FFAF8CB4000-memory.dmp	upx
behavioral1/memory/3468-937-0x00007FFAE3630000-0x00007FFAE365E000-memory.dmp	upx
behavioral1/memory/3468-941-0x00007FFAE31F0000-0x00007FFAE3565000-memory.dmp	upx
behavioral1/memory/3468-939-0x00007FFAE3570000-0x00007FFAE3628000-memory.dmp	upx
behavioral1/memory/3468-942-0x00007FFAE3160000-0x00007FFAE31E7000-memory.dmp	upx
behavioral1/memory/3468-943-0x00007FFAE3140000-0x00007FFAE3154000-memory.dmp	upx
behavioral1/memory/3468-947-0x00007FFAE3E90000-0x00007FFAE3F4B000-memory.dmp	upx
behavioral1/memory/3468-946-0x00007FFAE3110000-0x00007FFAE3136000-memory.dmp	upx
behavioral1/memory/3468-945-0x00007FFAF8C20000-0x00007FFAF8C2B000-memory.dmp	upx
behavioral1/memory/3468-944-0x00007FFAE3F50000-0x00007FFAE3F7D000-memory.dmp	upx
behavioral1/memory/3468-949-0x00007FFAE30F0000-0x00007FFAE3108000-memory.dmp	upx
behavioral1/memory/3468-948-0x00007FFAF8AC0000-0x00007FFAF8ACA000-memory.dmp	upx
behavioral1/memory/3468-950-0x00007FFAE3070000-0x00007FFAE3093000-memory.dmp	upx
behavioral1/memory/3468-951-0x00007FFAE3630000-0x00007FFAE365E000-memory.dmp	upx
behavioral1/memory/3468-953-0x00007FFAE2EF0000-0x00007FFAE3063000-memory.dmp	upx
behavioral1/memory/3468-952-0x00007FFAE3570000-0x00007FFAE3628000-memory.dmp	upx
behavioral1/memory/3468-955-0x00007FFAE2EB0000-0x00007FFAE2EE7000-memory.dmp	upx
behavioral1/memory/3468-968-0x00007FFAE2E70000-0x00007FFAE2E7B000-memory.dmp	upx
behavioral1/memory/3468-967-0x00007FFAE2E80000-0x00007FFAE2E8C000-memory.dmp	upx
behavioral1/memory/3468-966-0x00007FFAE2E90000-0x00007FFAE2E9E000-memory.dmp	upx
behavioral1/memory/3468-965-0x00007FFAE2EA0000-0x00007FFAE2EAD000-memory.dmp	upx
behavioral1/memory/3468-964-0x00007FFAE3160000-0x00007FFAE31E7000-memory.dmp	upx
behavioral1/memory/3468-963-0x00007FFAF64E0000-0x00007FFAF64EB000-memory.dmp	upx
behavioral1/memory/3468-962-0x00007FFAEDF00000-0x00007FFAEDF0C000-memory.dmp	upx
behavioral1/memory/3468-961-0x00007FFAEF1B0000-0x00007FFAEF1BB000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3064	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Boostrapper (1).exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
7028	cmd.exe
2596	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5128	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
468	WMIC.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5084	WMIC.exe
5428	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4504	ipconfig.exe
5128	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2416	systeminfo.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
6224	taskkill.exe
6324	taskkill.exe
6416	taskkill.exe
6488	taskkill.exe
456	taskkill.exe
6096	taskkill.exe
2848	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133730181663164851"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Boostrapper (1).exe:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
3468	Boostrapper (1).exe
4892	powershell.exe
4892	powershell.exe
4892	powershell.exe
6828	powershell.exe
6828	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe
Token: SeShutdownPrivilege	3148	chrome.exe
Token: SeCreatePagefilePrivilege	3148	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe
3148	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 4392	3148	chrome.exe	77
PID 3148 wrote to memory of 4392	3148	chrome.exe	77
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 2616	3148	chrome.exe	78
PID 3148 wrote to memory of 3364	3148	chrome.exe	79
PID 3148 wrote to memory of 3364	3148	chrome.exe	79
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80
PID 3148 wrote to memory of 3804	3148	chrome.exe	80

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/boostrapperx/boostrapper/releases/download/vypix/Boostrapper.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf998cc40,0x7ffaf998cc4c,0x7ffaf998cc58
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1740,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1996,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4804,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4800,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4808,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5184,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5172,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4472,i,3459314187138204705,618740272628444411,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1892
- C:\Users\Admin\Downloads\Boostrapper (1).exe
  "C:\Users\Admin\Downloads\Boostrapper (1).exe"
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Users\Admin\Downloads\Boostrapper (1).exe
    "C:\Users\Admin\Downloads\Boostrapper (1).exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3468
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
      4⤵
      PID:3056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "start bound.exe"
      4⤵
      PID:4008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3504
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:1040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:3352
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:5084

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2552

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4100

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1356

C:\Users\Admin\Downloads\Boostrapper (1).exe
"C:\Users\Admin\Downloads\Boostrapper (1).exe"
1⤵
- Executes dropped EXE
PID:6984
- C:\Users\Admin\Downloads\Boostrapper (1).exe
  "C:\Users\Admin\Downloads\Boostrapper (1).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'"
    3⤵
    PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\bound.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "start bound.exe"
    3⤵
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\bound.exe
      bound.exe
      4⤵
      Executes dropped EXE
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\bound.exe
        
        bound.exe
        5⤵
        Executes dropped EXE
        
        PID:5232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:5328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:5908
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:5428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        6⤵
        
        PID:5956
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        7⤵
        
        PID:5424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "gdb --version"
        6⤵
        
        PID:5972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:5992
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:5432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        6⤵
        
        PID:5548
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        7⤵
        
        PID:5588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:5628
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:5728
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:5636
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:5716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:5792
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:5820
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3148"
        6⤵
        
        PID:5872
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3148
        7⤵
        Kills process with taskkill
        
        PID:456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4392"
        6⤵
        
        PID:6004
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4392
        7⤵
        Kills process with taskkill
        
        PID:6096
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2616"
        6⤵
        
        PID:6124
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2616
        7⤵
        Kills process with taskkill
        
        PID:2848
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3364"
        6⤵
        
        PID:6164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3364
        7⤵
        Kills process with taskkill
        
        PID:6224
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3804"
        6⤵
        
        PID:6280
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3804
        7⤵
        Kills process with taskkill
        
        PID:6324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1068"
        6⤵
        
        PID:6348
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1068
        7⤵
        Kills process with taskkill
        
        PID:6416
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2008"
        6⤵
        
        PID:6444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2008
        7⤵
        Kills process with taskkill
        
        PID:6488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        6⤵
        
        PID:6640
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        7⤵
        
        PID:6816
        
        C:\Windows\system32\chcp.com
        
        chcp
        8⤵
        
        PID:6848
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        6⤵
        
        PID:6660
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        7⤵
        
        PID:2528
        
        C:\Windows\system32\chcp.com
        
        chcp
        8⤵
        
        PID:6872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:6672
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:1440
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        6⤵
        Clipboard Data
        
        PID:6676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        7⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:6828
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:7028
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        6⤵
        Network Service Discovery
        
        PID:7040
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:2416
        
        C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        7⤵
        
        PID:2108
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        7⤵
        Collects information from the system
        
        PID:468
        
        C:\Windows\system32\net.exe
        
        net user
        7⤵
        
        PID:1908
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        8⤵
        
        PID:2064
        
        C:\Windows\system32\query.exe
        
        query user
        7⤵
        
        PID:1852
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        8⤵
        
        PID:1996
        
        C:\Windows\system32\net.exe
        
        net localgroup
        7⤵
        
        PID:3476
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        8⤵
        
        PID:5064
        
        C:\Windows\system32\net.exe
        
        net localgroup administrators
        7⤵
        
        PID:2200
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        8⤵
        
        PID:4648
        
        C:\Windows\system32\net.exe
        
        net user guest
        7⤵
        
        PID:2252
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        8⤵
        
        PID:3736
        
        C:\Windows\system32\net.exe
        
        net user administrator
        7⤵
        
        PID:3172
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        8⤵
        
        PID:4692
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        7⤵
        
        PID:2096
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        7⤵
        Enumerates processes with tasklist
        
        PID:3320
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:4504
        
        C:\Windows\system32\ROUTE.EXE
        
        route print
        7⤵
        
        PID:3384
        
        C:\Windows\system32\ARP.EXE
        
        arp -a
        7⤵
        Network Service Discovery
        
        PID:4460
        
        C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        7⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:5128
        
        C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        7⤵
        Launches sc.exe
        
        PID:3064
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2092
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:1404
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:5132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:5288
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:5364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
5ac29dcdc968041876d1036bfd62a2bd

SHA1
97141260deb2c4c42d107bae22fbdd7ea266afcc

SHA256
d97c4dc38377422730fd17dc52574806ab539e4e6c8b844c04964da1ef6e7972

SHA512
5aecb890961485d0688143648dd5cc591756c2e115e40a2c1ff5ec13955ae3b5988552f6646e42797a16efd7d3152c0b6c8a27a863cfec9fa15c7c1a5538a7c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8891a5bb790d3399ab14991e42270ca3

SHA1
9411d75f9311b83a2f5c43c27219d2bfa5299a96

SHA256
bae08c0740f661fbabfd4a461bfce87fa8e9facb85f11bca8e8e053202e92b9f

SHA512
f5e29b8d510436678650c82a73bba2f88f39c72eaf409ef596f7f589a5ff56a79dd3a9d2cc02811ea0058c90db5edfa743306dd1ce5127068c0550ffe38f3b1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
2285d7e1c95b5bd50977a71c630ad1a3

SHA1
9bd12ff1edd1e464cc24a4a5a8fbddafa14fa060

SHA256
7fc2538cf988f1d8d4c2aabef102845147dd468feff305847634d9e44af783a7

SHA512
233b554fb18d49bb32d23632ecb4c4f9cfc2a46267b7444b0ef97a136754c9c8dcf7ad30083dcb71a970c3f9a0f19b9e835eb13f41a3df09011926b8442a4d24

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
353c84de1044f6d86cff38dcece6648d

SHA1
6a31cd94a4cb56ac4ad2457418b6c693ce3c02db

SHA256
941ecfa47c143f3738bbb629747c60349bb3722b8340ac746cde32f92523523d

SHA512
709355a6c596c417b5f0d2101c1599e5df88670e24d98aa3baa0ff36344f3b8b770310fb735e2abdcdfaa8b68722c397113c52815928db5bf43ba209d9eae409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
2012deec315fd2a9dc50b8aca03b25e6

SHA1
d9dd17459333172c8702203a9e0dd793878cf5a2

SHA256
3b96770f9d55761fea33dafc8925c6aadf8862105a5f800dd8ef03584f116b90

SHA512
7a2963f89b72bccd2ad22a911f833d7fe0dfc63004ab97f2021eeec4f60e567978d947a374b338432186d425b03f2373c78f9b5ba403a6764d4a8d7902396a4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
d316d21dc0b7f89b997a0fb77492f679

SHA1
8baacd39e59d192fba82cc85e3617e3eac833dbb

SHA256
0c5cefa2b129e17cb653d66c78d7c79ec75cbf49250e15821612e81ab032c2a0

SHA512
bad395f192687e7ed21f8e647a43cb6ca26e12ac3d8c63f833e8a9e5950dff9ff824ed51cbb240ebe91c7567ccd0a8156b8e4323e2d8e3d34a4a3f1b4104cf07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
b450013055c3e00ca53da93141086277

SHA1
d68b6d177a6387a7d23f4f846075143de8f3f31d

SHA256
bcbca0087fb7001c92c581b7eee8c9aa9958c742ee0bbdffb80aed43ea60836e

SHA512
8af09c50e9daa7b8ac2e72fa3e5874a25198adedc59d41eef1a2070c3b27ac36100cfc61c62a9c477b04f0a672aa5d2136b065334885f136970b5af2cfd064d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
6b2f6a4034828779ec8a5f5e40409fb5

SHA1
2cb79ce6e2995573e71aaa9f3441d13a92bc1759

SHA256
a3a67c40f6999f7b449a8b2e218b7b6e43233f5d64dd35d2aaf1d69dee72435c

SHA512
dbbf4ad4e0a5e4037e1e15826458bda0a6d475bf26e0d3264b73c8325b99831fa3216e9c098a8dc5f886d524157f6c384476efbdb388047e2f4216fb8023424c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
84d6c7f67477d2d9365f8cd894ca9f43

SHA1
9b1b5b94521758b94c605603d78f6898f891d7c0

SHA256
e4898c1bd0f86436ff9f4175e38448ef676381ad4b96942fd1f0bd612dd18775

SHA512
312293aa84c4758d9432f6f2cf8d6239997d053eb3cd176b731d4b3956feffb9dd35b23a9f9aed36acba72738a0fb00f1bf76e3607baf7064e80d7c8749dad6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
aaae5e6cf02993ad0275049891670f26

SHA1
57ff531a2ad864cda364e157e8adec95782156d0

SHA256
71e91797f4cea552df4940fa14d1ae3700cd96d813b095cbf2169c6489ecc940

SHA512
1b60e7b1afb8b7303bdee21ce8ce6f78a84c0cc5ad95bee1dd4f451d4f0938355f5b025a3c2dc18aa51fc41276e7a14e6ff0305604dd1272044d65a9053a6354

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
77dcbee7119f122fa8596df650d043a2

SHA1
34e400711a2aecbc77c2e3e8823edd37d6b75985

SHA256
04be2302275161389b74816c400ecbbbc3895add2fdf4d36011edca2872625bf

SHA512
f61b3d9cf55572dfd0dfe7217f275f216c42e1b114c640d3851253390c6ed6959f741636a1ea150b9e9c09f1ae2a868316e8d1fa908ed7174759a8a6a9a7d2cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
5687744aa4b486aa6949d041a90b4a95

SHA1
d25c453881560b4d7bc26059b23924b60e6defd4

SHA256
f7c5bfcd3e1628ff0e8abece7bb00ee23ad1944df2714d650fbb5e895f02e0c7

SHA512
2ce65ac90300f4d1b6aa9c9a7ad468323abc7e958c1affb21f0a53aa27df0cc447ef678988dc777940f639c13a550c9c7dbf4b8befdf9bef44a6906470652b1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
228KB

MD5
1a6d46a7aa2d5d83cc8b5eb155d863e8

SHA1
b49f5e88684a80cddf33b7e9dd2e27c82a9e576f

SHA256
9fb9b2cd784e6eca980bec95c06847e5bd5c76f1774bedff17f6d8a047e39883

SHA512
570705555a6abd2f3986374d0075ac4eebe7c4c2d4404f93e0bf839b62ca9faf79fb642aaa16f1e4b1911ee92022fe4c4f0826ac10e95e4c983aef0a42d2888a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\d328be6c-917f-416c-b663-f24845569b18.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupApprove.ps1

Filesize
486KB

MD5
25da249b6bc46b2dc496ad64ee099b88

SHA1
b5005715217f4610bb50b4eec13379797905f426

SHA256
89445433d30a5c72e6c3b1f0c1f2bfecd4819218b2ecb5f50cc61240cc2272fe

SHA512
8f79a1cdc4693b987fe8315ee4f0cb41813fef8052810035fc047ce3412cd475885210af23d9770392df997c4994ea15e5278a03fed62314603a224ffa75f843

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupReset.docx

Filesize
604KB

MD5
046bef2b2075214819fb8fe86330d1de

SHA1
22443346e32a4fa812708b9ffe1ca2f775924759

SHA256
1b5bc35ff8c2d7b098e60cc11196598d9558d7360b72299d6dbad59c453c530f

SHA512
3ed15bbc8f8b5b807fe804a1d309b83815b6ae8b7625ab3f28db3a5ba1bfdefc90499314b1a7ecd8a02912e896e31b519713fc6f33836bfaf3524fd624058793

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConnectResolve.png

Filesize
752KB

MD5
7f7d171dd998118a331c16225d54fd01

SHA1
504f0230fd0309c0a2beeda6b0ab4ed432bf943c

SHA256
0fa2b612f833a3ca30c343e32f40d6b595d3fcb665d1609153c23878c6771ac7

SHA512
94a37fa62b67fee2ad85c1230ef1d6ced54fa6c4960f6337db8265467c6bfab4fedb039b69959e0e130ea116a915fea8fba49e10af5dfdf0ac6785fde710f9e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\WriteGroup.docx

Filesize
12KB

MD5
9a75cdcc1b339a691e13a581b7dac9ce

SHA1
444d6c58e0df8a8169728bd1477ab0c06a4929e5

SHA256
4fa76863929ed4edce872af85b6761a2013d9611abd2d93fc298032ec151d9f7

SHA512
793ac95a0cc1cdd93b9db46bf70ab7091e0e4dd06c940b86706372469addd4e25c9181356c440b26bff976db3a13c2d78b7abaf57cb0793e5f475757e782cf17

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ConvertRequest.docx

Filesize
19KB

MD5
a464e45c5155d76ffa087a0243200db7

SHA1
6406d6bcf5ffe12a7f2ebafe78c3fc06795751a5

SHA256
a97e1417e9b888415b09d96f3ba223fd02737937428a07d99227fb745bd3418c

SHA512
f8326e5492619fb76f30d4201c81bca90410cfe5dd0b316729c1cbccd99757e26df44b560fd8120897e2124f6fa5fdc51a3b2a4988a1096a4d3604db67506676

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ExpandCheckpoint.xlsx

Filesize
11KB

MD5
20c0a4014274445d777152117fbd7283

SHA1
28aa9225eb3584cdfab9a1d9e9d16061189a9200

SHA256
551dd4cd577b32e954f6c8ea2a0c8e64744e77226fc436f5dab8321079e2bd49

SHA512
cd5796e619303a0228d790675a9ec77b6808b950fd699d850ae3a07b49f46de6fd8fdb76a9e62b9378a67ccaf1ab0d45b73248a34801b882f479051624d97afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ExportProtect.pdf

Filesize
871KB

MD5
0cc470c1dcb3ab34b554e3c1184f8b9c

SHA1
1ae54884b4ac53ea57f8181d5e7ebf40435ccc08

SHA256
d030e8c446ecc19d6e5898520086f921015906b54ba79cbff6c93edf2c1ff0c9

SHA512
7d4d4082718836cd5095b86ffe881b88284107e703133a1af02ea16e0c30076511a8f2ce3c1620c1169bf859e293514a539682fc66215d58e1525c7a719151d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MoveDismount.pdf

Filesize
338KB

MD5
cbc784c3ba71423b7953c80cc0c4b613

SHA1
d17619cdd91cd18bac1740b580316490da26ad59

SHA256
2d2ed0557b1e191a092accfa2d17d6b4e0f80071e9368cd0b46187dd36f9a0eb

SHA512
37c5d04c4458beacf98362d15f40ef7fc9338dbdc026cf3aeb5f516e8d8cd261345b3d49dcc14b6c0c0d814bea4a153050d3698f63b3dcbf37169cb0b962fc52

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SplitCheckpoint.docx

Filesize
14KB

MD5
08107ebe18217dc78efa937d8b2edfaf

SHA1
be3555000b0542d5e9765d200ff76fb8c1b21e92

SHA256
a61a98715a99fed0ea89c49934188100be60333129ef777e117aaf04c5bb8658

SHA512
0d84fddc374423131e61fbbeda77d57f657c8f13850f9ba2226657edb4a67b81846e2cdccdc133c3a43b9e5bf221e65aac05418d0f5f167a793b991e2839a01c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\EnableBackup.tif

Filesize
850KB

MD5
557d70166da9ef43b92f05d82bc107af

SHA1
b8ac49883bea562a04a145741f73cdef79a54672

SHA256
cef45059a100c4a014aa3fe3181fbb836bb7e2f41de951a3a1ae2740e3a33f07

SHA512
251adcc9c83a736dc77ab63bf1d617c47cbde594a16a5afc757bb7bdf924c50831381f6407ec449abc1de051e6ad2899d3f0ac9b84147eea3b19f4cb6b4916e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\StartSuspend.doc

Filesize
833KB

MD5
d1435ce6a4b83d9de763643598c574e1

SHA1
2b3d3483e04c768dc6565ed033fac1d1f47ea0f6

SHA256
232fe3a38aa286206a02d3dd0e73c82a78467768c9451f452750ac9e081a7067

SHA512
571bd86b317436230be75fed6e36ffa318badc811ac8b10c530e5fb12e82edf39a1e07400e65f8a60e726f2d183852e4236b15f9dff80cf46098e79e4cca21f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\StopInstall.csv

Filesize
442KB

MD5
cc04b90b1e27ba4f79cbc7024ce108b5

SHA1
fa613a04b7a47cbe2a9bdd6ce94c5eb75b199dea

SHA256
d888bc06ee4437aa6173d62490eac0bf74d2e527635990b050a87e5395bd770d

SHA512
d9b495f3d276d5ae35f9dde2d27fcb85ca528f5856b10350583afae68044addf63bd0850e388d166a86af4307939e4cec41fd8e826941888dc53ab208f93219c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UninstallBackup.dll

Filesize
544KB

MD5
096113483ebd2a3bd6ebb4d24d337317

SHA1
f2e52b7ea3d88d99ddbdedb903f4aa83352d6a03

SHA256
84e5cdebfacaa129dc69cbfd1e54164da19af1e4d9f5882925d96404997e2944

SHA512
a5a249050c9f39f25076eeed86530f5bbb53e53c359ffaa6a7798b991228dbe953eb154cdf601b2aeded24b5bb7a3fc6c845bfcf1f7cc484bc6508b5a96b5528

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ConnectGroup.docx

Filesize
470KB

MD5
66d280ed667ab63ddd9404c19d035046

SHA1
43a90055416902e80b7d65899b541f191dc60b39

SHA256
1148ee191b774e2fa09924c1499438ce6f0692f64a8854babca9c9081a8b5ad5

SHA512
7c4386ae6277201ccd033a4633f69331dd497405976b515576a59d551ec47072781c3fd89687a2c4f0e2a9a320e1ec84684d39b2afe7c68a8cc25807434647e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\JoinConvert.doc

Filesize
287KB

MD5
ee7ca001a51cfb7aacd72c58108b1824

SHA1
73bd57818ab4fe08dd0ebe240bd3ea111d2a2e46

SHA256
93c9882ffc9ab5945a5b7baa662a908687fade23a288f5f02c22caed808148c7

SHA512
4a95899c81a01e7faf0363bdd9167d28d4732bdceea11572c17f83a1dcd27190b1d4fd753901b72161380198dc108da921805be1a8de9f8181abe4e289090240

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\BackupLock.emf

Filesize
548KB

MD5
d4f254eec4026d68d1aa366dc841ac63

SHA1
9c72146d8c38e58cdcbfa5b148e82016bf2df075

SHA256
38448579bd4fc0b4747e1b93ab969155dabea56fdd2e7ce16128a8cbf97421b8

SHA512
7fe5360c56cc6232248103e38e5021c8cdbfaa4416d36acb22164da8943f5d197e45700d6144bdcc3bcdc74d5d8f1c9aa54ac64947000cd9f2c1fa9533ae3587

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\PingSearch.png

Filesize
408KB

MD5
8cb821101dec5948ac58d969c225b646

SHA1
c97e22857dc351aa313a299c187f9b2a663a5a6c

SHA256
3b453e4e74971b71f1c10bacd9f770f594881d3025b8916b8f6d96caaeacedc9

SHA512
efd941e6d10ba111466eb6192de5f0a9848ed3cc21b13e78051152e57d4684af2d928d02e3491bca692da43de69d34e534c3459423efbecbd9f24fa4b7eb1bdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ReceiveSuspend.jpg

Filesize
472KB

MD5
30fe1928a20d8d3d11354a37e9189045

SHA1
31f68106c1bfe92f0b47013b3f64f9002ed8b33f

SHA256
b230412887a6d3408a10134ca321d62849d5363f97e4630da9f11117474bb219

SHA512
b7b6740b7e9bdc1f54c62fa20918605d5dac6c7f39135a4af0ea82668a8fa0604263fd2e93b46fed6029641af4eca0e0882f0621740c8874ee08fc5610556815

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RedoConvertTo.jpg

Filesize
268KB

MD5
5eb2e3cf4e8990a49662b6019c2a04e9

SHA1
fce8e90dcd85fed38a4179ee2ec936801cc7c9fb

SHA256
9f58bd31b65fd65dfc21d5544aeb7ebd3250ae25ce2c4cfae48c6bc967845617

SHA512
8a0608c98ab7754939e598aed7d41e5fb247e6c5e27a08708bf43dd19c502b8b9f02f67af5a9711a3de02afd89e14c35913f0b5abd2b237a3b3096d8cfb42e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RenameStep.png

Filesize
280KB

MD5
9c56928392c726a97e5942af11588856

SHA1
662ac71eda194ea893cd6cfecec7972da427bfe7

SHA256
14ed1794934f79b3188ac3e8d55088dbb9223269952b2ecb19b402c196639057

SHA512
c5d1dd1b3ceb323634a6f0d0f84a868f467a6b083de3ed2bf9c2abd3e04f089950524ee95e73d9c655cbf4470e534dc391749aa77229d439ae74aef36fd951cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ResumeRestore.jpeg

Filesize
370KB

MD5
c1d4f341527a14ce3f73849195b1bc8f

SHA1
33db5dca73be603a1f6a2486a950c27becdfdff4

SHA256
b2fdcb44b2f5d40c244056685cf57dcacba5311a760d2614ce72bf6786a30ee3

SHA512
eec9b73ed00b0d7ce1972b440f8a3f656c553798a4560cb2bb1c0ffc0c20c5381c26cd8df2c8a8eb9e238934e0dbb764e6da6b64af18ac87b80768d54e7a2d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SplitInstall.png

Filesize
536KB

MD5
d9d4873cb1e453ab4bdf080209dcffc8

SHA1
4b43345d3176f6fc212845fccdcbac65f539211c

SHA256
8c7942afdfbfab8e3f775d0859a63ab81b4b30e91a68d9820e324ad538f11f89

SHA512
dae8661dec58e87972ee8fe832342652aaec1f788cd043cec0b2d4d801b7f91d24fe402947d94673e1c68234054fa3b299a604e4f8058f35b653ece3c4f00bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\VCRUNTIME140_1.dll

Filesize
37KB

MD5
75e78e4bf561031d39f86143753400ff

SHA1
324c2a99e39f8992459495182677e91656a05206

SHA256
1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

SHA512
ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_asyncio.pyd

Filesize
34KB

MD5
936e44a303a5957709434a0c6bf4532e

SHA1
e35f0b78f61797d9277741a1ee577b5fe7af3d62

SHA256
11f1062fafb4fbca92e3b2cef97ab66ec011142f5b0312e74815decd93be458b

SHA512
cebe905b718825c1841e9c0e83dfdac95d0ff50b116ab3b91b05ca21f86f1482f5b1e13988c969244c644d17bd378792ac4967caa721f0b0e858cd92859af154

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_bz2.pyd

Filesize
46KB

MD5
af3d45698d379c97a90cca9625bc5926

SHA1
0783866af330c1029253859574c369901969208e

SHA256
47af0730824f96865b5e20f8bba34b0d5f3a330087411adba71269312bf7ccec

SHA512
117e95d2ba0432f5ece882ad67a3fbf2e2cd251b4327a0d66b3fffd444e2d1813ddb568321bde1636b4180d19607db6103df145153e4ff84e9be601fd2dd5691

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_cffi_backend.cp311-win_amd64.pyd

Filesize
71KB

MD5
f5a0e3f73ad4002839a85ec9b5285cc0

SHA1
2657e49964491d8b0784ab6ae157c767cf809673

SHA256
34dff4546abf4cd9d1e605f215339e6816c3aa4ef3c6028afcf00cb6241dbccf

SHA512
81d683f45b6ea1b48d0e377779c9b87ddff5b8549f00ae375ebe617fbd00d0149639a2b5c1b42ea536bde786aea50025646311b3de243c48ed192014dcc9974b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_ctypes.pyd

Filesize
57KB

MD5
2346cf6a1ad336f3ee23c4ec3ff7871c

SHA1
e36b759c0b78d2def431aa11bcbb7d7cf02f1eea

SHA256
490a11d03dd3aeb05a410eb0d285e3da788e73b643ea9914fffd5a2c102dc1df

SHA512
7a92de4937b23952e2a31bb09a58b2ad81c06da23704e4b4f964eb42948adad1a1e57920c021283da1b7154e7ac19e46031ffee6b69a73acbc85d95ef45bf8ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_decimal.pyd

Filesize
104KB

MD5
9b801838394e97e30c99dcf5f9fcc8fa

SHA1
33fb049b2f98bcb2f2cb9508be2408a6698243be

SHA256
15668e03f9c55f07184ec9c048a8569f7d7ebd9ea6dbef145f1f3b581f8623f3

SHA512
5f074c82f344ca43a07a59132fab59e3504e314a2f7673bfec906782b947daf8fe45a1b956f72502eae72f01369a3bb1fbb73b10dc605d43b889a6700bd98a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_hashlib.pyd

Filesize
33KB

MD5
7fd141630dfa2500f5bf4c61e2c2d034

SHA1
0f8d1dfae2cbce1ad714c93216f01bf7001aabda

SHA256
689f0ac1d44481688cd4ae90b6f801176a52ff4bb4170c62575ea58f44452e15

SHA512
c6b7b1aefb7280f38d63f4ab84a349ebb696ca7300b7a451e7a994baff7e0a83fb4488c43ed3160b94dec74e0d27417d68913056b3006c8c6da11e39681f512e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_lzma.pyd

Filesize
84KB

MD5
ab6a735ad62592c7c8ea0b06cb57317a

SHA1
e27a0506800b5bbc2b350e39899d260164af2cd1

SHA256
0ebdf15c1c6d59e49716dfb4601f0abe6383449c70db1a349c6ad486742144a8

SHA512
9a285593cd8cc29844688723d8907e55a9f8a3109f9538cc4140912cc973f495de32779a4cd4a48dc62d680fdf81a5797e4e9c33f236a803082dfc3c00d02060

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_multiprocessing.pyd

Filesize
25KB

MD5
241a977372d63b46b6ae4f7227579cc3

SHA1
21c8fa02217ec69c5cc9a1cc9edaa5de6f8d9f91

SHA256
04e56f1c6919f2987f205e9e3afa16d945eeaffa415c746104ccb7763c067f9c

SHA512
7aeaa94a5cd46d604370e430c72724b683e149af7e032c85708e33bfb94fb6a9ccc52c70bc701dfb94b4ae55d4e8acd8e394efb6cd81466fd9fa1a6addaa4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_overlapped.pyd

Filesize
30KB

MD5
ef52dc3e7d12795745e23487026a5b5e

SHA1
6c9f488a9eaabdc6db11ed2c32231d518a8b8f42

SHA256
b1b56328df4b19cf04586303f693979536253078fc7017b4ac4ae6d730296b1f

SHA512
8b3c311bf4a54eaa21fa1db058037b274bd3b9e838e844537269f8e0102ad47ca7181e73bbb4f5269100cfe82499bb0787bc04943b02e36ea0ab26bfa8e65326

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_queue.pyd

Filesize
24KB

MD5
71955beaf83aca364ed64285021781ca

SHA1
cac93d08f9085079fb32e6fc6d8e4fc8cd9115e6

SHA256
3df280391d7275e73aef70af228bb21c03434147ae9fe31e8c620ea151e08b30

SHA512
9b055a0273ace0f9b673e015a20c8867689090608fffaf85c54636f061cf595de1e6c9bfc2d8ea75fa4dd247b4af0493022f24d6a931b53e7f60009a85b45601

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_socket.pyd

Filesize
41KB

MD5
53dc1aa457a1e3b4f6c8baed19a6ca0a

SHA1
290a572e981cc5ce896dc52a53f112d9eaaefc39

SHA256
26200892f616f859e82c167701ab866b8291eabbe808dd18c434cc80ebeedf19

SHA512
460de92115288e0e95fd03837df775e5f34425784c18ab7e9ad0885511166371647a6f06d95ffa6c3437de69895d46cd4cddcda2841ccdb5ef268b1a857837e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_sqlite3.pyd

Filesize
54KB

MD5
1c5e0718dce15682d32185f1e1f8df7d

SHA1
f59662db717663ed1589328c5749bb8b44a0d053

SHA256
56f74ec6490b916c513b618635edaa22cb2374a92e5f79549c1e2b7c5c37f31d

SHA512
702f8348d2fe08ec10e0120129e64c12368c971ea52852cd0c7d26fd159f5b34bc808b9b318168aaa81366ed4944909e305d4e9727f0374d921eddb54ea22cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_ssl.pyd

Filesize
60KB

MD5
df5a6f6c547300a7c87005eb0fafcfa0

SHA1
c792342e964a1c8a776e5203f3eee7908e6cad09

SHA256
dea09b9750c26813130ca32db0b4455796e12a3d61bb52066d5a53302bcce0ce

SHA512
018a79871faa2cf6a1644e96f10750ddccccd56436720faf760808b1997940f9bcd2866a4533b903058ab608629ff8ed46fadb788e4a6714b19775d557dd69b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\_uuid.pyd

Filesize
21KB

MD5
cf378e1866edaa02db65a838f0e0ad8e

SHA1
cc66b98b3289a126fa4cf960d89cbbecff0f5aa8

SHA256
caabfac7123e70906fafe3a34d11c0c87c62695b2716a5f95b032bb54982744e

SHA512
cdb6fb5861fee4eeee49dd79ba164ef8538235b0b41e505dd59f1b5a79256390a4bb920ade9ff58abdc41c738ec6f316d387df4f588b673d8f324e5c1c32a9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\base_library.zip

Filesize
1.4MB

MD5
481da210e644d6b317cafb5ddf09e1a5

SHA1
00fe8e1656e065d5cf897986c12ffb683f3a2422

SHA256
3242ea7a6c4c712f10108a619bf5213878146547838f7e2c1e80d2778eb0aaa0

SHA512
74d177794f0d7e67f64a4f0c9da4c3fd25a4d90eb909e942e42e5651cc1930b8a99eef6d40107aa8756e75ffbcc93284b916862e24262df897aaac97c5072210

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\bound.luna

Filesize
10.7MB

MD5
bff8b4f5118e5524b5ecc0cce19d24e9

SHA1
38a81c04830693a8de0e08e228a6e133aa453353

SHA256
8282da48dd04b9a4c3d0eba4293eaf098ebe1bd2b53315afd82bb7f146bce0e5

SHA512
c30221e41319d222fc9830e3f7c96327ebbb9e674b64b4d241bcd8a11821b20a91fc33044027c7704f2899efc770d807a0c1d765741a371ed315b72a3248f4a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\libcrypto-1_1.dll

Filesize
1.1MB

MD5
571796599d616a0d12aa34be09242c22

SHA1
0e0004ab828966f0c8a67b2f10311bb89b6b74ac

SHA256
6242d2e13aef871c4b8cfd75fc0f8530e8dccfeaba8f1b66280e9345f52b833b

SHA512
7362a6c887600fafc1a45413823f006589bb95a76ac052b6c7022356a7a9a6e8cd3e76f59cecf152e189323791d9626a6fdb7a98bf3a5250d517b746c3e84e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\libffi-8.dll

Filesize
24KB

MD5
24ea21ebcc3bef497d2bd208e7986f88

SHA1
d936f79431517b9687ee54d837e9e4be7afc082d

SHA256
18c097ef19f3e502a025c1d63cfec73a4fa30c5482286f4000d40d4784a0070a

SHA512
1bdbeddd812ecc2cdfbbf3498b0a8ef551cc18ce73fc30eb40b415fab0cdd20b80057a25a33ca2f9247b08978838df3587a3caf6e1a8e108c5a9a4f67dd75a94

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\libssl-1_1.dll

Filesize
203KB

MD5
aabafc5d0e409123ae5e4523d9b3dee2

SHA1
4d0a1834ed4e4ceecb04206e203d916eb22e981b

SHA256
84e4c37fb28b6cf79e2386163fe6bb094a50c1e8825a4bcdb4cb216f4236d831

SHA512
163f29ad05e830367af3f2107e460a587f4710b8d9d909a01e04cd8cfee115d8f453515e089a727a6466ce0e2248a56f14815588f7df6d42fe1580e1b25369cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\luna.aes

Filesize
339KB

MD5
62a8e162c785dfd28f5042b0ccce6288

SHA1
b2b016e98fc4f35f54706029bd68478f6592778d

SHA256
b689f2890ac05dcaa83a99b61a1629f70f71b358503611b56cc7576a0531636c

SHA512
9a4fcdc84889a0d945cefaa21fd7cf92c2f4497a4925fa58f0dc5a662cf01df85b7c1de061d50f2a744aa516848905356904c0a85458ee9d90739337d7f7aed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\pyexpat.pyd

Filesize
86KB

MD5
c498ed10d7245560412f9df527508b5c

SHA1
b84b57a54a1a9c5631f4d0b8ac31694786cc822b

SHA256
297ec9e654500400ba5731101b65d29c14d0305ae9f6c05b9763f57ab150b07d

SHA512
ab8bcf6e4a395944316e19aa7aa598e8bfeaa038f4ae086fcede6d01747b670896d640dbf4992630fcbd737d2be3ab627b7be8ad36437629671387f4aaf85957

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\python3.DLL

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\python311.dll

Filesize
1.6MB

MD5
4fcf14c7837f8b127156b8a558db0bb2

SHA1
8de2711d00bef7b5f2dcf8a2c6871fa1db67cf1f

SHA256
a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc

SHA512
7a6195495b48f66c35b273a2c9d7ff59e96a4180ea8503f31c8b131167c6cdddd8d6fe77388a34096964a73c85eab504281a14ae3d05350cfee5c51d2491cec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\pywin32_system32\pythoncom311.dll

Filesize
193KB

MD5
5f3cf50b9a64926d61b0d412aeb546d6

SHA1
d48999624f209b9686a28a3d496cb35d9fd3cb99

SHA256
69c3b2aba4aca22769da98e3537e8f9a4b0a70eb615ce8eda4ad36db0b4a405b

SHA512
72260c8cbf63f1966839131197cfe883f53bef0d0e7b4d88af6d83e692bf905ff8aeb3ce59b68b812ffa39d391e313a4c5207dcbe006336f1ecc521a504c5574

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\pywin32_system32\pywintypes311.dll

Filesize
61KB

MD5
0e135c015c65ae810e322e1bf4544de5

SHA1
3677ed38075fa822ed5168f7e3b5fb39a169e09e

SHA256
74ee310dae35927923793bae12acf415337b0e966e2f458603f320e830978e83

SHA512
c15b83f6dbe89d927e5ca1b7694c54c21258587cf4b0f7b25074a3fbc15b4fbb47734057a21914f03afada3386d7632e2cd229fb74fff6dea400a3dc83d1ca8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\select.pyd

Filesize
24KB

MD5
0dc8f694b3e6a3682b3ff098bd2468f6

SHA1
737252620116c6ac5c527f99d3914e608a0e5a74

SHA256
818120c08358b6b4d1234b7456c7b5c777af8473e26314a6a6c0f37237d53208

SHA512
d0e704d52b0c5e24c07447a60d71ccec490ec15ecb6b4532b2e93ac07036bda7f27051f80dac1ef3705b0186f35f9d6dfc05415412e483b68fd79f1098411123

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\sqlite3.dll

Filesize
608KB

MD5
605b722497acc50ffb33ebdb6afaf1f0

SHA1
e24c55472c827d4b519e5b6f0a3cfc49e10d1fa9

SHA256
a61016520a3f228285e32e40d878fe449450136c55aa9d4d7b54006a8dc7f339

SHA512
9611afc66cd1236cea1fce94e8ecf8e4d2168db3b51d8d9a799b574e8523ca0aea48da6b6c15fc863dd737b9c394ac6e56d2f3fa45e29792b630da389cb21dc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\unicodedata.pyd

Filesize
293KB

MD5
2b1809546e4bc9d67ea69d24f75edce0

SHA1
9d076445dfa2f58964a6a1fd1844f6fe82645952

SHA256
89cbb2814a75a5bd53acbfb1fe090ca8395c4a7f559acd4fe0187758c172623a

SHA512
5ae015add4697e8290eb881fa770bca2fa22ba8376b86b26f7880d4f92ad362e741042926a4c47cc3413c83f445e372ffda915bcf8567673d807bd2dac28fbbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI45402\win32\win32api.pyd

Filesize
47KB

MD5
9b6c6a8714560ed3d6094f561965e891

SHA1
bf6ed0eebe9cbbcdf640498934f8285879acbf48

SHA256
b0caf6f7840db0611bef53c201e896a27ff7a4b19121c46d15b00cc894a33883

SHA512
5d72b476afd6ec15459637b280407a1fbff2060d16405c722d776f8f8b83b9aa495f1aafa2dc012b6589a99176697e9ea9d8a3534a0da054186b85b31d0273a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI69842\cryptography-43.0.1.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1uxne4kf.yud.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Boostrapper (1).exe

Filesize
45.2MB

MD5
b6bf72ac4dc7a822b45d85bda7a524d1

SHA1
421edd76c1e23d1eba3d53c87f957d763d1f3881

SHA256
7f2c783712a842a921edf6b5ec91cc4e8f50734efd7c85aae3170fde10f87904

SHA512
634892bdb97d092c76330f1ebc356d289447276c642149270c2f3b3a81dc5218a645d106e8c3816ede9fe6a1f7fd0267cde122cfdbfa59f3412ab5b9cdaaa100

Download Submit
C:\Users\Admin\Downloads\Boostrapper (1).exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3468-975-0x00007FFAE3070000-0x00007FFAE3093000-memory.dmp

Filesize
140KB

Download
memory/3468-1028-0x00007FFAE2EF0000-0x00007FFAE3063000-memory.dmp

Filesize
1.4MB

Download
memory/3468-951-0x00007FFAE3630000-0x00007FFAE365E000-memory.dmp

Filesize
184KB

Download
memory/3468-953-0x00007FFAE2EF0000-0x00007FFAE3063000-memory.dmp

Filesize
1.4MB

Download
memory/3468-952-0x00007FFAE3570000-0x00007FFAE3628000-memory.dmp

Filesize
736KB

Download
memory/3468-955-0x00007FFAE2EB0000-0x00007FFAE2EE7000-memory.dmp

Filesize
220KB

Download
memory/3468-954-0x000001F94FEE0000-0x000001F950255000-memory.dmp

Filesize
3.5MB

Download
memory/3468-968-0x00007FFAE2E70000-0x00007FFAE2E7B000-memory.dmp

Filesize
44KB

Download
memory/3468-967-0x00007FFAE2E80000-0x00007FFAE2E8C000-memory.dmp

Filesize
48KB

Download
memory/3468-966-0x00007FFAE2E90000-0x00007FFAE2E9E000-memory.dmp

Filesize
56KB

Download
memory/3468-965-0x00007FFAE2EA0000-0x00007FFAE2EAD000-memory.dmp

Filesize
52KB

Download
memory/3468-964-0x00007FFAE3160000-0x00007FFAE31E7000-memory.dmp

Filesize
540KB

Download
memory/3468-963-0x00007FFAF64E0000-0x00007FFAF64EB000-memory.dmp

Filesize
44KB

Download
memory/3468-962-0x00007FFAEDF00000-0x00007FFAEDF0C000-memory.dmp

Filesize
48KB

Download
memory/3468-961-0x00007FFAEF1B0000-0x00007FFAEF1BB000-memory.dmp

Filesize
44KB

Download
memory/3468-960-0x00007FFAF2440000-0x00007FFAF244C000-memory.dmp

Filesize
48KB

Download
memory/3468-959-0x00007FFAF4CC0000-0x00007FFAF4CCB000-memory.dmp

Filesize
44KB

Download
memory/3468-958-0x00007FFAF4FF0000-0x00007FFAF4FFC000-memory.dmp

Filesize
48KB

Download
memory/3468-957-0x00007FFAF7D60000-0x00007FFAF7D6B000-memory.dmp

Filesize
44KB

Download
memory/3468-956-0x00007FFAE31F0000-0x00007FFAE3565000-memory.dmp

Filesize
3.5MB

Download
memory/3468-971-0x00007FFAE2E50000-0x00007FFAE2E5C000-memory.dmp

Filesize
48KB

Download
memory/3468-970-0x00007FFAE30F0000-0x00007FFAE3108000-memory.dmp

Filesize
96KB

Download
memory/3468-969-0x00007FFAE2E60000-0x00007FFAE2E6B000-memory.dmp

Filesize
44KB

Download
memory/3468-976-0x00007FFAE2E00000-0x00007FFAE2E0C000-memory.dmp

Filesize
48KB

Download
memory/3468-948-0x00007FFAF8AC0000-0x00007FFAF8ACA000-memory.dmp

Filesize
40KB

Download
memory/3468-974-0x00007FFAE2E10000-0x00007FFAE2E22000-memory.dmp

Filesize
72KB

Download
memory/3468-973-0x00007FFAE2E30000-0x00007FFAE2E3D000-memory.dmp

Filesize
52KB

Download
memory/3468-972-0x00007FFAE2E40000-0x00007FFAE2E4B000-memory.dmp

Filesize
44KB

Download
memory/3468-977-0x00007FFAE2EF0000-0x00007FFAE3063000-memory.dmp

Filesize
1.4MB

Download
memory/3468-982-0x00007FFAE2970000-0x00007FFAE2D92000-memory.dmp

Filesize
4.1MB

Download
memory/3468-981-0x00007FFAE2DA0000-0x00007FFAE2DBC000-memory.dmp

Filesize
112KB

Download
memory/3468-980-0x00007FFAE2DC0000-0x00007FFAE2DCB000-memory.dmp

Filesize
44KB

Download
memory/3468-979-0x00007FFAE2EB0000-0x00007FFAE2EE7000-memory.dmp

Filesize
220KB

Download
memory/3468-978-0x00007FFAE2DD0000-0x00007FFAE2DF7000-memory.dmp

Filesize
156KB

Download
memory/3468-983-0x00007FFAE15C0000-0x00007FFAE2967000-memory.dmp

Filesize
19.7MB

Download
memory/3468-984-0x00007FFAE13B0000-0x00007FFAE13D2000-memory.dmp

Filesize
136KB

Download
memory/3468-985-0x00007FFAE0840000-0x00007FFAE0A88000-memory.dmp

Filesize
2.3MB

Download
memory/3468-988-0x00007FFAE2E70000-0x00007FFAE2E7B000-memory.dmp

Filesize
44KB

Download
memory/3468-1001-0x00007FFAE3A90000-0x00007FFAE3BAC000-memory.dmp

Filesize
1.1MB

Download
memory/3468-1016-0x00007FFAF4FF0000-0x00007FFAF4FFC000-memory.dmp

Filesize
48KB

Download
memory/3468-1038-0x00007FFAE2E70000-0x00007FFAE2E7B000-memory.dmp

Filesize
44KB

Download
memory/3468-1046-0x00007FFAE2DA0000-0x00007FFAE2DBC000-memory.dmp

Filesize
112KB

Download
memory/3468-1045-0x00007FFAE2DC0000-0x00007FFAE2DCB000-memory.dmp

Filesize
44KB

Download
memory/3468-1044-0x00007FFAE2DD0000-0x00007FFAE2DF7000-memory.dmp

Filesize
156KB

Download
memory/3468-1043-0x00007FFAE2E30000-0x00007FFAE2E3D000-memory.dmp

Filesize
52KB

Download
memory/3468-1042-0x00007FFAE2E00000-0x00007FFAE2E0C000-memory.dmp

Filesize
48KB

Download
memory/3468-1041-0x00007FFAE2E40000-0x00007FFAE2E4B000-memory.dmp

Filesize
44KB

Download
memory/3468-1040-0x00007FFAE2E50000-0x00007FFAE2E5C000-memory.dmp

Filesize
48KB

Download
memory/3468-1039-0x00007FFAE2E60000-0x00007FFAE2E6B000-memory.dmp

Filesize
44KB

Download
memory/3468-1047-0x00007FFAE2970000-0x00007FFAE2D92000-memory.dmp

Filesize
4.1MB

Download
memory/3468-1037-0x00007FFAE3110000-0x00007FFAE3136000-memory.dmp

Filesize
152KB

Download
memory/3468-1036-0x00007FFAE31F0000-0x00007FFAE3565000-memory.dmp

Filesize
3.5MB

Download
memory/3468-1049-0x00007FFAE13B0000-0x00007FFAE13D2000-memory.dmp

Filesize
136KB

Download
memory/3468-1048-0x00007FFAE15C0000-0x00007FFAE2967000-memory.dmp

Filesize
19.7MB

Download
memory/3468-1035-0x00007FFAEDF00000-0x00007FFAEDF0C000-memory.dmp

Filesize
48KB

Download
memory/3468-1034-0x00007FFAEF1B0000-0x00007FFAEF1BB000-memory.dmp

Filesize
44KB

Download
memory/3468-1033-0x00007FFAF2440000-0x00007FFAF244C000-memory.dmp

Filesize
48KB

Download
memory/3468-1032-0x00007FFAF4CC0000-0x00007FFAF4CCB000-memory.dmp

Filesize
44KB

Download
memory/3468-1031-0x00007FFAE2E90000-0x00007FFAE2E9E000-memory.dmp

Filesize
56KB

Download
memory/3468-1030-0x00007FFAF7D60000-0x00007FFAF7D6B000-memory.dmp

Filesize
44KB

Download
memory/3468-1029-0x00007FFAE2EB0000-0x00007FFAE2EE7000-memory.dmp

Filesize
220KB

Download
memory/3468-950-0x00007FFAE3070000-0x00007FFAE3093000-memory.dmp

Filesize
140KB

Download
memory/3468-1027-0x00007FFAE3070000-0x00007FFAE3093000-memory.dmp

Filesize
140KB

Download
memory/3468-1026-0x00007FFAE30F0000-0x00007FFAE3108000-memory.dmp

Filesize
96KB

Download
memory/3468-1025-0x00007FFAF8AC0000-0x00007FFAF8ACA000-memory.dmp

Filesize
40KB

Download
memory/3468-1024-0x00007FFAE2EA0000-0x00007FFAE2EAD000-memory.dmp

Filesize
52KB

Download
memory/3468-1023-0x00007FFAF8C20000-0x00007FFAF8C2B000-memory.dmp

Filesize
44KB

Download
memory/3468-1022-0x00007FFAE3140000-0x00007FFAE3154000-memory.dmp

Filesize
80KB

Download
memory/3468-1021-0x00007FFAE2E80000-0x00007FFAE2E8C000-memory.dmp

Filesize
48KB

Download
memory/3468-1020-0x00007FFAE3570000-0x00007FFAE3628000-memory.dmp

Filesize
736KB

Download
memory/3468-1019-0x00007FFAE2E10000-0x00007FFAE2E22000-memory.dmp

Filesize
72KB

Download
memory/3468-1018-0x00007FFAE3630000-0x00007FFAE365E000-memory.dmp

Filesize
184KB

Download
memory/3468-1015-0x00007FFAF64E0000-0x00007FFAF64EB000-memory.dmp

Filesize
44KB

Download
memory/3468-1005-0x00007FFAE3160000-0x00007FFAE31E7000-memory.dmp

Filesize
540KB

Download
memory/3468-1000-0x00007FFAE3E60000-0x00007FFAE3E8A000-memory.dmp

Filesize
168KB

Download
memory/3468-999-0x00007FFAE3E90000-0x00007FFAE3F4B000-memory.dmp

Filesize
748KB

Download
memory/3468-998-0x00007FFAE3F50000-0x00007FFAE3F7D000-memory.dmp

Filesize
180KB

Download
memory/3468-997-0x00007FFAF9B10000-0x00007FFAF9B1D000-memory.dmp

Filesize
52KB

Download
memory/3468-996-0x00007FFAF9CC0000-0x00007FFAF9CCD000-memory.dmp

Filesize
52KB

Download
memory/3468-995-0x00007FFAEDEA0000-0x00007FFAEDEB9000-memory.dmp

Filesize
100KB

Download
memory/3468-994-0x00007FFAF4CD0000-0x00007FFAF4D05000-memory.dmp

Filesize
212KB

Download
memory/3468-993-0x00007FFAF5000000-0x00007FFAF502D000-memory.dmp

Filesize
180KB

Download
memory/3468-992-0x00007FFAF64F0000-0x00007FFAF6509000-memory.dmp

Filesize
100KB

Download
memory/3468-991-0x00007FFAFC8E0000-0x00007FFAFC8EF000-memory.dmp

Filesize
60KB

Download
memory/3468-990-0x00007FFAF8C90000-0x00007FFAF8CB4000-memory.dmp

Filesize
144KB

Download
memory/3468-989-0x00007FFAE3F80000-0x00007FFAE4568000-memory.dmp

Filesize
5.9MB

Download
memory/3468-949-0x00007FFAE30F0000-0x00007FFAE3108000-memory.dmp

Filesize
96KB

Download
memory/3468-944-0x00007FFAE3F50000-0x00007FFAE3F7D000-memory.dmp

Filesize
180KB

Download
memory/3468-868-0x00007FFAE3F80000-0x00007FFAE4568000-memory.dmp

Filesize
5.9MB

Download
memory/3468-878-0x00007FFAFC8E0000-0x00007FFAFC8EF000-memory.dmp

Filesize
60KB

Download
memory/3468-876-0x00007FFAF8C90000-0x00007FFAF8CB4000-memory.dmp

Filesize
144KB

Download
memory/3468-901-0x00007FFAF5000000-0x00007FFAF502D000-memory.dmp

Filesize
180KB

Download
memory/3468-890-0x00007FFAF64F0000-0x00007FFAF6509000-memory.dmp

Filesize
100KB

Download
memory/3468-922-0x00007FFAF9B10000-0x00007FFAF9B1D000-memory.dmp

Filesize
52KB

Download
memory/3468-924-0x00007FFAE3F50000-0x00007FFAE3F7D000-memory.dmp

Filesize
180KB

Download
memory/3468-921-0x00007FFAF9CC0000-0x00007FFAF9CCD000-memory.dmp

Filesize
52KB

Download
memory/3468-920-0x00007FFAEDEA0000-0x00007FFAEDEB9000-memory.dmp

Filesize
100KB

Download
memory/3468-919-0x00007FFAF4CD0000-0x00007FFAF4D05000-memory.dmp

Filesize
212KB

Download
memory/3468-928-0x00007FFAE3E90000-0x00007FFAE3F4B000-memory.dmp

Filesize
748KB

Download
memory/3468-931-0x00007FFAE3E60000-0x00007FFAE3E8A000-memory.dmp

Filesize
168KB

Download
memory/3468-945-0x00007FFAF8C20000-0x00007FFAF8C2B000-memory.dmp

Filesize
44KB

Download
memory/3468-946-0x00007FFAE3110000-0x00007FFAE3136000-memory.dmp

Filesize
152KB

Download
memory/3468-947-0x00007FFAE3E90000-0x00007FFAE3F4B000-memory.dmp

Filesize
748KB

Download
memory/3468-943-0x00007FFAE3140000-0x00007FFAE3154000-memory.dmp

Filesize
80KB

Download
memory/3468-942-0x00007FFAE3160000-0x00007FFAE31E7000-memory.dmp

Filesize
540KB

Download
memory/3468-939-0x00007FFAE3570000-0x00007FFAE3628000-memory.dmp

Filesize
736KB

Download
memory/3468-941-0x00007FFAE31F0000-0x00007FFAE3565000-memory.dmp

Filesize
3.5MB

Download
memory/3468-940-0x000001F94FEE0000-0x000001F950255000-memory.dmp

Filesize
3.5MB

Download
memory/3468-937-0x00007FFAE3630000-0x00007FFAE365E000-memory.dmp

Filesize
184KB

Download
memory/3468-935-0x00007FFAF8C90000-0x00007FFAF8CB4000-memory.dmp

Filesize
144KB

Download
memory/3468-934-0x00007FFAE3A90000-0x00007FFAE3BAC000-memory.dmp

Filesize
1.1MB

Download
memory/3468-933-0x00007FFAE3F80000-0x00007FFAE4568000-memory.dmp

Filesize
5.9MB

Download
memory/7080-2532-0x00007FFAE3EC0000-0x00007FFAE3F7B000-memory.dmp

Filesize
748KB

Download
memory/7080-2537-0x00007FFAE3220000-0x00007FFAE3595000-memory.dmp

Filesize
3.5MB

Download
memory/7080-2539-0x00007FFAF8D80000-0x00007FFAF8D94000-memory.dmp

Filesize
80KB

Download
memory/7080-2542-0x00007FFAF8D60000-0x00007FFAF8D6A000-memory.dmp

Filesize
40KB

Download
memory/7080-2543-0x00007FFAF8C90000-0x00007FFAF8CA8000-memory.dmp

Filesize
96KB

Download
memory/7080-2544-0x00007FFAF8B10000-0x00007FFAF8B33000-memory.dmp

Filesize
140KB

Download
memory/7080-2545-0x00007FFAE3010000-0x00007FFAE3183000-memory.dmp

Filesize
1.4MB

Download
memory/7080-2547-0x00007FFAF8C20000-0x00007FFAF8C2B000-memory.dmp

Filesize
44KB

Download
memory/7080-2549-0x00007FFAF8AD0000-0x00007FFAF8ADC000-memory.dmp

Filesize
48KB

Download
memory/7080-2546-0x00007FFAF4FF0000-0x00007FFAF5027000-memory.dmp

Filesize
220KB

Download
memory/7080-2534-0x00007FFAE3A90000-0x00007FFAE3BAC000-memory.dmp

Filesize
1.1MB

Download
memory/7080-2538-0x00007FFAE3190000-0x00007FFAE3217000-memory.dmp

Filesize
540KB

Download