Malware Analysis Report

2025-03-15 03:42

Sample ID 241028-yk52pswblb
Target xero.exe.bin
SHA256 48033a75dbddda6de878f156a02550e5769225b36a4ebb8af70b60c1e2f0044b
Tags
exelastealer collection defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

48033a75dbddda6de878f156a02550e5769225b36a4ebb8af70b60c1e2f0044b

Threat Level: Known bad

The file xero.exe.bin was found to be: Known bad.

Malicious Activity Summary

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Exela Stealer

Exelastealer family

Grants admin privileges

Modifies Windows Firewall

Reads user/profile data of web browsers

Clipboard Data

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Network Service Discovery

Enumerates processes with tasklist

UPX packed file

Hide Artifacts: Hidden Files and Directories

Launches sc.exe

System Network Connections Discovery

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Unsigned PE

Permission Groups Discovery: Local Groups

Detects Pyinstaller

System Network Configuration Discovery: Wi-Fi Discovery

Suspicious use of WriteProcessMemory

Collects information from the system

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Gathers network information

Runs net.exe

Views/modifies file attributes

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-28 19:51

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-28 19:51

Reported

2024-10-28 19:54

Platform

win10v2004-20241007-en

Max time kernel

135s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\xero.exe"

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe" C:\Windows\system32\reg.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4916 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Users\Admin\AppData\Local\Temp\xero.exe
PID 4916 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Users\Admin\AppData\Local\Temp\xero.exe
PID 3836 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 1152 wrote to memory of 1488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1152 wrote to memory of 1488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4056 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4056 wrote to memory of 2824 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3836 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 2616 wrote to memory of 3428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2616 wrote to memory of 3428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3836 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 428 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 428 wrote to memory of 1524 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3836 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 4844 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4844 wrote to memory of 232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3836 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3484 wrote to memory of 3656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3484 wrote to memory of 3656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1832 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1832 wrote to memory of 4432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 3472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2040 wrote to memory of 3472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 336 wrote to memory of 1104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 336 wrote to memory of 1104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3472 wrote to memory of 2144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3472 wrote to memory of 2144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4432 wrote to memory of 4952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4432 wrote to memory of 4952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3836 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 3836 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Windows\system32\cmd.exe
PID 652 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 652 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2700 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2700 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 652 wrote to memory of 4720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 652 wrote to memory of 4720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 652 wrote to memory of 3028 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 652 wrote to memory of 3028 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 652 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 652 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 1896 wrote to memory of 1488 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1896 wrote to memory of 1488 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 652 wrote to memory of 2944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\query.exe
PID 652 wrote to memory of 2944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\query.exe
PID 2944 wrote to memory of 3892 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe
PID 2944 wrote to memory of 3892 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\xero.exe

"C:\Users\Admin\AppData\Local\Temp\xero.exe"

C:\Users\Admin\AppData\Local\Temp\xero.exe

"C:\Users\Admin\AppData\Local\Temp\xero.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"

C:\Windows\system32\reg.exe

reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
N/A 127.0.0.1:52133 tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
N/A 127.0.0.1:52145 tcp
N/A 127.0.0.1:52151 tcp
N/A 127.0.0.1:52153 tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 162.159.135.232:443 discord.com tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
N/A 127.0.0.1:52332 tcp
N/A 127.0.0.1:52334 tcp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI49162\python310.dll

MD5 fc7bd515b12e537a39dc93a09b3eaad6
SHA1 96f5d4b0967372553cb106539c5566bc184f6167
SHA256 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512 a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

C:\Users\Admin\AppData\Local\Temp\_MEI49162\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/3836-55-0x00007FFA03E90000-0x00007FFA042FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\base_library.zip

MD5 5e2fcf2cc2af9ec275951a05cfec23b6
SHA1 f6d27e85aa08758b4273d6a8e4f166ab7b219131
SHA256 1b2eec43721ac25169ee9874f6c0e5bef73e7fafa06944235380a54039fbc9bf
SHA512 eacd1ef8fb3df739e73d5dd60b482786838b128cf2d16c85a184a6bf74d39dea86a7519ef85617a3e185541556a0dd73e1a0ea49e76c5dcb72fd572f6826bae4

C:\Users\Admin\AppData\Local\Temp\_MEI49162\python3.DLL

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_ctypes.pyd

MD5 4b90108fabdd64577a84313c765a2946
SHA1 245f4628683a3e18bb6f0d1c88aa26fb959ed258
SHA256 e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1
SHA512 91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

C:\Users\Admin\AppData\Local\Temp\_MEI49162\libffi-7.dll

MD5 d50ebf567149ead9d88933561cb87d09
SHA1 171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA256 6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
SHA512 7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

memory/3836-63-0x00007FFA17340000-0x00007FFA17364000-memory.dmp

memory/3836-84-0x00007FFA1C400000-0x00007FFA1C40F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_socket.pyd

MD5 53e72716073038c1dd1db65bfdb1254c
SHA1 7bf220a02a3b51aa51300b3a9ea7fa48358ca161
SHA256 e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d
SHA512 c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_lzma.pyd

MD5 8edbeeccb6f3dbb09389d99d45db5542
SHA1 f7e7af2851a5bf22de79a24fe594b5c0435fca8a
SHA256 90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f
SHA512 2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

memory/3836-96-0x00007FFA03D10000-0x00007FFA03E81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\libssl-1_1.dll

MD5 6cd33578bc5629930329ca3303f0fae1
SHA1 f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512 c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

memory/3836-100-0x00007FFA156D0000-0x00007FFA156FE000-memory.dmp

memory/3836-104-0x00007FFA0F2F0000-0x00007FFA0F3A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_asyncio.pyd

MD5 7d4f9a2b793e021f7e37b8448751ed4e
SHA1 0ea07b5024501aad5008655cfeae6d96b5da957a
SHA256 2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4
SHA512 af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_hashlib.pyd

MD5 3b5530f497ff7c127383d0029e680c35
SHA1 fb5dc554bb9ff49622184cc16883a7567115c7ca
SHA256 5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573
SHA512 12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

C:\Users\Admin\AppData\Local\Temp\_MEI49162\yarl\_quoting_c.cp310-win_amd64.pyd

MD5 c14493cd3cc9b9b5f850b5fadcbe936e
SHA1 eddb260ff89bfa132a479fdf783c67098011fb85
SHA256 1782f3c12b3eb01716fcd59b0cd69c02c2fb888db4377f4d5fe00f07986be8e3
SHA512 0a7b85322b8fa566fb3d24b8e4021fb64433be06c3c4dbeb06d9633e4af0a5b76252fb2228de0abd818be5f4a18fffc712c727816632dd8c8585c9a9a7bf0fb6

C:\Users\Admin\AppData\Local\Temp\_MEI49162\aiohttp\_http_parser.cp310-win_amd64.pyd

MD5 16a2765d0487ee171c8f8761df29ddcf
SHA1 44fc0c0700039457095256f18702f56ec8ff743e
SHA256 285d9d527b2f1c70182d3060fee35a95b2c4e8316137f5f4dec806eb64e57af2
SHA512 f78c29c91eb08de69810a64e6a5025e24c692394b0f242f6e281c7bb59f88194ea22a2e33954c1a40adf00b34dd81164655674e496c552057a19b4780b968a6b

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_uuid.pyd

MD5 59cfd9669367517b384922b2485cb6a7
SHA1 1bd44298543204d61d4efd2cd3980ad01071360d
SHA256 e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f
SHA512 d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

C:\Users\Admin\AppData\Local\Temp\_MEI49162\cryptography\hazmat\bindings\_rust.pyd

MD5 073606ea92928af7b2863782c0114949
SHA1 ec7b4dbf415af6a071a6ca3a0d4f4a0cf544515c
SHA256 9be10e3f170875a5b3e403f29d7241bf64957c01bfcae3504f5576578183610a
SHA512 5cd48348b475c9de7c2c8d85f36a1f8cf63ee5ee2bde60e2e5a1026f0e877b4c686ad07ab37c8ae37b46b719233b28aa699ce5a2fedd0247c7607da6e519a11e

C:\Users\Admin\AppData\Local\Temp\_MEI49162\frozenlist\_frozenlist.cp310-win_amd64.pyd

MD5 6106b4d1eec11d2a71def28d2a2afa46
SHA1 e10039eff42f88a2cd8dfe11d428c35f6178c6ce
SHA256 19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da
SHA512 d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43

memory/3836-129-0x00007FFA13660000-0x00007FFA13674000-memory.dmp

memory/3836-128-0x00007FFA173A0000-0x00007FFA173B0000-memory.dmp

memory/3836-137-0x00007FFA131D0000-0x00007FFA131EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_cffi_backend.cp310-win_amd64.pyd

MD5 641e49ce0c4fa963d347fbf915aabdbe
SHA1 1351f6c4ac5dcda7e3ffbf3d5e355b4bb864eb10
SHA256 1c795df278c7f64be8e6973f8dbf1a625997cb39ae2dcb5bee0ca4c1b90c8906
SHA512 766b9adb5143e89d663177c2fb0e951afb84c0a43ec690ae2c477ee0bbe036df6f4161a6012430d42e4913fd5fbe7e49af6d13ac7c62d042a484861fc5a04616

memory/3836-136-0x00007FFA17200000-0x00007FFA1720A000-memory.dmp

memory/3836-139-0x00007FFA030C0000-0x00007FFA03861000-memory.dmp

memory/3836-135-0x00007FFA13330000-0x00007FFA13341000-memory.dmp

memory/3836-134-0x00007FFA131F0000-0x00007FFA1323C000-memory.dmp

memory/3836-133-0x00007FFA13350000-0x00007FFA13369000-memory.dmp

memory/3836-132-0x00007FFA13640000-0x00007FFA13657000-memory.dmp

memory/3836-131-0x00007FFA135D0000-0x00007FFA135F2000-memory.dmp

memory/3836-130-0x00007FFA03870000-0x00007FFA03988000-memory.dmp

memory/3836-127-0x00007FFA19450000-0x00007FFA19469000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\aiohttp\_websocket.cp310-win_amd64.pyd

MD5 623862193e92582b732fcc4683bfb515
SHA1 ce0b2201938cb7e7ea18dcdd98d8ccc2fa28ef9d
SHA256 dfd68ae5add1c99e0e31820a676fafdf6a472dcab49362d9970c8a66f4121645
SHA512 5b7333af6b6e20aa33cce6561b9673ed590e942d58c48004a7203ff3b33eb6f21541398716b550fa602953c14c80a06da8a439f95bd3f004731ecc5c29e347b9

C:\Users\Admin\AppData\Local\Temp\_MEI49162\aiohttp\_http_writer.cp310-win_amd64.pyd

MD5 878a426eb61ebecdba1016400e8fe60d
SHA1 7ae2f28199cde86ce2cc382d6a1b87b373940d95
SHA256 53fc5a5371a69ec8a700dea681654483c2be301f584d9393789cb5a134ba6aa8
SHA512 d1297868c9400530733538947603e0c73722600c11dc5ce0d7d8371939a7ac840ac0b574b42d9a9a407c3cfbdd938672f73e5da54aa8317eea4053e66fcd6475

C:\Users\Admin\AppData\Local\Temp\_MEI49162\aiohttp\_helpers.cp310-win_amd64.pyd

MD5 79dbf6677f21a17c9561eb008cc2a987
SHA1 096ef929cd31638cdc3ec18883495e5999efd263
SHA256 bd1638d83bcc69d9cadc1812d5db298f67d1e1b2831cc7783587c0ac7cf9b595
SHA512 2d9d8814f0d69b56a7ff1e9bb4207d00f9259113bc8f3e20211341cffeed117829ba9b80d8c0fb9b2da9fc68910a2be039b0fcf1c7bb0de23efee6644d17e164

C:\Users\Admin\AppData\Local\Temp\_MEI49162\unicodedata.pyd

MD5 fed35db31377d515d198e5e446498be2
SHA1 62e388d17e17208ea0e881ccd96c75b7b1fbc5f7
SHA256 af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b
SHA512 0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

C:\Users\Admin\AppData\Local\Temp\_MEI49162\multidict\_multidict.cp310-win_amd64.pyd

MD5 58a0ff76a0d7d3cd86ceb599d247c612
SHA1 af52bdb9556ef4b9d38cf0f0b9283494daa556a6
SHA256 2079d8be068f67fb2ece4fb3f5927c91c1c25edecb9d1c480829eb1cd21d7cc5
SHA512 e2d4f80cdeba2f5749a4d3de542e09866055d8aee1d308b96cb61bc53f4495c781e9b2559cc6a5f160be96b307539a8b6e06cabeffcc0ddb9ad4107dcacd8a76

memory/3836-143-0x00007FFA11340000-0x00007FFA11378000-memory.dmp

memory/3836-142-0x00007FFA13680000-0x00007FFA13694000-memory.dmp

memory/3836-108-0x00007FFA14660000-0x00007FFA14675000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_overlapped.pyd

MD5 5c1441f6ee11632183a83dac2d22853b
SHA1 eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2
SHA256 104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf
SHA512 e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

memory/3836-103-0x00007FFA17340000-0x00007FFA17364000-memory.dmp

memory/3836-102-0x00007FFA03990000-0x00007FFA03D05000-memory.dmp

memory/3836-99-0x00007FFA03E90000-0x00007FFA042FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\libcrypto-1_1.dll

MD5 86cfc84f8407ab1be6cc64a9702882ef
SHA1 86f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512 b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_ssl.pyd

MD5 7e9d95ac47a2284706318656b4f711d3
SHA1 f085104709201c6e64635aeacf1da51599054e55
SHA256 38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9
SHA512 294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

C:\Users\Admin\AppData\Local\Temp\_MEI49162\sqlite3.dll

MD5 6a3a34c9c67efd6c17d44292e8db8fad
SHA1 339b1e514d60d8370eaec1e2f2b71cead999f970
SHA256 7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9
SHA512 6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

memory/3836-94-0x00007FFA172D0000-0x00007FFA172EF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_sqlite3.pyd

MD5 e7d68df8f65fbb0298a45519e2336f32
SHA1 ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d
SHA256 2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79
SHA512 626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

memory/3836-92-0x00007FFA172F0000-0x00007FFA1731D000-memory.dmp

memory/3836-90-0x00007FFA17320000-0x00007FFA17339000-memory.dmp

memory/3836-89-0x00007FFA1B200000-0x00007FFA1B20D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_bz2.pyd

MD5 6250a28b9d0bfefc1254bd78ece7ae9f
SHA1 4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd
SHA256 7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b
SHA512 6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

C:\Users\Admin\AppData\Local\Temp\_MEI49162\select.pyd

MD5 3797a47a60b606e25348c67043874fe8
SHA1 63a33fedffd52190236a6acd0fc5d9d491e3ac45
SHA256 312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac
SHA512 3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

memory/3836-86-0x00007FFA19450000-0x00007FFA19469000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_queue.pyd

MD5 5c4c43763fb1a796134aa5734905c891
SHA1 44a5e1ae4806406a239129d77888bd87d291a410
SHA256 4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c
SHA512 07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_multiprocessing.pyd

MD5 4fbc5fd5da9da74c04fe0374387b34d3
SHA1 1e9c98db0486f98fb7d8eb9fa57a949494b649b5
SHA256 b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950
SHA512 ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

C:\Users\Admin\AppData\Local\Temp\_MEI49162\_decimal.pyd

MD5 20985dc78dbd1992382354af5ca28988
SHA1 385a3e7a7654e5e4c686399f3a72b235e941e311
SHA256 f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43
SHA512 61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

C:\Users\Admin\AppData\Local\Temp\_MEI49162\pyexpat.pyd

MD5 46331749084f98bcfe8631d74c5e038f
SHA1 5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347
SHA256 21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df
SHA512 edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe

MD5 51a59b84b382c87fb5afb6f793c51af0
SHA1 3e1ce55d1c0f5dcff9f72a8d34a9d32a7710f009
SHA256 48033a75dbddda6de878f156a02550e5769225b36a4ebb8af70b60c1e2f0044b
SHA512 ac4cf466ac5476f13c28514c1afcb8a97162ddf2f6ae6ec4a77aa8253776759610f67086e27f3d31f2191a752944a813ac7c6f596e1fc251d65d91c7a3116782

memory/3836-185-0x00007FFA172D0000-0x00007FFA172EF000-memory.dmp

memory/3836-186-0x00007FFA139F0000-0x00007FFA139FD000-memory.dmp

memory/1104-189-0x000002425B2E0000-0x000002425B302000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tzqzqsyt.s4w.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3836-201-0x00007FFA03D10000-0x00007FFA03E81000-memory.dmp

memory/3836-202-0x00007FFA03990000-0x00007FFA03D05000-memory.dmp

memory/3836-205-0x00007FFA156D0000-0x00007FFA156FE000-memory.dmp

memory/3836-206-0x00007FFA0F2F0000-0x00007FFA0F3A8000-memory.dmp

memory/3836-207-0x00007FFA14660000-0x00007FFA14675000-memory.dmp

memory/3836-208-0x00007FFA030C0000-0x00007FFA03861000-memory.dmp

memory/3836-217-0x00007FFA03E90000-0x00007FFA042FE000-memory.dmp

memory/3836-248-0x00007FFA131F0000-0x00007FFA1323C000-memory.dmp

memory/3836-247-0x00007FFA13350000-0x00007FFA13369000-memory.dmp

memory/3836-246-0x00007FFA13640000-0x00007FFA13657000-memory.dmp

memory/3836-245-0x00007FFA135D0000-0x00007FFA135F2000-memory.dmp

memory/3836-244-0x00007FFA173A0000-0x00007FFA173B0000-memory.dmp

memory/3836-242-0x00007FFA11340000-0x00007FFA11378000-memory.dmp

memory/3836-229-0x00007FFA14660000-0x00007FFA14675000-memory.dmp

memory/3836-224-0x00007FFA172D0000-0x00007FFA172EF000-memory.dmp

memory/3836-218-0x00007FFA17340000-0x00007FFA17364000-memory.dmp

memory/3836-262-0x00007FFA0F2F0000-0x00007FFA0F3A8000-memory.dmp

memory/3836-270-0x00007FFA13350000-0x00007FFA13369000-memory.dmp

memory/3836-268-0x00007FFA135D0000-0x00007FFA135F2000-memory.dmp

memory/3836-263-0x00007FFA14660000-0x00007FFA14675000-memory.dmp

memory/3836-261-0x00007FFA03990000-0x00007FFA03D05000-memory.dmp

memory/3836-260-0x00007FFA156D0000-0x00007FFA156FE000-memory.dmp

memory/3836-251-0x00007FFA03E90000-0x00007FFA042FE000-memory.dmp

memory/3836-278-0x00007FFA03E90000-0x00007FFA042FE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConvertToClear.xlsx

MD5 24d0db2622267b452e4a0582da4709e1
SHA1 180c148415325578d4cd3f73e390dbe79ae091be
SHA256 d761f6d7fb4172d1ada24f7fef153e081eb0e3459e2b5c7cd3ea208917337b4d
SHA512 04eee84177b49362bf1f18d47e3866ade6d17ba4305e40bb85308b0538191237defe6a90a9d85db201b4417a7a62b687749561aa5214831318872813a4b6d9fb

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CopySync.docx

MD5 36a811b34b0e102f5c04fa4e87f8f9ef
SHA1 6253f49462e2fa0da20967e01ebc2c25bf79b7fb
SHA256 619d0c2ec6f560e29a0b86c43d693e919349841a550622ab3b905e996376e1e7
SHA512 9a2e7a95c7d87c3870a83e5338adb8cdcb0564bbdf0d6114231686a8e34d92f428d33698764ce434b6db654b19f629e2ca7bfb506d3f4627ddc2bcf3c3b38b13

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ConnectRevoke.docx

MD5 aba80cfc00310859f1dc6af9e52d7361
SHA1 e768fb6896cad201807321e8a3f5ee0d3d0edcf0
SHA256 6afbfc925bbb1f9d959775ea629445b420216a08571813e35f42fb30a5338eed
SHA512 1afcc3fc6035cffcbadd1ddb5b6d264187be438e7f5c72c1234f1721492dcac1371baba3b5590dd40d15f5ae192b8a13818ba633cf0df58ae564844346d71e6f

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ConfirmUpdate.xlsx

MD5 cbec5aaf1faaba0e84449149f2bd1406
SHA1 13dbb72db717211d86c3dc7a586ab7c3e743aabf
SHA256 4fe1fdab2b6b9fa04ea3c90470fdd8617f9cb7e6c3260d3d4447c25e3453159e
SHA512 6cc46e7ce3b9faef40d96507392a131be4e1a2cdca153ed3e9f71fb7be138d615fd5bd832b3b9fe47ba0d0b09a5d2271b19fcfc2da39fe2104ca8e57501863ba

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SendResume.xlsx

MD5 21226ae9071336b70ee995f52aef60dd
SHA1 383b350e9b0e3d162dbe14e96378cc473a25355a
SHA256 11a5b21a401553f36a7f2ec084c44f746934f8cf159d38f91f42c37c92d0288d
SHA512 c0827b5c4277ab5975981f71a4a213c3a9520fd0b1f5f9d4bb445b04ae40f67f198a547d8044ef39f82658a6504b7cb640bf6173d16bafff0560121616d926db

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\PublishClear.xlsx

MD5 575cdaf3f571a46e79d35b01eb11f38c
SHA1 d1671888c6aa8d04be26e3ae05b35096cee4c96e
SHA256 0280dbe1f9f4e16124c039b2058ae29ec33abff89167ee6166a6f482cc22bfec
SHA512 d43295fca0154036ca17cfa792a4da701e4b566d42870db04bc8f822ad24f60a9c39af6106e5e8137a31854348aa51ef1283e1a10cbaf37e3830d5989d74dc1a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\DebugGroup.csv

MD5 d1081537a4960174315ed8de3516ed4d
SHA1 0db97fc2a63035f18933dd63706b15f6342b01ce
SHA256 0be0c3457db1b33e31592d21d9775fbe5fe04c64f8e756cc60d910f14a67e032
SHA512 2ed3bdaa9b747626e2afc6ab7cc2b1c7b395bd98d145fb68e47d3cd62704ec6310fc3a582e2d87c791d1efe44beae80a3b73eeff6d8e72bc2a37ae88d117ab55

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ExitUndo.docx

MD5 37712624e80500ee159037bc75216b28
SHA1 92c016cc7cdc8921a874318b9b8ae5ccdb442be9
SHA256 821c4be8b709c93722d2bb707c628b4c400c9762de1286e8d5f2675032b98ea0
SHA512 83bf671fdb347e59211cb2bea41453807af7011dab379cadfa8272a370e279923216505dfb4f07d941d25eaf518619e5c16f2b26c2d8398548adedfe00ff2c2b

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OutRevoke.docx

MD5 20b9099670d5b874d3e1b70898260752
SHA1 1b24ff7d98a0b9e0710c01f6192c870aafb24449
SHA256 d239d47b93da0380981afc3ffc2d81b691d33e3d122d3dbde1febf3b48e7cec3
SHA512 599c7d15c51c7632b5e8425fe5a1e35c640d8e3ebc1fc3bd9cb90535e870c3428c7c854ba6a86a136b297caff44b06db81517f534961146084675cb753f0fcae

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RevokeHide.pdf

MD5 47fe1a2a79f743418ed13e7e0f5a0dc5
SHA1 28d39641b4d7ee130952e0bbe94335232e437258
SHA256 fad343a61992ed2f1ada4219129b6887200ce86905d1fc1c44a925b73994adb4
SHA512 b7352edfe02e1d7f4722eae975bcc7abba822ca44064a21c108e80e255ff378c624d231fe80f8cf9af9d2af09b64b47adaaad87470ae3eef80030b68c4c15e7a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ProtectGroup.xlsx

MD5 ba0b3105d971b035917b2e824a531289
SHA1 a7468bf546eefbc9f44891e56d4e1cbc7abb19db
SHA256 b1627bad71499813404defe31039db7fbb09f7a6b95f48fa6c52b8acbc6f5d47
SHA512 33b672374d3ec5c5fd6474b4403d352e307dbde8c193baaac4750e80ecaab86a94a8e176f41913a410b431132ba0403eb21a81e42141b4b9f51086005b26f509

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\EditResolve.xlsx

MD5 5d14f08daf270b57041a311ac155e7bc
SHA1 8b0a90fa6c4ae2a3a59cf683adda424b1650892b
SHA256 4fb35269cba509626d527984d4fdb98c8912c37f844ded658fbc82c4c73f09be
SHA512 47d7189447b846bccf1c0c2c8a7a1d901ffdd8b606de634937eb6cf2b82c413277459856d63a97beb8c755e69aa7b76808ebad52edc3dd1da026f02c5d2d7ece

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CompleteMeasure.xls

MD5 f0ccf6a69211a29e5935c4974ed42d6e
SHA1 b0ec87610dce55deb616439c6da247f0fc360576
SHA256 43e40e44087c702b7ced4d601474e4c7cda9be49cd1a1a48ed234e06eeb2a7be
SHA512 9a4000b4f4f9c2892033e0d088dd9e106d651da64b574553ee501f7a717b53c0df5b0501795397f919783a195702f68c868d351cd966d1f0173b9d8688e6834e

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\StopBackup.rtf

MD5 f188a9f36e341a8b079f04320ece2df1
SHA1 3fdd1e9d9f12cd0c8c0fd5430bae38170d46691e
SHA256 a775ec60f6f373c243c28fb2e543fbe27a11f9eb593414a915cff723ff8af773
SHA512 5f7c8928327c1a4c869be424dd9a29941f280325f27d822e630c3f75de354df9c896d625f4eef6e9fdd2876fd045d84ad354f4c95eea80dbca8621c0926df664

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupDisable.mp4

MD5 6566654a615bfb7395f38992355d11d2
SHA1 efc9b27a1f8591c41f12ad1bbba7bb7c5328ac2a
SHA256 ce3ab978dd7d7f097e2fe8428f2fae6adb6db8a5bf02b9a706b4c419544f8679
SHA512 dd8b86c8b119aba21199f8ecedd5d25196e91d6747d59f5ad4ee23597e8a3b0ac7ab287ad891ff8331ec2a56909a135098e600f3219b9606f2d549cd2ec67e79

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\TestPublish.docx

MD5 dd4d42a24698d2c62a8ee055b14d995b
SHA1 57af326a8a6358fbceb21e0d223426901a852ce1
SHA256 127bce3789277e5ef7bc39a00d67c268f6816a89c9c21e63cbd29a3c5b0b85f2
SHA512 6a9d31c0360da867b6cc3a01c17cad44c049e47d32a187f66e90f3b768fc0d8425605be18053a81add5d8137c4940b3569afdf90984aee51b8b039a6d4373113

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CloseProtect.jpg

MD5 71aa3d60330092b4c6b385da941abcd3
SHA1 91e5b28f1f31912740e17f1916b0168ea205cbdb
SHA256 5b577cab67062e505e038208959d0889c6ae94b58f67dbeb9a6c3b76a11da997
SHA512 be46331cb194d0730d3d55fc2a492ef1f33f8a89682c8ed32bc45846527a292540f90bac3f70d85947d4455c2da1352d4453c7aa58f93927938a18002191abb1

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\UnregisterPing.doc

MD5 9f5546b9adca62e315b87e47ffa9bfa6
SHA1 70990a5fd99c6f866cde5e7a947d02a489116ef3
SHA256 547bc95cb06ef64bf64b4f016ca7deefedf8c8171be0239d479bd37e47db58b9
SHA512 b0f25dab413002bc886978ae42cf57388b05d53f2a0672a3bd14ddf6f078c5dfd922323275e248a0503dafe0d510c1018ef8a39672f88e0b6861155fe1efc23d

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\MountRestore.jpeg

MD5 5731867a09735cd6e465d5144ead6ee1
SHA1 b6f074a66c13e4e2a89dd3ea865ef036467c371a
SHA256 46e5565771e31219e5fed300dbd3527065e73b91b0fe55416b893de9123f60ed
SHA512 a082a32a92dd31a4213a5f5499098915af41bc4053025e70cbb8070085e050a27061580312632cc7ac920912ebb83ed8acc1b56489e655b566230cc385ad0671

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ResizeBackup.xltm

MD5 53c75ec4cc7fd1144243f2d000b75aa0
SHA1 2a149a8818352a67c3d330adfb8313109d97f074
SHA256 f5f4a4b41c07a7ea3c3ccec377472924df06ec4f5c79e7dc9b3c5edd1371ca3a
SHA512 fbab94c491659157bb27c6ab5876027d6b3477b84cbb7644e823fca91150e2a8573a9988bcd9d17ca12fb0e96bf3ea413bd496af2e1d313f3ffd3a22d3707750

memory/3836-542-0x00007FFA1B200000-0x00007FFA1B20D000-memory.dmp

memory/3836-541-0x00007FFA13680000-0x00007FFA13694000-memory.dmp

memory/3836-540-0x00007FFA1C400000-0x00007FFA1C40F000-memory.dmp

memory/3836-539-0x00007FFA17340000-0x00007FFA17364000-memory.dmp

memory/3836-538-0x00007FFA17320000-0x00007FFA17339000-memory.dmp

memory/3836-543-0x00007FFA0F2F0000-0x00007FFA0F3A8000-memory.dmp

memory/3836-547-0x00007FFA156D0000-0x00007FFA156FE000-memory.dmp

memory/3836-546-0x00007FFA03D10000-0x00007FFA03E81000-memory.dmp

memory/3836-555-0x00007FFA13640000-0x00007FFA13657000-memory.dmp

memory/3836-564-0x00007FFA139F0000-0x00007FFA139FD000-memory.dmp

memory/3836-563-0x00007FFA030C0000-0x00007FFA03861000-memory.dmp

memory/3836-562-0x00007FFA19450000-0x00007FFA19469000-memory.dmp

memory/3836-561-0x00007FFA11340000-0x00007FFA11378000-memory.dmp

memory/3836-560-0x00007FFA131D0000-0x00007FFA131EE000-memory.dmp

memory/3836-559-0x00007FFA17200000-0x00007FFA1720A000-memory.dmp

memory/3836-558-0x00007FFA13330000-0x00007FFA13341000-memory.dmp

memory/3836-557-0x00007FFA131F0000-0x00007FFA1323C000-memory.dmp

memory/3836-556-0x00007FFA13350000-0x00007FFA13369000-memory.dmp

memory/3836-554-0x00007FFA135D0000-0x00007FFA135F2000-memory.dmp

memory/3836-553-0x00007FFA03870000-0x00007FFA03988000-memory.dmp

memory/3836-552-0x00007FFA13660000-0x00007FFA13674000-memory.dmp

memory/3836-551-0x00007FFA03990000-0x00007FFA03D05000-memory.dmp

memory/3836-550-0x00007FFA14660000-0x00007FFA14675000-memory.dmp

memory/3836-549-0x00007FFA173A0000-0x00007FFA173B0000-memory.dmp

memory/3836-548-0x00007FFA03E90000-0x00007FFA042FE000-memory.dmp

memory/3836-545-0x00007FFA172D0000-0x00007FFA172EF000-memory.dmp

memory/3836-544-0x00007FFA172F0000-0x00007FFA1731D000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-28 19:51

Reported

2024-10-28 19:54

Platform

win7-20241010-en

Max time kernel

13s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\xero.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xero.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 572 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Users\Admin\AppData\Local\Temp\xero.exe
PID 572 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Users\Admin\AppData\Local\Temp\xero.exe
PID 572 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\xero.exe C:\Users\Admin\AppData\Local\Temp\xero.exe

Processes

C:\Users\Admin\AppData\Local\Temp\xero.exe

"C:\Users\Admin\AppData\Local\Temp\xero.exe"

C:\Users\Admin\AppData\Local\Temp\xero.exe

"C:\Users\Admin\AppData\Local\Temp\xero.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI5722\python310.dll

MD5 fc7bd515b12e537a39dc93a09b3eaad6
SHA1 96f5d4b0967372553cb106539c5566bc184f6167
SHA256 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512 a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

memory/2960-53-0x000007FEF6360000-0x000007FEF67CE000-memory.dmp