exelastealer | 0ac8093eb7a5cad5f85c462be90ab5c33a093490e3118f1d98846fd5bffee686

Analysis

max time kernel
133s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
24-11-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DexLogo.png
Size

104KB
MD5

3c996b6f3a892ca41e22b203714c21b2
SHA1

45a2af707f4f93196f05a0c30db044e14b0698bb
SHA256

0ac8093eb7a5cad5f85c462be90ab5c33a093490e3118f1d98846fd5bffee686
SHA512

68f4162e0d9e18f39687d14babc4cb4e63b422dc8295f2a0bc37d8fc0dd3b72889b1e9fdb99a92c17714518081b7471a3371ea921bd8769a162c5ec498960798
SSDEEP

1536:S9ISS5AVuCkdD3v5ytq3s7uhrQmxxZOeIBEr9UiyV:S9IltCwf5cqgO02xZwEZWV

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence phishing privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
3872	netsh.exe
4904	netsh.exe

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: sweetalert2@11
phishing

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

Processes:

cmd.exepowershell.exe

pid	Process
1200	cmd.exe
4976	powershell.exe

Deletes itself 1 IoCs

Processes:

Exela.exe

pid	Process
2072	Exela.exe

Executes dropped EXE 2 IoCs

Processes:

Exela.exeExela.exe

pid	Process
444	Exela.exe
2072	Exela.exe

Loads dropped DLL 33 IoCs

Processes:

Exela.exe

pid	Process
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe
2072	Exela.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
7	discord.com
81	discord.com
82	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
35	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

Processes:

cmd.exeARP.EXE

pid	Process
664	cmd.exe
3364	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	Process
1348	tasklist.exe
4792	tasklist.exe
2256	tasklist.exe
5020	tasklist.exe
4864	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Processes:

cmd.exe

pid	Process
1672	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x001900000002acaf-605.dat	upx
behavioral1/memory/2072-609-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp	upx
behavioral1/files/0x001900000002ac4a-611.dat	upx
behavioral1/files/0x001900000002aca3-618.dat	upx
behavioral1/memory/2072-619-0x00007FFA4BF90000-0x00007FFA4BF9F000-memory.dmp	upx
behavioral1/memory/2072-617-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp	upx
behavioral1/files/0x001900000002ac55-620.dat	upx
behavioral1/memory/2072-622-0x00007FFA41710000-0x00007FFA41729000-memory.dmp	upx
behavioral1/files/0x001400000002acb0-623.dat	upx
behavioral1/memory/2072-625-0x00007FFA4BDB0000-0x00007FFA4BDBD000-memory.dmp	upx
behavioral1/files/0x001c00000002ac48-626.dat	upx
behavioral1/memory/2072-629-0x00007FFA416F0000-0x00007FFA41709000-memory.dmp	upx
behavioral1/files/0x001900000002ac4f-630.dat	upx
behavioral1/memory/2072-632-0x00007FFA414F0000-0x00007FFA4151D000-memory.dmp	upx
behavioral1/files/0x001900000002ac56-642.dat	upx
behavioral1/memory/2072-644-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp	upx
behavioral1/files/0x001900000002acb3-643.dat	upx
behavioral1/memory/2072-646-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp	upx
behavioral1/files/0x001900000002ac59-647.dat	upx
behavioral1/memory/2072-649-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp	upx
behavioral1/files/0x001900000002aca1-650.dat	upx
behavioral1/files/0x001900000002aca4-651.dat	upx
behavioral1/memory/2072-657-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp	upx
behavioral1/memory/2072-656-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp	upx
behavioral1/memory/2072-659-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp	upx
behavioral1/memory/2072-655-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp	upx
behavioral1/files/0x001900000002ac47-661.dat	upx
behavioral1/files/0x001900000002ac53-662.dat	upx
behavioral1/memory/2072-665-0x00007FFA41710000-0x00007FFA41729000-memory.dmp	upx
behavioral1/memory/2072-666-0x00007FFA45A90000-0x00007FFA45AA0000-memory.dmp	upx
behavioral1/memory/2072-663-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp	upx
behavioral1/files/0x001c00000002aca8-667.dat	upx
behavioral1/memory/2072-668-0x00007FFA380D0000-0x00007FFA380E4000-memory.dmp	upx
behavioral1/memory/2072-669-0x00007FFA380B0000-0x00007FFA380C4000-memory.dmp	upx
behavioral1/memory/2072-670-0x00007FFA36E20000-0x00007FFA36E42000-memory.dmp	upx
behavioral1/memory/2072-671-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp	upx
behavioral1/memory/2072-672-0x00007FFA2C7A0000-0x00007FFA2C8B8000-memory.dmp	upx
behavioral1/memory/2072-674-0x00007FFA36000000-0x00007FFA3601B000-memory.dmp	upx
behavioral1/memory/2072-673-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp	upx
behavioral1/memory/2072-675-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp	upx
behavioral1/memory/2072-676-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp	upx
behavioral1/memory/2072-677-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp	upx
behavioral1/memory/2072-679-0x00007FFA313F0000-0x00007FFA3143D000-memory.dmp	upx
behavioral1/memory/2072-678-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp	upx
behavioral1/memory/2072-683-0x00007FFA457E0000-0x00007FFA457EA000-memory.dmp	upx
behavioral1/memory/2072-682-0x00007FFA313D0000-0x00007FFA313E1000-memory.dmp	upx
behavioral1/memory/2072-680-0x00007FFA31370000-0x00007FFA313A2000-memory.dmp	upx
behavioral1/memory/2072-685-0x00007FFA30DF0000-0x00007FFA30E0E000-memory.dmp	upx
behavioral1/memory/2072-684-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp	upx
behavioral1/memory/2072-686-0x00007FFA2C010000-0x00007FFA2C79A000-memory.dmp	upx
behavioral1/memory/2072-688-0x00007FFA30DB0000-0x00007FFA30DE7000-memory.dmp	upx
behavioral1/memory/2072-687-0x00007FFA380D0000-0x00007FFA380E4000-memory.dmp	upx
behavioral1/memory/2072-700-0x00007FFA380B0000-0x00007FFA380C4000-memory.dmp	upx
behavioral1/memory/2072-730-0x00007FFA36E20000-0x00007FFA36E42000-memory.dmp	upx
behavioral1/memory/2072-735-0x00007FFA2C7A0000-0x00007FFA2C8B8000-memory.dmp	upx
behavioral1/memory/2072-771-0x00007FFA36000000-0x00007FFA3601B000-memory.dmp	upx
behavioral1/memory/2072-772-0x00007FFA489F0000-0x00007FFA489FD000-memory.dmp	upx
behavioral1/memory/2072-788-0x00007FFA31370000-0x00007FFA313A2000-memory.dmp	upx
behavioral1/memory/2072-789-0x00007FFA313F0000-0x00007FFA3143D000-memory.dmp	upx
behavioral1/memory/2072-798-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp	upx
behavioral1/memory/2072-802-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp	upx
behavioral1/memory/2072-817-0x00007FFA489F0000-0x00007FFA489FD000-memory.dmp	upx
behavioral1/memory/2072-815-0x00007FFA2C010000-0x00007FFA2C79A000-memory.dmp	upx
behavioral1/memory/2072-809-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

Processes:

setup.exesetup.exechrome.exe

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid	Process
1056	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

chrome.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
behavioral1/files/0x001e00000002abeb-515.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exe

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

Processes:

cmd.exenetsh.exe

pid	Process
4860	cmd.exe
4812	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

Processes:

NETSTAT.EXE

pid	Process
3040	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	chrome.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

Processes:

WMIC.exe

pid	Process
1988	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

Processes:

WMIC.exe

pid	Process
4652	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

Processes:

ipconfig.exeNETSTAT.EXE

pid	Process
2172	ipconfig.exe
3040	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

Processes:

systeminfo.exe

pid	Process
4356	systeminfo.exe

Kills process with taskkill 8 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
3400	taskkill.exe
1108	taskkill.exe
2004	taskkill.exe
2760	taskkill.exe
2120	taskkill.exe
1124	taskkill.exe
980	taskkill.exe
1032	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133769541508352058"	chrome.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exepowershell.exe

pid	Process
3712	chrome.exe
3712	chrome.exe
4976	powershell.exe
4976	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

chrome.exe

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe
Token: SeShutdownPrivilege	3712	chrome.exe
Token: SeCreatePagefilePrivilege	3712	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

chrome.exe

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	Process
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe
3712	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 3712 wrote to memory of 2832	3712	chrome.exe	84
PID 3712 wrote to memory of 2832	3712	chrome.exe	84
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 1048	3712	chrome.exe	85
PID 3712 wrote to memory of 2136	3712	chrome.exe	86
PID 3712 wrote to memory of 2136	3712	chrome.exe	86
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87
PID 3712 wrote to memory of 236	3712	chrome.exe	87

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
5104	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DexLogo.png
1⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3093cc40,0x7ffa3093cc4c,0x7ffa3093cc58
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1848,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2036 /prefetch:3
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4408,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4744,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:2872
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff70e824698,0x7ff70e8246a4,0x7ff70e8246b0
    3⤵
    - Drops file in Windows directory
    PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3760,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3792,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3452,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5116,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3340,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5452,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4552,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5168,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5668,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5684,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3320,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4364,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6052,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6040,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5876,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1560
- C:\Users\Admin\Downloads\Exela.exe
  "C:\Users\Admin\Downloads\Exela.exe"
  2⤵
  - Executes dropped EXE
  PID:444
- - C:\Users\Admin\Downloads\Exela.exe
    "C:\Users\Admin\Downloads\Exela.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:2416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:1920
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:4652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      PID:3488
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        
        PID:4892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:1044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:1908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2256
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      PID:2712
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        
        PID:1688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:1236
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:3856
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      PID:1672
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
      4⤵
      PID:3408
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
        5⤵
        Adds Run key to start application
        
        PID:3896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
      4⤵
      PID:804
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
        5⤵
        
        PID:1120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:904
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3712"
      4⤵
      PID:2480
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3712
        5⤵
        Kills process with taskkill
        
        PID:2004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2832"
      4⤵
      PID:5004
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2832
        5⤵
        Kills process with taskkill
        
        PID:2760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1048"
      4⤵
      PID:4572
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1048
        5⤵
        Kills process with taskkill
        
        PID:2120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2136"
      4⤵
      PID:4524
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2136
        5⤵
        Kills process with taskkill
        
        PID:1124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 236"
      4⤵
      PID:4612
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 236
        5⤵
        Kills process with taskkill
        
        PID:980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3972"
      4⤵
      PID:2096
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3972
        5⤵
        Kills process with taskkill
        
        PID:1032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2036"
      4⤵
      PID:4776
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2036
        5⤵
        Kills process with taskkill
        
        PID:3400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1560"
      4⤵
      PID:1020
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1560
        5⤵
        Kills process with taskkill
        
        PID:1108
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:1584
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:1240
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:3268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:892
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:4284
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:3032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:704
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:1348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      PID:1200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:4976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4860
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      PID:664
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:4356
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:4852
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        
        PID:1988
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:764
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:2644
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:4380
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:4084
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:1932
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:4992
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:3376
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:1808
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:3480
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:4464
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:2136
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:3796
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:4924
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:4792
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:2172
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:1784
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:3364
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:3040
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:1056
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3872
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:1036
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:2748
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4512

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ea5106808a22a100c0a620c618bf0772

SHA1
d10d374871e00162b062962021d5932dce3d135b

SHA256
4c9410cccbcaa442a3571d0f03495faaf16bbba922d123bd126b8fa4a4cec7e6

SHA512
9598751b617318460e06c5f440f4d97b8763668987e3f3348bcc4cd1a0b072fa1f33438f99ba4b1a4a788fc1f7f038c254f8ef0ac0fd900eb33c2bc3089f25a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
49KB

MD5
8991c3ec80ec8fbc41382a55679e3911

SHA1
8cc8cee91d671038acd9e3ae611517d6801b0909

SHA256
f55bacd4a20fef96f5c736a912d1947be85c268df18003395e511c1e860e8800

SHA512
4968a21d8cb9821282d10ba2d19f549a07f996b9fa2cdbcc677ac9901627c71578b1fc65db3ca78e56a47da382e89e52ac16fee8437caa879ece2cfba48c5a6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
167KB

MD5
76f5c6dbcc4339ea6beb2bd207b3b7de

SHA1
45a9200053ed7a20a071741d459248bf84895853

SHA256
8771f8f89332dba5f5edcd3d1a22d7b33b81b44c8d627472d987ec7b03216813

SHA512
c445cdfe59d14b76f5f56c5b30edf6f64bf3940aec89b7c30224beb6cec41c0e3dbea4ea71bc4515c124342c7e383bebd9601d9a69ecc7ff12a6052df2ef5d89

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
102KB

MD5
d8522bf05a310f2ad4447869d2f87c0e

SHA1
3e14fb23b9657529f2771aab7f441c713f1fcb05

SHA256
5ec00b802395903d22b5f2e1782c7bacf6242f0d18cee668c98f23414d2e0e3f

SHA512
f4d8ed46859dcd316ee1e79c4f5c184e4eaaea51619467544796e4296945184828be14e43a65bd48d6418d60fc7a0f8f21832d77c984047b06bd389cc2018fb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
99KB

MD5
1775a2de8e864d834c3a0a0cfcb3dd25

SHA1
7ceaff40e292d8dff5ae8d231d885fbb88ce13ec

SHA256
5f857b6788f0c32bf13967765923fd0fb962fb2aefae2efdc6385041d3067041

SHA512
f49c834a7deb5c3ba6e9c872911f24875e5f2d0874ff47a17f6764c874482369a835632580f57ca822c1bcdd73a701d0c2ecaeafcee2c81fece618b39971138a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
19KB

MD5
4a95afba649e8d4fad3cff81980aff08

SHA1
044798ae8471aa7a2177c50d9429e44a1a539bd3

SHA256
86fa7d0aeb7e18f63d966264dba1761c0e0bbf1d75f25a28262fb0c08208d05d

SHA512
2f0a7c340ee344e627d41f396ff37c92ca733839fe70a9ac3c8f8058930da0025d7743dc01d4b9b785dedfce8cefa17f25ee998200bfff17d8b402bcf7539126

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
42KB

MD5
164be23d7264175ad016a13a0bcaf957

SHA1
c35ce3510b46a12a5ad3f73edc9ac18eb1e8018c

SHA256
4bb1ef87d7b93cb72976e936bca7f607d5dee5517dfa739fcf403a2cd130f6d7

SHA512
7dcfeb8007467dec38af535e1240cbd15e951735720e66e5887d7c69404edc2b2737fce054a369726b46b5a2038bc296b136615dc981d56cad7a8d674cb88aba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

Filesize
22KB

MD5
24fdbbe5166a53bacc707c93c28f2080

SHA1
6cf5abe9908cb8993d39c73bffd4186f5b038c5d

SHA256
ed1f3ca8bdaa2fb78fc141b6177f62471694268c5dabc136c8c1bf0b440f7cf2

SHA512
141fdb18b95be3969ba9d4c43d8fb9a98bd2c4ac4fecc7d7d7c3519656b915a29efd47ca46f77e511f315d5e1bf664f0bc6ce98f176105421ccb5f1496122518

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
29KB

MD5
24b7febceabe22846d8a553396b172c5

SHA1
678a0160e54254e918e44754ac1f60c91d202ed3

SHA256
60443cd90688dbe05437ae37062a761097cec2d17373cca62913c2abedc02190

SHA512
d5b79d81290a0d0f55952217cc9b0846b92e64762361af79ab1acf0674456e576b748b7b810a31f83f5b7b9fea7bfc5a3e222d7ee6a7b72c4fa32c4b624624e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
31KB

MD5
6d2e861e5abfe019d20acfbee1e8b693

SHA1
7303a071b36007b343108fa6b6c3da959bcf67e7

SHA256
e2acb73f603e9917333c81ce9735620f435d73daa8459d347624b4762d4097fb

SHA512
212fb6eefc98aabe0eb222f0d2870258239913aea5a35d2bdcba9a127453ec037ffcb75d3921cf9b573d4fc05978b2419f494bdb92e366d7cb545bd0c0915126

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
16KB

MD5
7d73f18dce766411b8ff2e59d1ca52f3

SHA1
0c9f4fbb70cdf2c277cf89fde5bf2e614673d43c

SHA256
7bc425e067df800599ed529bb14e8335f675e585678913dcae0e84417229a549

SHA512
6f6a156e316a128d79ea06b5777585daf4c1c2e001520caa38f686fd20203f9547e740b339e3a7112f7c1f498e8cb67d471ad4d0beb45e92593d95ce3e99b831

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
600B

MD5
f184698f00ccccdb0ae4a7d9c4ed8241

SHA1
be5aa8a1f063aa6c3f0417a0dc8715d431ad560e

SHA256
0ef476624b0c4449a80f8cc50f521c630b7d079bbcbc961c3c909c96f8ee17bc

SHA512
89a48696da924b367e4f64f7a293960d70d76a63cceb99a56691ab5196bdb783354ec57efdaa33d9fd8714e185436944b9ad1f5f646c7eb3a0e7bc34d100865b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
dac7bd3c965a7a71ae7e9f33e202aacd

SHA1
294747a7d6bf299f5dc2a02b5935500f6fe555b7

SHA256
5c5b353a2e528e9933c7227ce4569ac7032057df976ed37c31854efdd1c5f97d

SHA512
dd2e9c875f636f3296688c6a932930fec19dacccfc22b66058ee7ef49c97885505696aa3d7397ce8813916c07b3e99a5a5962332261cb5b13741b86c0c7cdc76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7002ac1d025d251ccd7b10a7d28fa035

SHA1
cf2d31660b57dde60b7eada546558b312ffd14df

SHA256
153772a90682a0acb6c1c629fb0ac6e72f4c44dec752a573c0bcce0a90374985

SHA512
5b185ba2a60d1d11d94a20a0a0b0cfbb3b6155174186a9d25961d854ec599b1fbe26a24446af3502ec38de15c68c9a02efac11d84ea229d98b919082f5df6c1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
91dd2eefd3c4da632a41148ad16e384c

SHA1
d3f34deca3f02bceaf584503319c1df881c73e5e

SHA256
c868f24f88e19c4c738be6a8ff8b5a648211dfd02021aefbc3f2ce4dea2f562b

SHA512
03c63488137993c77e7c90f127c0e664f203bc721565b40e6e296f34214438b840e5f10db496e83aafef78b3f01f95bfc2ec5c1d15e621e4b022ea898bd40eb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cf97f553306531659a647725a1eef595

SHA1
2580b411f4d487e8f20b0b2008672541c4f85b45

SHA256
3cd30e4f79d953fd93fe9d3380d1bd331a58a50f2df82285d847409e39216c73

SHA512
de9de8c49d1243af46e23cce64c6edc10a591ac897a912ec8d9095c7a0f9d3ad03405c2ba4f40d389e1d3bf8846368e1e62cb4f33a1ce06dd68a6b82633520f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
20fed111ceeae61e179cade300e6c7d4

SHA1
221540f7724b0cc65818d9ddf4a12daca092c82e

SHA256
03496a3de3c9153fe460c642d150448bbac538d040527a5f20ced58dc4879f87

SHA512
a91282591866c36445eac3debeb8def9068bee11cde28470ce0a41cb499948dc56dba31d8a2640081be1dcc207942e16f14fc967e8efea6f350ac72893b5adac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8b5a22b5dddf4456eea3cb79c4e46c49

SHA1
3e415a8f572d311bca521796ceb1085fa1841820

SHA256
35e9b0f753e1440e856a74a3e879f1dbcb21732da7d4527101866c52ebd03e35

SHA512
1bc95734c4b3132ff86c2fc62fa7df9084cfede237bac81cdf1dbe175d083053cf74320dd58722fee81b294837b91231290594c3d29b0cc37087fce3e82aa837

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c3f713417c9bc9831f97dce63a663a42

SHA1
9b7b459edf60d760ee62aa742034e50e8e7482e1

SHA256
da5467b3beaedb913e56a3ca1bcb3719e15d380ce7d270cad5dca5eccd1ffd71

SHA512
d665093ec89598f713c3e407fb45d1c1402b915d8b94c0efe730b5869960a025ff1b9ee75b4c7fee8dd278987a27f563f5567411fa95dd0be4e16994dc4f5e7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
39f838839cf8de972cec14cc89f74039

SHA1
c2ac83745b938d84206b010c4dee9f77a92dcabf

SHA256
f355967d6c02bf50286bd73abe42b173c12effcb26e9ca4dcb096309c512f5d4

SHA512
bfad1da25989df8b10e37a6133f412debdb6536d9b237fa72aab178f3d42187cdfa14e28a48ced7e254b11ba14d367ee5afa49b1846358012e752b920926ddb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1d533273f42aff2f8fa25b4842b850ba

SHA1
89320d52a0bd4888b23d3bd756cdf8511c95279f

SHA256
9b7274f49c75f8c7353a66a6cd9e97d05841230508098d328ad909ce457bd3af

SHA512
ca6b07cd3ee0262c970f263d3c958442b0d1881c405142173104d5c90232a5be58b19cfede7cc8b982108fe7cd0cf6f5a4d7f8ef1347d8d281f9168992599799

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f14f0231a0ce2ca7f584b52c91273b34

SHA1
3eea3e4ebc40e41d26b8229f7cc1fbbb5d91247a

SHA256
1ec02c1dd4175ac4bbff278e6ee75c9b54ec50670c9664d9bf747f4e4436dd35

SHA512
4c16ca81442c0d9f9176c58b12ea067f90de577dccc4e0f353c9dafd6cb4092fc207feaf9d39402953d35725992b17515b0e3322055cccd4de1232da707a3088

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
26f49df9643a39a8eb648c68994505b8

SHA1
a7a4b1482ac2c377421ec584573a4204a7a5f280

SHA256
fd935b8e3142e4308825ad6dccd8446636926eadf644e207d1ddcf442d46572d

SHA512
640ec13bf03715c2e9d514554a2241fc53526040a5c50cd26052dac2664bcd5cc9407d1396a324244835c3209fc21fef8de8adb8005c7aa844ef07994f92fd51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e6d7594122091f344b5bdc1e1e4c50cc

SHA1
c06a5a6c0fbf39e3df6715212894d54cc4748650

SHA256
4d227c5302acd08559c9ad1b18c0e279384e34b6aee82e65113ef0bccfb55c4a

SHA512
fc351e921b81d13c13c02f4a47762f3a1bed88da865a3a5ef6cacf8e14b173659e3cb3de8ac56b88edd5a07fbd1b832fdcd430621435a1ccb09155352cae531d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
5711ebad304e3f16bced45ae20aa8fc8

SHA1
dd89ee88fd9bd2e6ba13deeef5c0792385125c84

SHA256
c2f89fadaaaabd45b8606b2ec7ef113fe6c59e59228a5b3bb53ed166b227c3f5

SHA512
f4af3e6273113acaeecac93059df93913e0ea2163daefd5c6c39b35fe58599a55bd38a12f6a73bb322e95ccdfe1dd6016f5598879f2ae1eab47b225c6d63d88f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
6ae3372dee33e8d53e02d9e69a05bb15

SHA1
00debee813c5cc6ac40d3a325c6af996487be2d1

SHA256
45eeac7d162b0c78db3b89e9ba526ab3c9975a92020e71f00a9de880f39b382d

SHA512
f987f5ba62ea596e9e8edb9871a87a11f2f48d0a2b49ab843963293697e3229fa5bcf9e441447a586f28db7218d0ec35dafc934cf159b0eeb9f47a5212a5ccf4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
e4f82e246f2902ad78217ccf97ead563

SHA1
247e855e3df584c792dc47e550217ba445b0822a

SHA256
c046efaea0862d90acb14c3d69df2ba6746d58a6962cc9bbd3af156f8a04d00e

SHA512
2ccbe9be1829d3223514f01884e2d5dbd3776c1846b5550c52ec665ec907b8eccc5a18bef9d7ca8b8ca72ca6920a8ed3599dad08d5090ebadfa29e3ec8008e63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
ee742991b08f550c5d28360dfa347aef

SHA1
670e49824bdc82f73a07453e38ce66e760f8c9f2

SHA256
097417f8e81123e9965eb0b8c0233e6487ca3c062f89f240e3383058029dcef8

SHA512
3328dc01b19950a2228fe3ee529a261b70491fac51c6c290354c948bd96a1f839de7c288611ddae98e3ba42754073a6fde0abab0d98d4b5c552c5c3e66d47857

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
236KB

MD5
400f7309a4ad52d6243cc1414ed1aaf5

SHA1
247a93bdf95469a3691927b6122dea1f4a63ddbb

SHA256
5e12fdc6e4dd7cd270c921eae84a9a8ba107a75e3492c03efc259ea2ffc8549d

SHA512
de3f8f7d68f73aea3a59e3ab3b777783291134ec4f58834c04ce2c661622a41e5699a86f4dcd2981c38b433dd64cd195d871bd99f1501b20c73cbbc9ceede32f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eef5490c-50c1-4b85-a083-b73387da7815.tmp

Filesize
236KB

MD5
b445b6dfaa7492aef52803869e237188

SHA1
1e80e2878af504b6181c0275604da5cf942372b2

SHA256
afe8ee1f4eadd7eb06c5353c86f6cd58230ad8b516934fd6a4d3aeb0f96a3487

SHA512
5dbc4db3c7c675e6f360b7d3decc3b7999aa7fb35603216bf8335065b611d55c2d97609c6ead4e24674c12b71d3d3d9767e9bd710b5a33705ba60bc20ac3cf78

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupConvert.fon

Filesize
422KB

MD5
2f8a8f99e354e654e50c0bfee72292b3

SHA1
560f4083aaac0c220a7904aa5f5464e7c7a2fd86

SHA256
affe0740a04960423a3fea091c26f8c2136271aa0820e414fe173194bcc558c3

SHA512
ceb76f813bf636a8c55cfba162a30f8b2de4382686764b31d63ceafc3775b1b6033de1ae07e04add33d2cb3e75d2970ea0344d351434e6fee5f244f213278b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\NewSwitch.docx

Filesize
15KB

MD5
71a951e976c73a8d8e5b665f906b14b0

SHA1
02a69d4cafd699cf4d99a154e0c1a22c396fc564

SHA256
542eb0d2f2871916059215ec721a844087f876e4c29a37d663ffa23a59f5e687

SHA512
19edfd7921347b615764e49ce742b7e366b13d5bf7002d2a133757e115a8ff286c975bb5a423c7bcac4562b6327e62bed6f1068a19399890f0c3134940cf7a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\DisconnectRequest.xlsx

Filesize
12KB

MD5
99c29c88b30e73fbacfd34f38f6cdb72

SHA1
9ecab908261eb0c5a0fad8a9d838b34451e60d20

SHA256
929d9d78deb4868c36e5cb9d59f05b8b59d4b847484b94f13588ed75034af88c

SHA512
1eda86f597f4e941003422bcff596cebffca8203e633800e99d3c20fe1b85b8deabef4128c744524e9e7aa7cfadecd899e2aebb5e58b06ac5b117a73b2b057ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\LockApprove.docx

Filesize
15KB

MD5
f5d4dfc70ef3dbfaf1e25eb611ee50ba

SHA1
e2a726c1cf7e6ba8e2e46d8562b00fdb146ab807

SHA256
f5c0fba20d4617ede794aebe2912458311dba14f73b9fb7771fab4b9d2eb0f21

SHA512
3d5eb7fc7ef1a7f8a4d8f60913925124746610961bfbda9cc6d77354ebe8d7394f18ca3dcc803dd2b6271039c8bb7fb18722cb874fabe23c725ae14479411783

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MoveStop.xls

Filesize
717KB

MD5
4dfc31f6bc1e2060664c472999397db9

SHA1
cb8691f74e3351e9474f5098813da00aca300338

SHA256
abbc08f558c4a8509c5ae3332c1c507a64122ec121db77a562516a452251eb8e

SHA512
95c992f41976f8b93cf4c5c008aa530ee5f342d8765a59baa5e6c4664954bc1c4dd221e9e8fd962a67fa0948b3eae86ec2f7307441bbc653f97181b409a562c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\NewCopy.xlsx

Filesize
15KB

MD5
93d5c0451a53435a664a3b6d4c4ce804

SHA1
2339ae3992edce8406ea51b1f6c26886e12ff3c1

SHA256
f2204ec642dda135d1c3739954028f6e1f9a59f68eb4d99e52fc94a52d2a162f

SHA512
7417fd977bd2b1dc82abb0c7b8c6b185be04d266faa4c96a1e4c744a64d7bbca327be362d0bed4e55bfea71e5cacc948eb3cccdca9271debaf13dc10561c283d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ReceiveApprove.xlsx

Filesize
11KB

MD5
8ff2bfa84f5a98ad2c50f9772884d24c

SHA1
212dfb261e83cea57c93d836e6b57240dab31df7

SHA256
bd25478f6e50299cd2fafa6b55c0c4e00003f6481a3278b91807ea144cb48068

SHA512
bedac23ea281f64d6a95a8815940c0e0357c7ee24fc2b5dc993b4fff72e00827ff12166a24d77bb9ebc6ba6a1ee6d18d238d9669d52d93b8fa28b2873223d4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RestartSync.docx

Filesize
16KB

MD5
83cf49f182a3b982ae366cf638e472bb

SHA1
8070d403a6929dcd4e60ad00f00bfa0fad796558

SHA256
1575d1dcfa119bee4122ed9ba9043f72b656a91093a3c8668e741a67e5ec5d4d

SHA512
3328127847e891ee0c865354ecef8b198d0a2702db14064de1a5a8298bf43b6e74e9c8aef927e93a6e321dbfb9cceb061ccd31030cc892fc9854573260f0dd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SaveRestart.txt

Filesize
566KB

MD5
ae62b309de6ad29fe8442fa3a8d847d9

SHA1
0c97005e70916a4030646c6e06864c98826866c6

SHA256
868e7224b7683614825b710cdfd8928f09ef07281bf800a846aba01868d7d093

SHA512
c19dfd80ebae1b33bf59334d9c2cdd526fe22981c46304ab9c293443412016c8af0d3faff0bf0fbb721156bf94a478a713796d8a81c28d6da8d108faffdd733f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\WaitClose.pdf

Filesize
289KB

MD5
266560524bd9c92d9dcdfe67f30c4417

SHA1
6004679e1fb2bf57a22260cc3c928b75f537efb3

SHA256
600b6f0f2a971586f65325b5b8503716ca18ab801264ce1c3654a1b4906b7ad3

SHA512
aa43a1aca43d8476b35a61dbf3439de83b5c38da6b5c097e1b7de960d8e75430e75097eb83ab7cd176d0705ac5fd171c712c46e4985689d6c75fdaa517114021

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\HideSelect.docx

Filesize
680KB

MD5
33b01acc87d8700d5f60ecdd2ed84d92

SHA1
0237126aff5a49e5f021bc9528db93b644528d10

SHA256
d3d19f3337f443bb9798ce493c47c2cdba9e68b4d052dbef54ce0ef1f2e90386

SHA512
e7c3817f5963d119077cb5cea264bab04f1fd10c1a33fed52f5235dac57a8795755fd6154f9e10c3e9c4f5882aabc2967b2fe32a6d3ee296a39a413a37b54e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupUse.emz

Filesize
496KB

MD5
e688bc1e969891d8f1f2c09ceecb6e9c

SHA1
0ff765b7fb7c332cb3f5338fc13bed33f5d3a125

SHA256
1c73408be4ec0731161c0edfe03e94aef623ab757e808335701dfb8d4725da1d

SHA512
9b1666e8b00efd3dfaa63223124b5e8e7a75fb744c922ca6d5a19610c887b32597e3d6ac97b37d20654e78221999dfa3e3209a0e5d20c5012300864d6a1fb2b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\PingPop.txt

Filesize
300KB

MD5
4d4a929b4103f00eba436612e29fae1e

SHA1
bd07ff2f36e21e0c1c8c592045165b00e26328e7

SHA256
270a9527db65fc7447792e4e673bb66ddb439a9f371c531be948fad16b1a81b9

SHA512
f9cd8fde5e24e1023232fc5bb03f2f4f84d6f5ced398d48d9adcc4dfb6fbe2453697d45cb15ed7b86fbb161bf1966902d8821f18895f051a6cbdf825b7f28fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SearchOptimize.png

Filesize
313KB

MD5
7b5b024fc800c2ea2c844cb986c7a274

SHA1
360b311cb57b4596763a711c3685465a96ae9270

SHA256
c137fd68a58a996d1ea82b4d50e46fce979f209ee0a43ec006661122348e32e2

SHA512
164e674bf3d5d69bdb37d999b7f034b3b69d29d700450343fe01e5f2c0f4bf51133a10a36b2033a52e6bf5ded017ff7bddcc44091262fff77fe026801ffe6f16

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SendSync.jpeg

Filesize
182KB

MD5
693641fbbc5697d0e69864a6317c148d

SHA1
4447c0e0ad5ef7e48e44f76dcdf3ba6734af3f23

SHA256
9887a83c9cf8f49a1d76c8efdc4fbba287f6ce257de3db49c3903747daed0a40

SHA512
a9cc9897f32d292236bdd3a67746bc1b444ad771d22f46aa3d40b5914229ec2d3ad2ab7606f8fa71d695c60daef3927a5ba22ef97856186e20d9402dc5852257

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CheckpointSwitch.jpg

Filesize
762KB

MD5
9c7665749ff0d0666e247073f30494fa

SHA1
3d89c50af61b059c5d041e8388510fce866cfdfe

SHA256
7a3d1988fb01891dbc0e97df87242b0cc7cb1b988fa15d4a13781201519553f8

SHA512
4fc634ca01f94b51ebefcb31c878d3768513377cfe529d575442ed89cc93f2821ec937d2bdfd36b6614ee8f325426307756ae88099fb6ba8236b81647c9e438e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ExportComplete.jpeg

Filesize
716KB

MD5
29f884b7a274aef9597a791041e45fab

SHA1
5f4796b8c13900cafc67be315fe7b2bd23fa7131

SHA256
86f06a3bb62c17c74f383a18050a47afa8560f316ff70eaed990b83f696ed84a

SHA512
131f297369bc032964744cbe7180405f32bb975cee4142d83aac6afc09e90afa7b32b095da64b3af4d1949e1391f517e433e27b3f69a657776160ffcdbfe1775

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ShowExport.png

Filesize
416KB

MD5
4df50fcaf3be03b8145db2cce22f229f

SHA1
afa4e7266a2ca3873c75b736b6a1cbde5799077d

SHA256
884cf4af3ecfec6719411f509c597426c2abc99ef319c6d491c3cbeaafad393d

SHA512
32cc91839184754de8e327d4cd9323beb58f2c5d2b754901726d27b38d9ee70218ba4c78360604f4ee6857c1c27054941a7e1a4e8c6a4c464d6f4870457728f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UnlockBackup.png

Filesize
785KB

MD5
825a8e37ed32c17647dcc8c58bfad430

SHA1
fe7344f0d06aa3fe98181c391ae20f4670fee87c

SHA256
a48a0f472ab43f95cde52fd8ae00c3dffe11c9117fb1c9fa916af484d7f16aa7

SHA512
425f2cb4039e579a43afcd2e61dd9e93ab23319c8ae67050fceba67fc6937d563f4adfd7871f334144e1a725d18c2099e803f2f59383a6bdee297aa4a6439994

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_asyncio.pyd

Filesize
34KB

MD5
6de61484aaeedf539f73e361eb186e21

SHA1
07a6ae85f68ca9b7ca147bf587b4af547c28e986

SHA256
2c308a887aa14b64f7853730cb53145856bacf40a1b421c0b06ec41e9a8052ff

SHA512
f9c4a6e8d4c5cb3a1947af234b6e3f08c325a97b14adc371f82430ec787cad17052d6f879575fc574abb92fd122a3a6a14004dce80b36e6e066c6bc43607463d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_bz2.pyd

Filesize
46KB

MD5
d584d4cfc04f616d406ec196997e706c

SHA1
b7fe2283e5b882823ee0ffcf92c4dd05f195dc4c

SHA256
e1ea9bb42b4184bf3ec29cbe10a6d6370a213d7a40aa6d849129b0d8ec50fda4

SHA512
ccf7cfbf4584401bab8c8e7d221308ca438779849a2eea074758be7d7afe9b73880e80f8f0b15e4dc2e8ae1142d389fee386dc58b603853760b0e7713a3d0b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_ctypes.pyd

Filesize
56KB

MD5
f0077496f3bb6ea93da1d7b5ea1511c2

SHA1
a901ad6e13c1568d023c0dcb2b7d995c68ed2f6a

SHA256
0269ae71e9a7b006aab0802e72987fc308a6f94921d1c9b83c52c636e45035a0

SHA512
4f188746a77ad1c92cefa615278d321912c325a800aa67abb006821a6bdffc145c204c9da6b11474f44faf23376ff7391b94f4a51e6949a1d2576d79db7f27ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_lzma.pyd

Filesize
84KB

MD5
213a986429a24c61eca7efed8611b28a

SHA1
348f47528a4e8d0a54eb60110db78a6b1543795e

SHA256
457114386ce08d81cb7ac988b1ff60d2fdffc40b3de6d023034b203582d32f5d

SHA512
1e43c2cacc819a2e578437d1329fa1f772fe614167d3ec9b5612b44f216175500e56e3d60a7107b66a5b3121e9e2e49344ebe9ff1b752cae574bb8b60eec42ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_overlapped.pyd

Filesize
30KB

MD5
b05bce7e8a1ef69679da7d1b4894208f

SHA1
7b2dd612cf76da09d5bd1a9dcd6ba20051d11595

SHA256
9c8edf15e9f0edbc96e3310572a231cdd1c57c693fbfc69278fbbc7c2fc47197

SHA512
27cef9b35a4560c98b4d72e5144a68d068263506ac97f5f813b0f6c7552f4c206c6f9a239bc1d9161aff79742cd4516c86f5997c27b1bd084e03854d6410b8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_socket.pyd

Filesize
41KB

MD5
02adf34fc4cf0cbb7da84948c6e0a6ce

SHA1
4d5d1adaf743b6bd324642e28d78331059e3342b

SHA256
e92b5042b4a1ca76b84d3070e4adddf100ba5a56cf8e7fcd4dd1483830d786a5

SHA512
da133fc0f9fefed3b483ba782948fcdc508c50ffc141e5e1e29a7ec2628622cdd606c0b0a949098b48ee3f54cdb604842e3ca268c27bc23f169fced3d2fbd0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_sqlite3.pyd

Filesize
48KB

MD5
b2b86c10944a124a00a6bcfaf6ddb689

SHA1
4971148b2a8d07b74aa616e2dd618aaf2be9e0db

SHA256
874783af90902a7a8f5b90b018b749de7ddb8ec8412c46f7abe2edfe9c7abe84

SHA512
0a44b508d2a9700db84bd395ff55a6fc3d593d2069f04a56b135ba41fc23ea7726ae131056123d06526c14284bce2dbadd4abf992b3eb27bf9af1e083763556f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\_ssl.pyd

Filesize
60KB

MD5
1af0fbf618468685c9a9541be14b3d24

SHA1
27e8c76192555a912e402635765df2556c1c2b88

SHA256
a46968ca76d6b17f63672a760f33664c3ea27d9356295122069e23d1c90f296a

SHA512
7382a0d3ec2ce560efd2ddd43db8423637af341ce6889d335165b7876b15d08f4de0f228f959dcb90b47814f9f4e0edd02d38a78ddad152ed7bc86791d46bc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\base_library.zip

Filesize
812KB

MD5
524a85217dc9edc8c9efc73159ca955d

SHA1
a4238cbde50443262d00a843ffe814435fb0f4e2

SHA256
808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621

SHA512
f5a929b35a63f073bdc7600155ba2f0f262e6f60cf67efb38fa44e8b3be085cf1d5741d66d25a1ecaaf3f94abfe9bbe97d135f8a47c11f2b811d2aac6876f46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\libcrypto-1_1.dll

Filesize
1.1MB

MD5
9c2ffedb0ae90b3985e5cdbedd3363e9

SHA1
a475fbe289a716e1fbe2eab97f76dbba1da322a9

SHA256
7c9418ad6fb6d15acb7d340b7a6533f76337ad302a18e2b4e08d4ee37689913a

SHA512
70d2635d42e24c7426cf5306ed010808f2222049915adb43ffc12c13259c8e7a9fee3a49e096d5ba2b6b733fef18574823d00df2e8d7fb1532e1d65d0c478008

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\libffi-7.dll

Filesize
23KB

MD5
8e1d2a11b94e84eaa382d6a680d93f17

SHA1
07750d78022d387292525a7d8385687229795cf1

SHA256
090a90cd17b74abefddf9f82d145effe5c676e7c62cf1a59834528f512d7ee82

SHA512
213bf92a707b14211941e5e071f1926be4b5795babc6df0d168b623ecd6cb7c7e0ae4320369c51d75c75b38ec282b5bf77f15eb94018ae74c8fd14f328b45a4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\libssl-1_1.dll

Filesize
203KB

MD5
87bb1a8526b475445b2d7fd298c57587

SHA1
aaad18ea92b132ca74942fd5a9f4c901d02d9b09

SHA256
c35a97d8f24ea84d1e39a8621b6b3027c9ac24885bdd37386c9fcaad1858419d

SHA512
956bd8e9f35c917cbfb570fc633bb2df0d1c2686731fa7179f5e7cd8789e665dd6ff8443e712eafa4e3f8d8661f933cb5675aeb1a2efc195c3bb32211e6d2506

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
07adf002b8bab71368fd904e8daa545c

SHA1
bd38ea6cca7f10660725c7df533fe33a349a11ea

SHA256
781496f2ae8d0a1cd2899bd643adee7813b33441f0f2c6177ab108148b5109ba

SHA512
20d4747890c957becb15136b4f16280356b74dcd159dac0f93cf853820a88dab5cb86f6e1ef0eff140f35443cdffe81ae0e05bccc573dbd3f54cda9ce0b2633d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\python3.DLL

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\python310.dll

Filesize
1.4MB

MD5
196deb9a74e6e9e242f04008ea80f7d3

SHA1
a54373ebad306f3e6f585bcdf1544fbdcf9c0386

SHA256
20b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75

SHA512
8c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\select.pyd

Filesize
24KB

MD5
16be2c5990fe8df5a6d98b0ba173084d

SHA1
572cb2107ff287928501dc8f5ae4a748e911d82d

SHA256
65de0eb0f1aa5830a99d46a1b2260aaa0608ed28e33a4b0ffe43fd891f426f76

SHA512
afa991c407548da16150ad6792a5233688cc042585538d510ac99c2cb1a6ee2144f31aa639065da4c2670f54f947947860a90ec1bde7c2afaa250e758b956dbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\sqlite3.dll

Filesize
608KB

MD5
4357c9ab90f329f6cbc8fe6bc44a8a97

SHA1
2ec6992da815dcdb9a009d41d7f2879ea8f8b3f3

SHA256
eb1b1679d90d6114303f490de14931957cdfddf7d4311b3e5bacac4e4dc590ba

SHA512
a245971a4e3f73a6298c949052457fbaece970678362e2e5bf8bd6e2446d18d157ad3f1d934dae4e375ab595c84206381388fb6de6b17b9df9f315042234343a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI4442\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffbv2xsc.qqk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
8KB

MD5
6c3586af53a946cfa75b6d95c456a596

SHA1
f09e91c10fa1e8bd6189796b6c32f29a14b8ad59

SHA256
3132b60d90fbb139f27c23bdf66990106f6fe9624e2e7b23174091d8459c8cea

SHA512
3c05d7f02ddd9d6a8aaccffe827d9bd3a31184b6f9606aaa75d97e13e805003deb6dba93d6c5e8608282b2d276affbcfbf68d3a4d8d12b0f9cf7262be5da3d9d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
14KB

MD5
6f888aae6eeb1528598249f5d0e0be37

SHA1
fd0decfee2237c5bc94bc24891a6ad87108fae81

SHA256
e8ce757fb2409d53b8194b3651093ec1bea8824c20045b57f9ea7adb1f42219b

SHA512
bacc8dc209fcb439c0085b8826bc35fffd47c10440ae14bb8b4b281c5ff870cef928a15afd13c864f3252bef2720267bec030ba120f8b74af3f12b05b2689fff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
15KB

MD5
08c02882f8e4fe3fd3efb8b2c7ba75e5

SHA1
cfa1a1237b9b0cc4cb516aa89a1e66b7772620b9

SHA256
90bf9bfff950f8a7ff1ef1fc0294dadcd031edc66072750738e36ed1fa5de17e

SHA512
434dec55d9b18e8bce78001f518f2fb93f521b3c9a9d442fe31539eb3876e9381bbf7ea73037a1381a7e59af5558c4afab75608aad6e6644ea9c661debd89813

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

Filesize
11KB

MD5
91cf8cac24f2c7e5d1b7e3da43a3d7ab

SHA1
3749cbda0b31b6c43486ab96d17e728ea99b44ba

SHA256
29d5533e4a1a461be88324745c5b3394a54b1b00143d962da858ff2ffa6a4d56

SHA512
a2f6c899696f27eae12681adeff4f1398a750f7deaddc7aa0308df52c9ff9ef84994bcee743f7f8c8bfcbcc153ec50388169bafb3397d3b5b4991d6b4a30e4fc

Download Submit
C:\Users\Admin\Downloads\Exela.exe

Filesize
10.4MB

MD5
480239b4bb04a06f340151b8e0d583f4

SHA1
6ec7267f1933e0fdc95504d8a9867ab387f45748

SHA256
b4ea5811b087651179d90e1dd7b8d33cb68206e98d28b9b2bee6f35033a712fa

SHA512
7d807d56826f173945f5809f644de5ee339d89aae43db99bb1cf80355e2e37766cf1c3889c3103c5a1ea1f054a0d9dc707a69671f73a6886b6e6d7d9fa555777

Download Submit
C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\crashpad_3712_KXPCSSYEVBMUDUFL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2072-798-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp

Filesize
1.4MB

Download
memory/2072-622-0x00007FFA41710000-0x00007FFA41729000-memory.dmp

Filesize
100KB

Download
memory/2072-669-0x00007FFA380B0000-0x00007FFA380C4000-memory.dmp

Filesize
80KB

Download
memory/2072-670-0x00007FFA36E20000-0x00007FFA36E42000-memory.dmp

Filesize
136KB

Download
memory/2072-671-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp

Filesize
124KB

Download
memory/2072-672-0x00007FFA2C7A0000-0x00007FFA2C8B8000-memory.dmp

Filesize
1.1MB

Download
memory/2072-674-0x00007FFA36000000-0x00007FFA3601B000-memory.dmp

Filesize
108KB

Download
memory/2072-673-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp

Filesize
1.4MB

Download
memory/2072-675-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

Filesize
184KB

Download
memory/2072-676-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp

Filesize
96KB

Download
memory/2072-817-0x00007FFA489F0000-0x00007FFA489FD000-memory.dmp

Filesize
52KB

Download
memory/2072-679-0x00007FFA313F0000-0x00007FFA3143D000-memory.dmp

Filesize
308KB

Download
memory/2072-678-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp

Filesize
3.5MB

Download
memory/2072-683-0x00007FFA457E0000-0x00007FFA457EA000-memory.dmp

Filesize
40KB

Download
memory/2072-682-0x00007FFA313D0000-0x00007FFA313E1000-memory.dmp

Filesize
68KB

Download
memory/2072-681-0x000001A4DAAB0000-0x000001A4DAE25000-memory.dmp

Filesize
3.5MB

Download
memory/2072-680-0x00007FFA31370000-0x00007FFA313A2000-memory.dmp

Filesize
200KB

Download
memory/2072-685-0x00007FFA30DF0000-0x00007FFA30E0E000-memory.dmp

Filesize
120KB

Download
memory/2072-684-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

Filesize
84KB

Download
memory/2072-686-0x00007FFA2C010000-0x00007FFA2C79A000-memory.dmp

Filesize
7.5MB

Download
memory/2072-688-0x00007FFA30DB0000-0x00007FFA30DE7000-memory.dmp

Filesize
220KB

Download
memory/2072-687-0x00007FFA380D0000-0x00007FFA380E4000-memory.dmp

Filesize
80KB

Download
memory/2072-700-0x00007FFA380B0000-0x00007FFA380C4000-memory.dmp

Filesize
80KB

Download
memory/2072-730-0x00007FFA36E20000-0x00007FFA36E42000-memory.dmp

Filesize
136KB

Download
memory/2072-735-0x00007FFA2C7A0000-0x00007FFA2C8B8000-memory.dmp

Filesize
1.1MB

Download
memory/2072-771-0x00007FFA36000000-0x00007FFA3601B000-memory.dmp

Filesize
108KB

Download
memory/2072-772-0x00007FFA489F0000-0x00007FFA489FD000-memory.dmp

Filesize
52KB

Download
memory/2072-666-0x00007FFA45A90000-0x00007FFA45AA0000-memory.dmp

Filesize
64KB

Download
memory/2072-788-0x00007FFA31370000-0x00007FFA313A2000-memory.dmp

Filesize
200KB

Download
memory/2072-789-0x00007FFA313F0000-0x00007FFA3143D000-memory.dmp

Filesize
308KB

Download
memory/2072-619-0x00007FFA4BF90000-0x00007FFA4BF9F000-memory.dmp

Filesize
60KB

Download
memory/2072-668-0x00007FFA380D0000-0x00007FFA380E4000-memory.dmp

Filesize
80KB

Download
memory/2072-677-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp

Filesize
736KB

Download
memory/2072-815-0x00007FFA2C010000-0x00007FFA2C79A000-memory.dmp

Filesize
7.5MB

Download
memory/2072-809-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp

Filesize
96KB

Download
memory/2072-803-0x00007FFA45A90000-0x00007FFA45AA0000-memory.dmp

Filesize
64KB

Download
memory/2072-801-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp

Filesize
3.5MB

Download
memory/2072-800-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp

Filesize
736KB

Download
memory/2072-799-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

Filesize
184KB

Download
memory/2072-797-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp

Filesize
124KB

Download
memory/2072-790-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

Filesize
4.4MB

Download
memory/2072-816-0x00007FFA30DB0000-0x00007FFA30DE7000-memory.dmp

Filesize
220KB

Download
memory/2072-791-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp

Filesize
144KB

Download
memory/2072-848-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp

Filesize
96KB

Download
memory/2072-841-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

Filesize
84KB

Download
memory/2072-838-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

Filesize
184KB

Download
memory/2072-829-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

Filesize
4.4MB

Download
memory/2072-665-0x00007FFA41710000-0x00007FFA41729000-memory.dmp

Filesize
100KB

Download
memory/2072-655-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

Filesize
4.4MB

Download
memory/2072-658-0x000001A4DAAB0000-0x000001A4DAE25000-memory.dmp

Filesize
3.5MB

Download
memory/2072-659-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp

Filesize
144KB

Download
memory/2072-656-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp

Filesize
736KB

Download
memory/2072-657-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp

Filesize
3.5MB

Download
memory/2072-649-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

Filesize
184KB

Download
memory/2072-646-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp

Filesize
1.4MB

Download
memory/2072-644-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp

Filesize
124KB

Download
memory/2072-632-0x00007FFA414F0000-0x00007FFA4151D000-memory.dmp

Filesize
180KB

Download
memory/2072-629-0x00007FFA416F0000-0x00007FFA41709000-memory.dmp

Filesize
100KB

Download
memory/2072-625-0x00007FFA4BDB0000-0x00007FFA4BDBD000-memory.dmp

Filesize
52KB

Download
memory/2072-802-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

Filesize
84KB

Download
memory/2072-617-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp

Filesize
144KB

Download
memory/2072-663-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

Filesize
84KB

Download
memory/2072-609-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

Filesize
4.4MB

Download
memory/4976-783-0x000001E972260000-0x000001E972282000-memory.dmp

Filesize
136KB

Download