exelastealer | 22905cd74085b5b80d07f0ec1cd0ed187400ac63e4601c0244317b60206ae0b7

Resubmissions

12-11-2024 03:23

241112-dxl45sxjbk 10

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VytrixDuper.exe
Size

22.8MB
MD5

d13ae015a085b21c90f987ed36574e2d
SHA1

2488d03a0b5f72153c89089536d8c2d27527e973
SHA256

c0a3974d6029fd96b68a40c3fe56c56868a1c68ef9a128ae7d9c24ddc5785c5b
SHA512

29e0d67b71ac7aec66de9b38edeea15159e50fa7a4d96925dc578ab5ae7f31509716a7b15eadb7e1eeb614762332ca95692eb423488912b3bd9bd28c6a07601c
SSDEEP

393216:uJ/+tByxjBIn8iK1piXLGVEgMv0XXsgyYWZBo:DtAjhDiXHjvmYBo

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1980 netsh.exe
3876 netsh.exe
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
collection

Clipboard Data
T1115

Processes:

cmd.exepowershell.exe

pid process

2896 cmd.exe
2796 powershell.exe

pid	process
1980	netsh.exe
3876	netsh.exe

pid	process
2896	cmd.exe
2796	powershell.exe

Loads dropped DLL 34 IoCs

Processes:

VytrixDuper.exe

pid	process
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe
3556	VytrixDuper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

27 discord.com
28 discord.com
29 discord.com
49 discord.com
54 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
discovery

Network Service Discovery
T1046

Processes:

cmd.exeARP.EXE

pid process

672 cmd.exe
1288 ARP.EXE
Enumerates processes with tasklist 1 TTPs 5 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid process

3260 tasklist.exe
2416 tasklist.exe
1984 tasklist.exe
3940 tasklist.exe
1064 tasklist.exe
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
defense_evasion

Hidden Files and Directories
T1564.001

Processes:

cmd.exe

pid process

1332 cmd.exe

flow	ioc
27	discord.com
28	discord.com
29	discord.com
49	discord.com
54	discord.com

flow	ioc
17	ip-api.com

pid	process
672	cmd.exe
1288	ARP.EXE

pid	process
3260	tasklist.exe
2416	tasklist.exe
1984	tasklist.exe
3940	tasklist.exe
1064	tasklist.exe

pid	process
1332	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI25082\python313.dll	upx
behavioral6/memory/3556-65-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\libffi-8.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\libcrypto-3.dll	upx
behavioral6/memory/3556-113-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp	upx
behavioral6/memory/3556-114-0x00007FFC0CAE0000-0x00007FFC0D013000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\libssl-3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\pyexpat.pyd	upx
behavioral6/memory/3556-121-0x00007FFC16F10000-0x00007FFC16F46000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\cryptography\hazmat\bindings\_rust.pyd	upx
behavioral6/memory/3556-125-0x00007FFC0C890000-0x00007FFC0CA0F000-memory.dmp	upx
behavioral6/memory/3556-123-0x00007FFC0E3A0000-0x00007FFC0E3C5000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_sqlite3.pyd	upx
behavioral6/memory/3556-119-0x00007FFC0CA10000-0x00007FFC0CADE000-memory.dmp	upx
behavioral6/memory/3556-116-0x00007FFC17670000-0x00007FFC176A4000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_ssl.pyd	upx
behavioral6/memory/3556-111-0x00007FFC1C490000-0x00007FFC1C4A4000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_hashlib.pyd	upx
behavioral6/memory/3556-108-0x00007FFC1CF20000-0x00007FFC1CF2F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_wmi.pyd	upx
behavioral6/memory/3556-106-0x00007FFC1D450000-0x00007FFC1D45D000-memory.dmp	upx
behavioral6/memory/3556-104-0x00007FFC21990000-0x00007FFC2199D000-memory.dmp	upx
behavioral6/memory/3556-102-0x00007FFC1C5A0000-0x00007FFC1C5B9000-memory.dmp	upx
behavioral6/memory/3556-101-0x00007FFC1C5C0000-0x00007FFC1C5EB000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_overlapped.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_multiprocessing.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_cffi_backend.cp313-win_amd64.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_asyncio.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\unicodedata.pyd	upx
behavioral6/memory/3556-128-0x00007FFC0C100000-0x00007FFC0C88A000-memory.dmp	upx
behavioral6/memory/3556-79-0x00007FFC1CC20000-0x00007FFC1CC39000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_bz2.pyd	upx
behavioral6/memory/3556-76-0x00007FFC219E0000-0x00007FFC219EF000-memory.dmp	upx
behavioral6/memory/3556-75-0x00007FFC1C5F0000-0x00007FFC1C617000-memory.dmp	upx
behavioral6/memory/3556-149-0x00007FFC17670000-0x00007FFC176A4000-memory.dmp	upx
behavioral6/memory/3556-148-0x00007FFC0C070000-0x00007FFC0C092000-memory.dmp	upx
behavioral6/memory/3556-147-0x00007FFC0BF90000-0x00007FFC0BFAB000-memory.dmp	upx
behavioral6/memory/3556-146-0x00007FFC0BFB0000-0x00007FFC0C063000-memory.dmp	upx
behavioral6/memory/3556-145-0x00007FFC0C0A0000-0x00007FFC0C0B4000-memory.dmp	upx
behavioral6/memory/3556-144-0x00007FFC0CAE0000-0x00007FFC0D013000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\propcache\_helpers_c.cp313-win_amd64.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\yarl\_quoting_c.cp313-win_amd64.pyd	upx
behavioral6/memory/3556-139-0x00007FFC13840000-0x00007FFC13852000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\multidict\_multidict.cp313-win_amd64.pyd	upx
behavioral6/memory/3556-136-0x00007FFC1C490000-0x00007FFC1C4A4000-memory.dmp	upx
behavioral6/memory/3556-133-0x00007FFC1C3C0000-0x00007FFC1C3D6000-memory.dmp	upx
behavioral6/memory/3556-132-0x00007FFC1CF20000-0x00007FFC1CF2F000-memory.dmp	upx
behavioral6/memory/3556-131-0x00007FFC0C0C0000-0x00007FFC0C0F8000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\aiohttp\_http_writer.cp313-win_amd64.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI25082\aiohttp\_helpers.cp313-win_amd64.pyd	upx
behavioral6/memory/3556-156-0x00007FFC0E3A0000-0x00007FFC0E3C5000-memory.dmp	upx
behavioral6/memory/3556-160-0x00007FFC0BAC0000-0x00007FFC0BAD1000-memory.dmp	upx
behavioral6/memory/3556-159-0x00007FFC0C890000-0x00007FFC0CA0F000-memory.dmp	upx
behavioral6/memory/3556-158-0x00007FFC0BAE0000-0x00007FFC0BB2D000-memory.dmp	upx
behavioral6/memory/3556-157-0x00007FFC0C100000-0x00007FFC0C88A000-memory.dmp	upx
behavioral6/memory/3556-155-0x00007FFC0BC00000-0x00007FFC0BC18000-memory.dmp	upx
behavioral6/memory/3556-154-0x00007FFC0BC40000-0x00007FFC0BC56000-memory.dmp	upx

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

956 sc.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

pid	process
956	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
discovery

Wi-Fi Discovery
T1016.002

Processes:

cmd.exenetsh.exe

pid process

1636 cmd.exe
4240 netsh.exe
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
discovery

System Network Connections Discovery
T1049

Processes:

NETSTAT.EXE

pid process

4532 NETSTAT.EXE
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.

Data from Local System
T1005

Processes:

WMIC.exe

pid process

64 WMIC.exe
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

4176 WMIC.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

NETSTAT.EXEipconfig.exe

pid process

4532 NETSTAT.EXE
3800 ipconfig.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

884 systeminfo.exe
Runs net.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

636 schtasks.exe
760 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2796 powershell.exe
2796 powershell.exe
2796 powershell.exe

pid	process
1636	cmd.exe
4240	netsh.exe

pid	process
4532	NETSTAT.EXE

pid	process
64	WMIC.exe

pid	process
4176	WMIC.exe

pid	process
4532	NETSTAT.EXE
3800	ipconfig.exe

pid	process
884	systeminfo.exe

pid	process
636	schtasks.exe
760	schtasks.exe

pid	process
2796	powershell.exe
2796	powershell.exe
2796	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exetasklist.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4176	WMIC.exe
Token: SeSecurityPrivilege	4176	WMIC.exe
Token: SeTakeOwnershipPrivilege	4176	WMIC.exe
Token: SeLoadDriverPrivilege	4176	WMIC.exe
Token: SeSystemProfilePrivilege	4176	WMIC.exe
Token: SeSystemtimePrivilege	4176	WMIC.exe
Token: SeProfSingleProcessPrivilege	4176	WMIC.exe
Token: SeIncBasePriorityPrivilege	4176	WMIC.exe
Token: SeCreatePagefilePrivilege	4176	WMIC.exe
Token: SeBackupPrivilege	4176	WMIC.exe
Token: SeRestorePrivilege	4176	WMIC.exe
Token: SeShutdownPrivilege	4176	WMIC.exe
Token: SeDebugPrivilege	4176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4176	WMIC.exe
Token: SeRemoteShutdownPrivilege	4176	WMIC.exe
Token: SeUndockPrivilege	4176	WMIC.exe
Token: SeManageVolumePrivilege	4176	WMIC.exe
Token: 33	4176	WMIC.exe
Token: 34	4176	WMIC.exe
Token: 35	4176	WMIC.exe
Token: 36	4176	WMIC.exe
Token: SeIncreaseQuotaPrivilege	728	WMIC.exe
Token: SeSecurityPrivilege	728	WMIC.exe
Token: SeTakeOwnershipPrivilege	728	WMIC.exe
Token: SeLoadDriverPrivilege	728	WMIC.exe
Token: SeSystemProfilePrivilege	728	WMIC.exe
Token: SeSystemtimePrivilege	728	WMIC.exe
Token: SeProfSingleProcessPrivilege	728	WMIC.exe
Token: SeIncBasePriorityPrivilege	728	WMIC.exe
Token: SeCreatePagefilePrivilege	728	WMIC.exe
Token: SeBackupPrivilege	728	WMIC.exe
Token: SeRestorePrivilege	728	WMIC.exe
Token: SeShutdownPrivilege	728	WMIC.exe
Token: SeDebugPrivilege	728	WMIC.exe
Token: SeSystemEnvironmentPrivilege	728	WMIC.exe
Token: SeRemoteShutdownPrivilege	728	WMIC.exe
Token: SeUndockPrivilege	728	WMIC.exe
Token: SeManageVolumePrivilege	728	WMIC.exe
Token: 33	728	WMIC.exe
Token: 34	728	WMIC.exe
Token: 35	728	WMIC.exe
Token: 36	728	WMIC.exe
Token: SeDebugPrivilege	1064	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4176	WMIC.exe
Token: SeSecurityPrivilege	4176	WMIC.exe
Token: SeTakeOwnershipPrivilege	4176	WMIC.exe
Token: SeLoadDriverPrivilege	4176	WMIC.exe
Token: SeSystemProfilePrivilege	4176	WMIC.exe
Token: SeSystemtimePrivilege	4176	WMIC.exe
Token: SeProfSingleProcessPrivilege	4176	WMIC.exe
Token: SeIncBasePriorityPrivilege	4176	WMIC.exe
Token: SeCreatePagefilePrivilege	4176	WMIC.exe
Token: SeBackupPrivilege	4176	WMIC.exe
Token: SeRestorePrivilege	4176	WMIC.exe
Token: SeShutdownPrivilege	4176	WMIC.exe
Token: SeDebugPrivilege	4176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4176	WMIC.exe
Token: SeRemoteShutdownPrivilege	4176	WMIC.exe
Token: SeUndockPrivilege	4176	WMIC.exe
Token: SeManageVolumePrivilege	4176	WMIC.exe
Token: 33	4176	WMIC.exe
Token: 34	4176	WMIC.exe
Token: 35	4176	WMIC.exe
Token: 36	4176	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VytrixDuper.exeVytrixDuper.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2508 wrote to memory of 3556	2508	VytrixDuper.exe	VytrixDuper.exe
PID 2508 wrote to memory of 3556	2508	VytrixDuper.exe	VytrixDuper.exe
PID 3556 wrote to memory of 3876	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 3876	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 3644	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 3644	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2400	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2400	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2364	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2364	3556	VytrixDuper.exe	cmd.exe
PID 3876 wrote to memory of 4176	3876	cmd.exe	WMIC.exe
PID 3876 wrote to memory of 4176	3876	cmd.exe	WMIC.exe
PID 3644 wrote to memory of 728	3644	cmd.exe	WMIC.exe
PID 3644 wrote to memory of 728	3644	cmd.exe	WMIC.exe
PID 2364 wrote to memory of 1064	2364	cmd.exe	tasklist.exe
PID 2364 wrote to memory of 1064	2364	cmd.exe	tasklist.exe
PID 3556 wrote to memory of 4064	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 4064	3556	VytrixDuper.exe	cmd.exe
PID 4064 wrote to memory of 672	4064	cmd.exe	WMIC.exe
PID 4064 wrote to memory of 672	4064	cmd.exe	WMIC.exe
PID 3556 wrote to memory of 2544	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2544	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 3604	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 3604	3556	VytrixDuper.exe	cmd.exe
PID 3604 wrote to memory of 3260	3604	cmd.exe	tasklist.exe
PID 3604 wrote to memory of 3260	3604	cmd.exe	tasklist.exe
PID 2544 wrote to memory of 1876	2544	cmd.exe	WMIC.exe
PID 2544 wrote to memory of 1876	2544	cmd.exe	WMIC.exe
PID 3556 wrote to memory of 1332	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 1332	3556	VytrixDuper.exe	cmd.exe
PID 1332 wrote to memory of 640	1332	cmd.exe	attrib.exe
PID 1332 wrote to memory of 640	1332	cmd.exe	attrib.exe
PID 3556 wrote to memory of 1268	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 1268	3556	VytrixDuper.exe	cmd.exe
PID 1268 wrote to memory of 3440	1268	cmd.exe	schtasks.exe
PID 1268 wrote to memory of 3440	1268	cmd.exe	schtasks.exe
PID 3556 wrote to memory of 4576	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 4576	3556	VytrixDuper.exe	cmd.exe
PID 4576 wrote to memory of 636	4576	cmd.exe	schtasks.exe
PID 4576 wrote to memory of 636	4576	cmd.exe	schtasks.exe
PID 3556 wrote to memory of 1724	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 1724	3556	VytrixDuper.exe	cmd.exe
PID 1724 wrote to memory of 760	1724	cmd.exe	schtasks.exe
PID 1724 wrote to memory of 760	1724	cmd.exe	schtasks.exe
PID 3556 wrote to memory of 2632	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2632	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 3328	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 3328	3556	VytrixDuper.exe	cmd.exe
PID 2632 wrote to memory of 3280	2632	cmd.exe	mshta.exe
PID 2632 wrote to memory of 3280	2632	cmd.exe	mshta.exe
PID 3328 wrote to memory of 2416	3328	cmd.exe	tasklist.exe
PID 3328 wrote to memory of 2416	3328	cmd.exe	tasklist.exe
PID 3556 wrote to memory of 2780	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2780	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 4324	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 4324	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2268	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2268	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2896	3556	VytrixDuper.exe	cmd.exe
PID 3556 wrote to memory of 2896	3556	VytrixDuper.exe	cmd.exe
PID 2896 wrote to memory of 2796	2896	cmd.exe	powershell.exe
PID 2896 wrote to memory of 2796	2896	cmd.exe	powershell.exe
PID 2268 wrote to memory of 1984	2268	cmd.exe	tasklist.exe
PID 2268 wrote to memory of 1984	2268	cmd.exe	tasklist.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

640 attrib.exe

pid	process
640	attrib.exe

C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe
"C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe
  "C:\Users\Admin\AppData\Local\Temp\VytrixDuper.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /TN "ExelaUpdateService"
      4⤵
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2780
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:1980
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4324
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:932
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1636
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:672
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:884
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4996
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:64
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:4276
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:2160
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:116
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:316
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:4972
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:3672
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:3248
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1368
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:4124
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:5044
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:1844
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:2000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:3820
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3940
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3800
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3060
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:1288
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:4532
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:956
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3876
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:1980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4288
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2728
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI25082\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\VCRUNTIME140_1.dll

Filesize
48KB

MD5
68156f41ae9a04d89bb6625a5cd222d4

SHA1
3be29d5c53808186eba3a024be377ee6f267c983

SHA256
82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd

SHA512
f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_asyncio.pyd

Filesize
37KB

MD5
fe4f2e32ed0ea1ef93188939ed5b9564

SHA1
082396142b4c17343695d9ad0d841e73372cddba

SHA256
7319ca620123e4664d6a6aff95ebb43a7a5b0b3cc0df0acb665be1330ed1d6ed

SHA512
3c2ce4589e1ca7f544585bf9fd6bbfe21c49141516a503c6f55ed1eb57b0bc3c53222062599e7213ad82d1b85e6c4e81b3b4bebf0efad4f1acbacd4132f9790c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_bz2.pyd

Filesize
48KB

MD5
76dda2f9e6796b85d4c80b7a49585bd0

SHA1
9d8eb7052fd218d75094c87c669a7e4d6d1614b9

SHA256
1ddc1386f8bec84b4c7d17e75a84fd2b7abef20bd3d5cdc648b3884252e78ca3

SHA512
602bfb0b42d3f8184f15082b61692796c18715c9581dbc840069209a2550545bb4af54e35c1f971a6a9a9830b94fb491f4c9f8d5f4899cf1b534ee6388505019

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_cffi_backend.cp313-win_amd64.pyd

Filesize
71KB

MD5
feb838919a9cbc39fa2f7e47b2cf2fa0

SHA1
4cfb8e03dc507587be9183e08c81c710ca368b86

SHA256
85508735f87ab59af7343101b96337a12d51d6e54227abc3fc139156565c5d8b

SHA512
317913492b361678bc9d7565c011eb201f8bf36fd3c4e3218e00554122db429ca583fa2c0fd782073ab9ae98ba4c228a291d4e71cfc443a8e6d79c051591656c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_ctypes.pyd

Filesize
62KB

MD5
83f2a420d3a54dc73dc553faead3bbd4

SHA1
954525c475713acc04fa2116191bd5a914cd881a

SHA256
b50b87720095fe7ed8dfad73f7a6a0bbeb408a24b561a2cfd7e3b333f87bed90

SHA512
21a80a2a6e3ca2e87df87bf3c34f0a61be441ca5d7bcb9fe7d35dfbce17a02ec04153e72864b284c001f6edcf4f7260476b21c2881614d0f632eeaa34656b1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_decimal.pyd

Filesize
117KB

MD5
2bbe0345bba0ceb1dfead3bd326e32f7

SHA1
7675f9a476b2ba7a3a76d825faddc9795d2e5afd

SHA256
79e9cf484191193a12126625bf8f8a929c51de8c0dd743f52eab49f86b313818

SHA512
9da97707bf77240ff8557d0a9f6c4cbefd0bd4d4c9b5528de9f588135f98fe9cd7b6d854068fb85df4d95d29b9981daf6d26f8abb94d483d0671bd9a79fbf53a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_hashlib.pyd

Filesize
35KB

MD5
e34a96f476a486da9f3a461abc2df8cc

SHA1
d70836f9ac2cd98c25b51c96f268674e95f53b26

SHA256
72d71d3e5ab403221d8e6ab292b97652fa194cf038fbd31afdf8ef61f1fbcf8e

SHA512
0e2ee8d50a85c450d29002975df616c2318d6e4d52caa0172d2ba46439a9c1fd0b639593852035b0585ccd6d84ba66ba46c79b6cb50e99dc5cff4988ea8af724

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_lzma.pyd

Filesize
86KB

MD5
4c91d0d2bd873740d3b835cd29ba4806

SHA1
76a4a59ea939d87177dc2e600a444bc908729d9a

SHA256
95578954b3282a5ed9c2db1e214cf3b4459afd955eabc898a896344b02908aba

SHA512
f551a17495b7620dbf6d60cf40c29f6a4ceb5afee31472e398492491308023e7401a334c50883f37b60767d209801be4611a6f57ed16a419b06ab8ad5c967565

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_multiprocessing.pyd

Filesize
27KB

MD5
3694bc10cac00d42b50bcf99cb9a8fc6

SHA1
3cffdb605d1e063dba0539400dbf6458a0351a03

SHA256
7bdefee7fbea26a231335cf4b58e6bafe2016275cd274339fdebfd7738d0be1d

SHA512
f5c905689ed17478c1cf66836fe43de656339a678b3f2c0028f196430e9e8d0431621158f03c4368a4eeceafd20904cd7ee89d554b839c21436a48ee65337159

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_overlapped.pyd

Filesize
33KB

MD5
ff936ad394f51e00cfa20b497820dc24

SHA1
02bc239848b717c0a71cefaa85ec7de44ef2e266

SHA256
c7a497d8bb056b55b7e8882c34e250afe3e3bf76f8691d6a90b3f24361ff672d

SHA512
2bccb9399b478516b85535cfb8ceb9c48ab9ab69df70f230a2f0e12506486f1935204bd931ea8cb4f3298bd00f9f7254278fa6739446c14ae0f0e9a0839f313e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_queue.pyd

Filesize
26KB

MD5
c7fdadca43547314c311fd077520000e

SHA1
c166a575e2896bd2700af2c43f7edae023304252

SHA256
6a984ba75337e4487a97646227a14a559eb752e76c831ff413165b5938b6fc69

SHA512
44be37526ddacdde4406a150d72278b2c2689051475d4ace5262d8a6425ab752fd22d0873b8e35620adae12f7c2c75b8feba8315863fb14c1ec1f8d311fc0431

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_socket.pyd

Filesize
44KB

MD5
574c2fee96efa2d63952a6042ee3272f

SHA1
22146b2592bd9aa086632c554f252a5ca92305cd

SHA256
66a745d27d7fdbe039f3ba2b82273eddcdcb8613cd17588682153fafd4b93384

SHA512
078e15e0a508c4035c2b83e458bab95ea56ef941d5505280fc207053be90d072699ec39b5094490ab495fd5041d2c684d0260e5a88ad2c68b199d04340ab4a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_sqlite3.pyd

Filesize
58KB

MD5
d8a9c98fae2b577c8cb4246e9875de10

SHA1
27b2a31ec26009a4c8a242f3c54b56e46d606070

SHA256
ccf4c7a8efce2a995a91548efc894859922be003ae1c2a00c75123c3453c711b

SHA512
cc519d00f67fc493ed9d9dccc0f6daa2c110247096d12ffdc9da69f7f0f11b11a1a333e6449f2c713b167c629ba9179a8c0083726cf25d8a04196045aed7cd66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_ssl.pyd

Filesize
66KB

MD5
51296f2f4ba52ad6a1f88471b34a42fa

SHA1
6e97e59a6438774ab8502157cc6139864cf8dff8

SHA256
edca2535998bc0f193f706d33f92324224587b353ce8cd1ad00836ad9093ffd1

SHA512
4bf99768f09cebf94c66f359b4e5c0fa03a44b7cd9f6df085d8d5287d66962cf4d654df243e853d9c4fb172a4b366d97a20367c7b3f4fcab81c63b0af3d6c21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_uuid.pyd

Filesize
25KB

MD5
3acf3138d5550ca6de7e2580e076e0f7

SHA1
3e878a18df2362aa6f0bdbfa058dca115e70d0b8

SHA256
f9d5008f0772aa0720bc056a6ecd5a2a3f24965e4b470b022d88627a436c1ffe

SHA512
f05e90a0feaa2994b425884af32149fbbe2e11cb7499fc88ca92d8a74410edcd62b2b2c0f1ecd1a46985133f7e89575f2c114bd01f619c22ce52f3cf2a7e37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\_wmi.pyd

Filesize
28KB

MD5
b263987e0a3cc69177351ef8c72931c0

SHA1
662f37a7c48feee8ddc2acfac21267ed168f0060

SHA256
9a72f30c62104ee4218519c244f9883890f7e116b546e77ca294d4c39cddf289

SHA512
f9a6ac77bf31e3ad42bb410197915e8c06f06d50053befd488df237b88a3554117f58c172045eea2a606034908dfe30874514abd93e06c8bf7d0d0903aa27c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\aiohttp\_helpers.cp313-win_amd64.pyd

Filesize
25KB

MD5
47b75330448e319b0c6e345f62bf1ae3

SHA1
9da89b2b57a20211c086133aa1c4a310a106f3fa

SHA256
0eacac6f25ab338180246b0b9b80837eadab380cf9f63b692bcdb6ccfdcc732d

SHA512
704e728e91b059d569f950548785cbd5411e0d83adc8c91bd29963206cf1bb06afe8c94fb741118fb6316f917f01f20056b71d6313548b68376ca199fcafb69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\aiohttp\_http_writer.cp313-win_amd64.pyd

Filesize
24KB

MD5
cc725a9807a5fd6174fc8d483fdd649d

SHA1
55f83645b710fbb6b0b666fd5b4c7420fe20f4b9

SHA256
86aca0e9742f5c4cd4f6e981eddd31e411518664e00b4e371d2cd624b3e70109

SHA512
190e3e316d97408a2bef58f8fe2b453cb818d221ddd2289ee370fa555ad310d8b8a3dd0c8193e950f825680326f2ed8260560ea2951e323431f41b4b3ce8dfd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\base_library.zip

Filesize
1.3MB

MD5
a9cbd0455b46c7d14194d1f18ca8719e

SHA1
e1b0c30bccd9583949c247854f617ac8a14cbac7

SHA256
df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

SHA512
b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.1MB

MD5
27bfdc1a00eb382f490991a6507cc3f2

SHA1
162bc0ddf111968bfd69246660cf650f89b5b7bc

SHA256
788d5c28a70e2bc4e695c827aec70e0869ad7bfdd1f0f4f75231d6f8d83450c2

SHA512
6fcc538c0f901f8543cf296b981a68eb6271f72ddcd106b69b45e0ebd166a355299ce23e999aa855d23edd69f95f53b653f92772435a42c72001386cdb423899

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\libcrypto-3.dll

Filesize
1.6MB

MD5
f5c66bbd34fc2839f2c8afa5a70c4e2c

SHA1
a085085dbf5396ca45801d63d9681b20f091414c

SHA256
7ff3ccb7903f8bc1b872c948cfff4520c51539ae184f93b7bd9c04bf60f4a7f4

SHA512
fc108dfa1ef75b4a4c45c3fae1ccb9257e8950a17f6374fef5080df69ffd52928e5bcac0490772d4d57091e0d81ea58cd1d6d34ec6993e30c1b4c5704be7044b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\libffi-8.dll

Filesize
29KB

MD5
0d1c6b92d091cef3142e32ac4e0cc12e

SHA1
440dad5af38035cb0984a973e1f266deff2bd7fc

SHA256
11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6

SHA512
5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\libssl-3.dll

Filesize
221KB

MD5
fc9d8dea869ea56ff6612a2c577394bf

SHA1
f30bc2bceb36e5e08c348936c791abaa93fd5b25

SHA256
8ec0a7ac78f483bf55585d53f77d23934a4d15665e06fbd73c4addf1c9e6c959

SHA512
929f5e08142e56f2d8067dac5d7457c72221da73e4cf6259da1982c5308b93dbec77d87cef89294a68441da77fa1923d6c9f812f714f6061ff9952f4f17783df

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\multidict\_multidict.cp313-win_amd64.pyd

Filesize
20KB

MD5
3c58269113cfce41c884db5b857bdc2d

SHA1
a7170fcf559c18acd9e5b9f1f07f557629ea1b30

SHA256
5513d20e607a6926737c8f83994d92e100e94b7117201a07d0c44531830b9daf

SHA512
d7dd460089dd9f6179aa3942b16553a4bd7a96fceb0a5d506f1499958409fadda666c43e2552227c1549e596c1a254374253bacc60b7ad3ea09db4864f9030cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\propcache\_helpers_c.cp313-win_amd64.pyd

Filesize
31KB

MD5
259dbfe970670d71dd3aba04f8489c03

SHA1
6c80ba0abfe89f599b74cf3da36ada926df22296

SHA256
64d60c63dcfd09a383f97bd7b75b891dbe215f7b0331bb7d7dcbbaed4108263c

SHA512
79d6b4180fd647f8146c57da7df1c1e178c40a6403ee57dea3da0342e0ad1c5616c8d89e6d45b1ac337f8c58ff2c4162da3274325f06a24051788144dbf47b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\pyexpat.pyd

Filesize
88KB

MD5
59c087c4a65839c69e3a59e129512563

SHA1
e5a39768dbd0be72f03c45a2d2eea9c802bb0f35

SHA256
1bba10c40afdad06f99d51624ecd0dfef43a4cee0beec5e5a21d61ae06cbdb49

SHA512
7c6f8164f0270b6aee2b30a66a44a094b987b6e6aaa2e34fdfcbc16b80143b76c430fd65871e5dcbe5338b8ad8b4635ff343bdfd09017b1d00663f31d4e5ef6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\python3.dll

Filesize
68KB

MD5
16855ebef31c5b1ebe767f1c617645b3

SHA1
315521f3a748abfa35cd4d48e8dd09d0556d989b

SHA256
a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4

SHA512
c3957b3bd36b10c7ad6ea1ff3bc7bd65cdceb3e6b4195a25d0649aa0da179276ce170da903d77b50a38fc3d5147a45be32dbcfdbfbf76cc46301199c529adea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\python313.dll

Filesize
1.8MB

MD5
d99ac8bac1343105b642295397ca2ffc

SHA1
93fd73c1fb9ee99ddc66d38885a657cf81f62836

SHA256
9116e56cedeb1c4ae82b4bde560f2fe0b83a16764865012cbf5501673d3c5536

SHA512
89d30bc84978daf469008ffc347cbd3e189f1df2c1a302dedfc2b700267cc28c671c7c35b5e95ba29a300e7fda75ccfc720d2173ea6db6eb69978772c0b8339f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\select.pyd

Filesize
25KB

MD5
9d6ec4a3d6011af6c1a18163d2f2dcd8

SHA1
04ff12fc1c8e185a65051b5ccd0e467bb997fe73

SHA256
fe525f24259716b6786c4ef169e106a977b06d7ef6661e63668551d96e03f31c

SHA512
6e9fc605f3319e563d880a573522f4361d24fc5731bff90f069fed053ab7f5159e69a8292929fbc0c56aa369fb350b5eee0c1dedb692e26221b7d7e7bd2d92b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Filesize
1KB

MD5
4ce7501f6608f6ce4011d627979e1ae4

SHA1
78363672264d9cd3f72d5c1d3665e1657b1a5071

SHA256
37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

SHA512
a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\sqlite3.dll

Filesize
643KB

MD5
739c7cfbb423ecc578012a1e968845c4

SHA1
b33937e491e611afbb1f7588647bdbf7ca36721e

SHA256
f71744ff7a6fb0bfe988b15453c258e53d6db7f08f3e6a50753dcc2a2990b72c

SHA512
4bb21339c39de65c604b73c46963d2e7e5cf31d33a1cdd7ac5c4b8ccc1fd88863a6342f7ba48d694ca6944764f7eec4e0b64851334781e3eddad743d8a8ed47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\unicodedata.pyd

Filesize
260KB

MD5
d06c37a2f1e9298433c1f40b2b5dfac6

SHA1
86a3b9edcae4ef141ce40d96551e73fd8d886b66

SHA256
c1eec492fccad5913c86e43cd6f2ed8d9660561ff15e43a2649f6848ef2105aa

SHA512
e40d1042a36145b7f233c6f8af1c191f622629aacfb5dffbd9ba99132b68cddd2fda194068a07ace2b351c0050172815bbfc1bc5e3e3cdc5135239384384f0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25082\yarl\_quoting_c.cp313-win_amd64.pyd

Filesize
41KB

MD5
45de7ac7d81235dcd7ea588303a7ca3d

SHA1
83a26166dc575f91800319e23186af33f54e2a89

SHA256
2df59c76027d73a30755aa6216bfa81684636737dcc76ae0ff489ee76469b397

SHA512
64172b750367600bac923119f44c4cb930670492b20c74396ba3835500883219fadb18c00e13dc94d5af0b9e2533da8a297c98b8174c339902d74bbf737b4148

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxrzgc5a.gp3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2796-212-0x0000015D69830000-0x0000015D69852000-memory.dmp

Filesize
136KB

Download
memory/3556-133-0x00007FFC1C3C0000-0x00007FFC1C3D6000-memory.dmp

Filesize
88KB

Download
memory/3556-256-0x00007FFC0BC40000-0x00007FFC0BC56000-memory.dmp

Filesize
88KB

Download
memory/3556-102-0x00007FFC1C5A0000-0x00007FFC1C5B9000-memory.dmp

Filesize
100KB

Download
memory/3556-104-0x00007FFC21990000-0x00007FFC2199D000-memory.dmp

Filesize
52KB

Download
memory/3556-106-0x00007FFC1D450000-0x00007FFC1D45D000-memory.dmp

Filesize
52KB

Download
memory/3556-108-0x00007FFC1CF20000-0x00007FFC1CF2F000-memory.dmp

Filesize
60KB

Download
memory/3556-128-0x00007FFC0C100000-0x00007FFC0C88A000-memory.dmp

Filesize
7.5MB

Download
memory/3556-79-0x00007FFC1CC20000-0x00007FFC1CC39000-memory.dmp

Filesize
100KB

Download
memory/3556-111-0x00007FFC1C490000-0x00007FFC1C4A4000-memory.dmp

Filesize
80KB

Download
memory/3556-76-0x00007FFC219E0000-0x00007FFC219EF000-memory.dmp

Filesize
60KB

Download
memory/3556-75-0x00007FFC1C5F0000-0x00007FFC1C617000-memory.dmp

Filesize
156KB

Download
memory/3556-149-0x00007FFC17670000-0x00007FFC176A4000-memory.dmp

Filesize
208KB

Download
memory/3556-148-0x00007FFC0C070000-0x00007FFC0C092000-memory.dmp

Filesize
136KB

Download
memory/3556-147-0x00007FFC0BF90000-0x00007FFC0BFAB000-memory.dmp

Filesize
108KB

Download
memory/3556-146-0x00007FFC0BFB0000-0x00007FFC0C063000-memory.dmp

Filesize
716KB

Download
memory/3556-145-0x00007FFC0C0A0000-0x00007FFC0C0B4000-memory.dmp

Filesize
80KB

Download
memory/3556-144-0x00007FFC0CAE0000-0x00007FFC0D013000-memory.dmp

Filesize
5.2MB

Download
memory/3556-116-0x00007FFC17670000-0x00007FFC176A4000-memory.dmp

Filesize
208KB

Download
memory/3556-119-0x00007FFC0CA10000-0x00007FFC0CADE000-memory.dmp

Filesize
824KB

Download
memory/3556-139-0x00007FFC13840000-0x00007FFC13852000-memory.dmp

Filesize
72KB

Download
memory/3556-123-0x00007FFC0E3A0000-0x00007FFC0E3C5000-memory.dmp

Filesize
148KB

Download
memory/3556-136-0x00007FFC1C490000-0x00007FFC1C4A4000-memory.dmp

Filesize
80KB

Download
memory/3556-125-0x00007FFC0C890000-0x00007FFC0CA0F000-memory.dmp

Filesize
1.5MB

Download
memory/3556-132-0x00007FFC1CF20000-0x00007FFC1CF2F000-memory.dmp

Filesize
60KB

Download
memory/3556-131-0x00007FFC0C0C0000-0x00007FFC0C0F8000-memory.dmp

Filesize
224KB

Download
memory/3556-121-0x00007FFC16F10000-0x00007FFC16F46000-memory.dmp

Filesize
216KB

Download
memory/3556-114-0x00007FFC0CAE0000-0x00007FFC0D013000-memory.dmp

Filesize
5.2MB

Download
memory/3556-156-0x00007FFC0E3A0000-0x00007FFC0E3C5000-memory.dmp

Filesize
148KB

Download
memory/3556-160-0x00007FFC0BAC0000-0x00007FFC0BAD1000-memory.dmp

Filesize
68KB

Download
memory/3556-159-0x00007FFC0C890000-0x00007FFC0CA0F000-memory.dmp

Filesize
1.5MB

Download
memory/3556-158-0x00007FFC0BAE0000-0x00007FFC0BB2D000-memory.dmp

Filesize
308KB

Download
memory/3556-157-0x00007FFC0C100000-0x00007FFC0C88A000-memory.dmp

Filesize
7.5MB

Download
memory/3556-155-0x00007FFC0BC00000-0x00007FFC0BC18000-memory.dmp

Filesize
96KB

Download
memory/3556-154-0x00007FFC0BC40000-0x00007FFC0BC56000-memory.dmp

Filesize
88KB

Download
memory/3556-161-0x00007FFC0BAA0000-0x00007FFC0BABE000-memory.dmp

Filesize
120KB

Download
memory/3556-176-0x00007FFC0BF90000-0x00007FFC0BFAB000-memory.dmp

Filesize
108KB

Download
memory/3556-113-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp

Filesize
6.4MB

Download
memory/3556-65-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp

Filesize
6.4MB

Download
memory/3556-242-0x00007FFC0C890000-0x00007FFC0CA0F000-memory.dmp

Filesize
1.5MB

Download
memory/3556-245-0x00007FFC1C3C0000-0x00007FFC1C3D6000-memory.dmp

Filesize
88KB

Download
memory/3556-257-0x00007FFC0BC00000-0x00007FFC0BC18000-memory.dmp

Filesize
96KB

Download
memory/3556-101-0x00007FFC1C5C0000-0x00007FFC1C5EB000-memory.dmp

Filesize
172KB

Download
memory/3556-244-0x00007FFC0C0C0000-0x00007FFC0C0F8000-memory.dmp

Filesize
224KB

Download
memory/3556-237-0x00007FFC0CAE0000-0x00007FFC0D013000-memory.dmp

Filesize
5.2MB

Download
memory/3556-239-0x00007FFC0CA10000-0x00007FFC0CADE000-memory.dmp

Filesize
824KB

Download
memory/3556-243-0x00007FFC0C100000-0x00007FFC0C88A000-memory.dmp

Filesize
7.5MB

Download
memory/3556-238-0x00007FFC17670000-0x00007FFC176A4000-memory.dmp

Filesize
208KB

Download
memory/3556-227-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp

Filesize
6.4MB

Download
memory/3556-253-0x00007FFC0BAE0000-0x00007FFC0BB2D000-memory.dmp

Filesize
308KB

Download
memory/3556-235-0x00007FFC1CF20000-0x00007FFC1CF2F000-memory.dmp

Filesize
60KB

Download
memory/3556-234-0x00007FFC1D450000-0x00007FFC1D45D000-memory.dmp

Filesize
52KB

Download
memory/3556-266-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp

Filesize
6.4MB

Download
memory/3556-297-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp

Filesize
6.4MB

Download
memory/3556-492-0x00007FFC1CC20000-0x00007FFC1CC39000-memory.dmp

Filesize
100KB

Download
memory/3556-503-0x00007FFC0BAE0000-0x00007FFC0BB2D000-memory.dmp

Filesize
308KB

Download
memory/3556-515-0x00007FFC0E3A0000-0x00007FFC0E3C5000-memory.dmp

Filesize
148KB

Download
memory/3556-517-0x00007FFC0BAA0000-0x00007FFC0BABE000-memory.dmp

Filesize
120KB

Download
memory/3556-516-0x00007FFC0C100000-0x00007FFC0C88A000-memory.dmp

Filesize
7.5MB

Download
memory/3556-514-0x00007FFC0BC00000-0x00007FFC0BC18000-memory.dmp

Filesize
96KB

Download
memory/3556-513-0x00007FFC0BC40000-0x00007FFC0BC56000-memory.dmp

Filesize
88KB

Download
memory/3556-512-0x00007FFC0CAE0000-0x00007FFC0D013000-memory.dmp

Filesize
5.2MB

Download
memory/3556-511-0x00007FFC0BF90000-0x00007FFC0BFAB000-memory.dmp

Filesize
108KB

Download
memory/3556-510-0x00007FFC0BFB0000-0x00007FFC0C063000-memory.dmp

Filesize
716KB

Download
memory/3556-509-0x00007FFC0BAC0000-0x00007FFC0BAD1000-memory.dmp

Filesize
68KB

Download
memory/3556-508-0x00007FFC13840000-0x00007FFC13852000-memory.dmp

Filesize
72KB

Download
memory/3556-507-0x00007FFC0C0A0000-0x00007FFC0C0B4000-memory.dmp

Filesize
80KB

Download
memory/3556-506-0x00007FFC0C0C0000-0x00007FFC0C0F8000-memory.dmp

Filesize
224KB

Download
memory/3556-505-0x00007FFC1C3C0000-0x00007FFC1C3D6000-memory.dmp

Filesize
88KB

Download
memory/3556-504-0x00007FFC0C890000-0x00007FFC0CA0F000-memory.dmp

Filesize
1.5MB

Download
memory/3556-502-0x00007FFC16F10000-0x00007FFC16F46000-memory.dmp

Filesize
216KB

Download
memory/3556-501-0x00007FFC0CA10000-0x00007FFC0CADE000-memory.dmp

Filesize
824KB

Download
memory/3556-500-0x00007FFC17670000-0x00007FFC176A4000-memory.dmp

Filesize
208KB

Download
memory/3556-499-0x00007FFC0C070000-0x00007FFC0C092000-memory.dmp

Filesize
136KB

Download
memory/3556-491-0x00007FFC219E0000-0x00007FFC219EF000-memory.dmp

Filesize
60KB

Download
memory/3556-490-0x00007FFC1C5F0000-0x00007FFC1C617000-memory.dmp

Filesize
156KB

Download
memory/3556-498-0x00007FFC1C490000-0x00007FFC1C4A4000-memory.dmp

Filesize
80KB

Download
memory/3556-497-0x00007FFC1CF20000-0x00007FFC1CF2F000-memory.dmp

Filesize
60KB

Download
memory/3556-496-0x00007FFC1D450000-0x00007FFC1D45D000-memory.dmp

Filesize
52KB

Download
memory/3556-495-0x00007FFC21990000-0x00007FFC2199D000-memory.dmp

Filesize
52KB

Download
memory/3556-494-0x00007FFC1C5A0000-0x00007FFC1C5B9000-memory.dmp

Filesize
100KB

Download
memory/3556-493-0x00007FFC1C5C0000-0x00007FFC1C5EB000-memory.dmp

Filesize
172KB

Download
memory/3556-489-0x00007FFC0D6F0000-0x00007FFC0DD53000-memory.dmp

Filesize
6.4MB

Download