Malware Analysis Report

2025-03-15 03:46

Sample ID 241124-zc5lmstrbp
Target DexLogo.png
SHA256 0ac8093eb7a5cad5f85c462be90ab5c33a093490e3118f1d98846fd5bffee686
Tags
exelastealer collection defense_evasion discovery evasion persistence phishing privilege_escalation pyinstaller spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0ac8093eb7a5cad5f85c462be90ab5c33a093490e3118f1d98846fd5bffee686

Threat Level: Known bad

The file DexLogo.png was found to be: Known bad.

Malicious Activity Summary

exelastealer collection defense_evasion discovery evasion persistence phishing privilege_escalation pyinstaller spyware stealer upx

Exela Stealer

Exelastealer family

Grants admin privileges

Modifies Windows Firewall

Downloads MZ/PE file

Executes dropped EXE

Clipboard Data

A potential corporate email address has been identified in the URL: sweetalert2@11

Deletes itself

Reads user/profile data of web browsers

A potential corporate email address has been identified in the URL: [email protected]

Loads dropped DLL

A potential corporate email address has been identified in the URL: [email protected]

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Network Service Discovery

UPX packed file

Hide Artifacts: Hidden Files and Directories

Enumerates processes with tasklist

Launches sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass

Drops file in Windows directory

Detects Pyinstaller

Enumerates physical storage devices

Permission Groups Discovery: Local Groups

System Network Connections Discovery

Event Triggered Execution: Netsh Helper DLL

System Network Configuration Discovery: Wi-Fi Discovery

Browser Information Discovery

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Detects videocard installed

Gathers network information

Kills process with taskkill

Suspicious use of FindShellTrayWindow

Gathers system information

Checks SCSI registry key(s)

Runs net.exe

NTFS ADS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies data under HKEY_USERS

Collects information from the system

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Reported

2024-11-24 20:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-24 20:35

Reported

2024-11-24 20:37

Platform

win11-20241023-en

Max time kernel

133s

Max time network

142s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\DexLogo.png

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

A potential corporate email address has been identified in the URL: [email protected]

phishing

A potential corporate email address has been identified in the URL: [email protected]

phishing

A potential corporate email address has been identified in the URL: sweetalert2@11

phishing

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A
N/A N/A C:\Users\Admin\Downloads\Exela.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe" C:\Windows\system32\reg.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\Crashpad\metadata C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133769541508352058" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3712 wrote to memory of 2832 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 2832 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 1048 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 2136 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 2136 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3712 wrote to memory of 236 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\DexLogo.png

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3093cc40,0x7ffa3093cc4c,0x7ffa3093cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2004,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2000 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1848,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2036 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2164 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3256 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3284 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4408,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4368 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4744,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4268 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4868 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff70e824698,0x7ff70e8246a4,0x7ff70e8246b0

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3760,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3728 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3792,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3504 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3452,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3476 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5116,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5004 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3340,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5452,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3332 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4552,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3308 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5168,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5748 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5668,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5700 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5684,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3320,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3348 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4364,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5444 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6052,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3464 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6040,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6048 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5876,i,742098301790616618,9888219851040871645,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5084 /prefetch:1

C:\Users\Admin\Downloads\Exela.exe

"C:\Users\Admin\Downloads\Exela.exe"

C:\Users\Admin\Downloads\Exela.exe

"C:\Users\Admin\Downloads\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"

C:\Windows\system32\reg.exe

reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3712"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3712

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2832"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 2832

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1048"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1048

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2136"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 2136

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 236"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 236

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3972"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 3972

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2036"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 2036

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1560"

C:\Windows\system32\taskkill.exe

taskkill /F /PID 1560

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

Network

Country Destination Domain Proto
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
GB 172.217.16.228:443 www.google.com udp
GB 142.250.178.14:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 104.21.84.174:443 gofile.to tcp
US 104.21.84.174:443 gofile.to tcp
US 104.21.84.174:443 gofile.to udp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
NL 139.45.197.245:443 waisheph.com tcp
NL 139.45.197.245:443 waisheph.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 104.17.246.203:443 unpkg.com tcp
US 104.17.246.203:443 unpkg.com tcp
GB 142.250.178.10:443 content-autofill.googleapis.com tcp
US 104.17.24.14:443 cdnjs.cloudflare.com udp
GB 142.250.200.2:443 googleads.g.doubleclick.net tcp
US 104.21.27.183:443 my.rtmark.net tcp
NL 139.45.197.236:443 yonmewon.com tcp
NL 212.117.190.201:443 sr7pv7n5x.com tcp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 183.27.21.104.in-addr.arpa udp
US 8.8.8.8:53 236.197.45.139.in-addr.arpa udp
US 8.8.8.8:53 201.190.117.212.in-addr.arpa udp
GB 172.217.16.226:443 ep1.adtrafficquality.google tcp
GB 172.217.169.1:443 ep2.adtrafficquality.google tcp
GB 172.217.169.1:443 ep2.adtrafficquality.google tcp
GB 172.217.169.1:443 ep2.adtrafficquality.google udp
GB 172.217.16.226:443 ep1.adtrafficquality.google udp
NL 139.45.197.245:443 waisheph.com tcp
NL 139.45.197.245:443 waisheph.com tcp
US 172.67.193.52:443 tzegilo.com tcp
DE 142.250.185.99:443 beacons.gcp.gvt2.com tcp
NL 139.45.197.236:443 yonmewon.com tcp
US 104.21.27.183:443 my.rtmark.net tcp
NL 139.45.195.254:443 flerap.com tcp
NL 139.45.195.254:443 flerap.com tcp
NL 185.49.145.45:443 datatechonert.com tcp
GB 23.214.144.96:443 s.click.aliexpress.com tcp
GB 184.26.44.47:443 ae01.alicdn.com tcp
GB 23.214.144.96:443 s.click.aliexpress.com tcp
GB 23.214.144.96:443 s.click.aliexpress.com tcp
GB 23.214.144.96:443 s.click.aliexpress.com tcp
GB 184.26.44.174:443 s.go-mpulse.net tcp
GB 2.18.108.132:443 c.go-mpulse.net tcp
GB 79.133.176.222:443 bottom.campaign.aliexpress.com tcp
GB 2.18.190.138:443 time-ae.akamaized.net tcp
DE 47.246.146.126:443 acs.aliexpress.com tcp
GB 184.26.44.47:443 ae01.alicdn.com udp
SG 47.246.110.45:443 ae.mmstat.com tcp
SG 47.246.110.45:443 ae.mmstat.com tcp
SG 47.246.110.45:443 ae.mmstat.com tcp
US 47.246.136.175:443 pcookie.aliexpress.com tcp
NL 212.117.190.201:443 sr7pv7n5x.com tcp
US 104.21.27.183:443 my.rtmark.net udp
US 104.21.84.174:443 gofile.to udp
GB 2.18.190.138:443 time-ae.akamaized.net tcp
US 172.66.0.236:443 gofile.95a6ab60df4973123f265d05d28f5eda.r2.cloudflarestorage.com tcp
US 172.66.0.236:443 gofile.95a6ab60df4973123f265d05d28f5eda.r2.cloudflarestorage.com tcp
N/A 127.0.0.1:50532 tcp
N/A 127.0.0.1:50542 tcp
N/A 127.0.0.1:50547 tcp
N/A 127.0.0.1:50552 tcp
N/A 127.0.0.1:50554 tcp
US 208.95.112.1:80 ip-api.com tcp
US 162.159.128.233:443 discord.com tcp
US 162.159.128.233:443 discord.com tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
N/A 127.0.0.1:50715 tcp
N/A 127.0.0.1:50717 tcp

Files

\??\pipe\crashpad_3712_KXPCSSYEVBMUDUFL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 ea5106808a22a100c0a620c618bf0772
SHA1 d10d374871e00162b062962021d5932dce3d135b
SHA256 4c9410cccbcaa442a3571d0f03495faaf16bbba922d123bd126b8fa4a4cec7e6
SHA512 9598751b617318460e06c5f440f4d97b8763668987e3f3348bcc4cd1a0b072fa1f33438f99ba4b1a4a788fc1f7f038c254f8ef0ac0fd900eb33c2bc3089f25a1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 6ae3372dee33e8d53e02d9e69a05bb15
SHA1 00debee813c5cc6ac40d3a325c6af996487be2d1
SHA256 45eeac7d162b0c78db3b89e9ba526ab3c9975a92020e71f00a9de880f39b382d
SHA512 f987f5ba62ea596e9e8edb9871a87a11f2f48d0a2b49ab843963293697e3229fa5bcf9e441447a586f28db7218d0ec35dafc934cf159b0eeb9f47a5212a5ccf4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 39f838839cf8de972cec14cc89f74039
SHA1 c2ac83745b938d84206b010c4dee9f77a92dcabf
SHA256 f355967d6c02bf50286bd73abe42b173c12effcb26e9ca4dcb096309c512f5d4
SHA512 bfad1da25989df8b10e37a6133f412debdb6536d9b237fa72aab178f3d42187cdfa14e28a48ced7e254b11ba14d367ee5afa49b1846358012e752b920926ddb1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 91dd2eefd3c4da632a41148ad16e384c
SHA1 d3f34deca3f02bceaf584503319c1df881c73e5e
SHA256 c868f24f88e19c4c738be6a8ff8b5a648211dfd02021aefbc3f2ce4dea2f562b
SHA512 03c63488137993c77e7c90f127c0e664f203bc721565b40e6e296f34214438b840e5f10db496e83aafef78b3f01f95bfc2ec5c1d15e621e4b022ea898bd40eb9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 5711ebad304e3f16bced45ae20aa8fc8
SHA1 dd89ee88fd9bd2e6ba13deeef5c0792385125c84
SHA256 c2f89fadaaaabd45b8606b2ec7ef113fe6c59e59228a5b3bb53ed166b227c3f5
SHA512 f4af3e6273113acaeecac93059df93913e0ea2163daefd5c6c39b35fe58599a55bd38a12f6a73bb322e95ccdfe1dd6016f5598879f2ae1eab47b225c6d63d88f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c3f713417c9bc9831f97dce63a663a42
SHA1 9b7b459edf60d760ee62aa742034e50e8e7482e1
SHA256 da5467b3beaedb913e56a3ca1bcb3719e15d380ce7d270cad5dca5eccd1ffd71
SHA512 d665093ec89598f713c3e407fb45d1c1402b915d8b94c0efe730b5869960a025ff1b9ee75b4c7fee8dd278987a27f563f5567411fa95dd0be4e16994dc4f5e7b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1d533273f42aff2f8fa25b4842b850ba
SHA1 89320d52a0bd4888b23d3bd756cdf8511c95279f
SHA256 9b7274f49c75f8c7353a66a6cd9e97d05841230508098d328ad909ce457bd3af
SHA512 ca6b07cd3ee0262c970f263d3c958442b0d1881c405142173104d5c90232a5be58b19cfede7cc8b982108fe7cd0cf6f5a4d7f8ef1347d8d281f9168992599799

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e4f82e246f2902ad78217ccf97ead563
SHA1 247e855e3df584c792dc47e550217ba445b0822a
SHA256 c046efaea0862d90acb14c3d69df2ba6746d58a6962cc9bbd3af156f8a04d00e
SHA512 2ccbe9be1829d3223514f01884e2d5dbd3776c1846b5550c52ec665ec907b8eccc5a18bef9d7ca8b8ca72ca6920a8ed3599dad08d5090ebadfa29e3ec8008e63

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 7002ac1d025d251ccd7b10a7d28fa035
SHA1 cf2d31660b57dde60b7eada546558b312ffd14df
SHA256 153772a90682a0acb6c1c629fb0ac6e72f4c44dec752a573c0bcce0a90374985
SHA512 5b185ba2a60d1d11d94a20a0a0b0cfbb3b6155174186a9d25961d854ec599b1fbe26a24446af3502ec38de15c68c9a02efac11d84ea229d98b919082f5df6c1a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f184698f00ccccdb0ae4a7d9c4ed8241
SHA1 be5aa8a1f063aa6c3f0417a0dc8715d431ad560e
SHA256 0ef476624b0c4449a80f8cc50f521c630b7d079bbcbc961c3c909c96f8ee17bc
SHA512 89a48696da924b367e4f64f7a293960d70d76a63cceb99a56691ab5196bdb783354ec57efdaa33d9fd8714e185436944b9ad1f5f646c7eb3a0e7bc34d100865b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8b5a22b5dddf4456eea3cb79c4e46c49
SHA1 3e415a8f572d311bca521796ceb1085fa1841820
SHA256 35e9b0f753e1440e856a74a3e879f1dbcb21732da7d4527101866c52ebd03e35
SHA512 1bc95734c4b3132ff86c2fc62fa7df9084cfede237bac81cdf1dbe175d083053cf74320dd58722fee81b294837b91231290594c3d29b0cc37087fce3e82aa837

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 e6d7594122091f344b5bdc1e1e4c50cc
SHA1 c06a5a6c0fbf39e3df6715212894d54cc4748650
SHA256 4d227c5302acd08559c9ad1b18c0e279384e34b6aee82e65113ef0bccfb55c4a
SHA512 fc351e921b81d13c13c02f4a47762f3a1bed88da865a3a5ef6cacf8e14b173659e3cb3de8ac56b88edd5a07fbd1b832fdcd430621435a1ccb09155352cae531d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 dac7bd3c965a7a71ae7e9f33e202aacd
SHA1 294747a7d6bf299f5dc2a02b5935500f6fe555b7
SHA256 5c5b353a2e528e9933c7227ce4569ac7032057df976ed37c31854efdd1c5f97d
SHA512 dd2e9c875f636f3296688c6a932930fec19dacccfc22b66058ee7ef49c97885505696aa3d7397ce8813916c07b3e99a5a5962332261cb5b13741b86c0c7cdc76

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 cf97f553306531659a647725a1eef595
SHA1 2580b411f4d487e8f20b0b2008672541c4f85b45
SHA256 3cd30e4f79d953fd93fe9d3380d1bd331a58a50f2df82285d847409e39216c73
SHA512 de9de8c49d1243af46e23cce64c6edc10a591ac897a912ec8d9095c7a0f9d3ad03405c2ba4f40d389e1d3bf8846368e1e62cb4f33a1ce06dd68a6b82633520f3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eef5490c-50c1-4b85-a083-b73387da7815.tmp

MD5 b445b6dfaa7492aef52803869e237188
SHA1 1e80e2878af504b6181c0275604da5cf942372b2
SHA256 afe8ee1f4eadd7eb06c5353c86f6cd58230ad8b516934fd6a4d3aeb0f96a3487
SHA512 5dbc4db3c7c675e6f360b7d3decc3b7999aa7fb35603216bf8335065b611d55c2d97609c6ead4e24674c12b71d3d3d9767e9bd710b5a33705ba60bc20ac3cf78

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 91cf8cac24f2c7e5d1b7e3da43a3d7ab
SHA1 3749cbda0b31b6c43486ab96d17e728ea99b44ba
SHA256 29d5533e4a1a461be88324745c5b3394a54b1b00143d962da858ff2ffa6a4d56
SHA512 a2f6c899696f27eae12681adeff4f1398a750f7deaddc7aa0308df52c9ff9ef84994bcee743f7f8c8bfcbcc153ec50388169bafb3397d3b5b4991d6b4a30e4fc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 6c3586af53a946cfa75b6d95c456a596
SHA1 f09e91c10fa1e8bd6189796b6c32f29a14b8ad59
SHA256 3132b60d90fbb139f27c23bdf66990106f6fe9624e2e7b23174091d8459c8cea
SHA512 3c05d7f02ddd9d6a8aaccffe827d9bd3a31184b6f9606aaa75d97e13e805003deb6dba93d6c5e8608282b2d276affbcfbf68d3a4d8d12b0f9cf7262be5da3d9d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

MD5 8991c3ec80ec8fbc41382a55679e3911
SHA1 8cc8cee91d671038acd9e3ae611517d6801b0909
SHA256 f55bacd4a20fef96f5c736a912d1947be85c268df18003395e511c1e860e8800
SHA512 4968a21d8cb9821282d10ba2d19f549a07f996b9fa2cdbcc677ac9901627c71578b1fc65db3ca78e56a47da382e89e52ac16fee8437caa879ece2cfba48c5a6d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

MD5 76f5c6dbcc4339ea6beb2bd207b3b7de
SHA1 45a9200053ed7a20a071741d459248bf84895853
SHA256 8771f8f89332dba5f5edcd3d1a22d7b33b81b44c8d627472d987ec7b03216813
SHA512 c445cdfe59d14b76f5f56c5b30edf6f64bf3940aec89b7c30224beb6cec41c0e3dbea4ea71bc4515c124342c7e383bebd9601d9a69ecc7ff12a6052df2ef5d89

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

MD5 d8522bf05a310f2ad4447869d2f87c0e
SHA1 3e14fb23b9657529f2771aab7f441c713f1fcb05
SHA256 5ec00b802395903d22b5f2e1782c7bacf6242f0d18cee668c98f23414d2e0e3f
SHA512 f4d8ed46859dcd316ee1e79c4f5c184e4eaaea51619467544796e4296945184828be14e43a65bd48d6418d60fc7a0f8f21832d77c984047b06bd389cc2018fb6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

MD5 1775a2de8e864d834c3a0a0cfcb3dd25
SHA1 7ceaff40e292d8dff5ae8d231d885fbb88ce13ec
SHA256 5f857b6788f0c32bf13967765923fd0fb962fb2aefae2efdc6385041d3067041
SHA512 f49c834a7deb5c3ba6e9c872911f24875e5f2d0874ff47a17f6764c874482369a835632580f57ca822c1bcdd73a701d0c2ecaeafcee2c81fece618b39971138a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

MD5 4a95afba649e8d4fad3cff81980aff08
SHA1 044798ae8471aa7a2177c50d9429e44a1a539bd3
SHA256 86fa7d0aeb7e18f63d966264dba1761c0e0bbf1d75f25a28262fb0c08208d05d
SHA512 2f0a7c340ee344e627d41f396ff37c92ca733839fe70a9ac3c8f8058930da0025d7743dc01d4b9b785dedfce8cefa17f25ee998200bfff17d8b402bcf7539126

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f14f0231a0ce2ca7f584b52c91273b34
SHA1 3eea3e4ebc40e41d26b8229f7cc1fbbb5d91247a
SHA256 1ec02c1dd4175ac4bbff278e6ee75c9b54ec50670c9664d9bf747f4e4436dd35
SHA512 4c16ca81442c0d9f9176c58b12ea067f90de577dccc4e0f353c9dafd6cb4092fc207feaf9d39402953d35725992b17515b0e3322055cccd4de1232da707a3088

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

MD5 164be23d7264175ad016a13a0bcaf957
SHA1 c35ce3510b46a12a5ad3f73edc9ac18eb1e8018c
SHA256 4bb1ef87d7b93cb72976e936bca7f607d5dee5517dfa739fcf403a2cd130f6d7
SHA512 7dcfeb8007467dec38af535e1240cbd15e951735720e66e5887d7c69404edc2b2737fce054a369726b46b5a2038bc296b136615dc981d56cad7a8d674cb88aba

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 6f888aae6eeb1528598249f5d0e0be37
SHA1 fd0decfee2237c5bc94bc24891a6ad87108fae81
SHA256 e8ce757fb2409d53b8194b3651093ec1bea8824c20045b57f9ea7adb1f42219b
SHA512 bacc8dc209fcb439c0085b8826bc35fffd47c10440ae14bb8b4b281c5ff870cef928a15afd13c864f3252bef2720267bec030ba120f8b74af3f12b05b2689fff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 400f7309a4ad52d6243cc1414ed1aaf5
SHA1 247a93bdf95469a3691927b6122dea1f4a63ddbb
SHA256 5e12fdc6e4dd7cd270c921eae84a9a8ba107a75e3492c03efc259ea2ffc8549d
SHA512 de3f8f7d68f73aea3a59e3ab3b777783291134ec4f58834c04ce2c661622a41e5699a86f4dcd2981c38b433dd64cd195d871bd99f1501b20c73cbbc9ceede32f

C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 20fed111ceeae61e179cade300e6c7d4
SHA1 221540f7724b0cc65818d9ddf4a12daca092c82e
SHA256 03496a3de3c9153fe460c642d150448bbac538d040527a5f20ced58dc4879f87
SHA512 a91282591866c36445eac3debeb8def9068bee11cde28470ce0a41cb499948dc56dba31d8a2640081be1dcc207942e16f14fc967e8efea6f350ac72893b5adac

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

MD5 24fdbbe5166a53bacc707c93c28f2080
SHA1 6cf5abe9908cb8993d39c73bffd4186f5b038c5d
SHA256 ed1f3ca8bdaa2fb78fc141b6177f62471694268c5dabc136c8c1bf0b440f7cf2
SHA512 141fdb18b95be3969ba9d4c43d8fb9a98bd2c4ac4fecc7d7d7c3519656b915a29efd47ca46f77e511f315d5e1bf664f0bc6ce98f176105421ccb5f1496122518

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

MD5 24b7febceabe22846d8a553396b172c5
SHA1 678a0160e54254e918e44754ac1f60c91d202ed3
SHA256 60443cd90688dbe05437ae37062a761097cec2d17373cca62913c2abedc02190
SHA512 d5b79d81290a0d0f55952217cc9b0846b92e64762361af79ab1acf0674456e576b748b7b810a31f83f5b7b9fea7bfc5a3e222d7ee6a7b72c4fa32c4b624624e9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

MD5 6d2e861e5abfe019d20acfbee1e8b693
SHA1 7303a071b36007b343108fa6b6c3da959bcf67e7
SHA256 e2acb73f603e9917333c81ce9735620f435d73daa8459d347624b4762d4097fb
SHA512 212fb6eefc98aabe0eb222f0d2870258239913aea5a35d2bdcba9a127453ec037ffcb75d3921cf9b573d4fc05978b2419f494bdb92e366d7cb545bd0c0915126

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

MD5 7d73f18dce766411b8ff2e59d1ca52f3
SHA1 0c9f4fbb70cdf2c277cf89fde5bf2e614673d43c
SHA256 7bc425e067df800599ed529bb14e8335f675e585678913dcae0e84417229a549
SHA512 6f6a156e316a128d79ea06b5777585daf4c1c2e001520caa38f686fd20203f9547e740b339e3a7112f7c1f498e8cb67d471ad4d0beb45e92593d95ce3e99b831

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 26f49df9643a39a8eb648c68994505b8
SHA1 a7a4b1482ac2c377421ec584573a4204a7a5f280
SHA256 fd935b8e3142e4308825ad6dccd8446636926eadf644e207d1ddcf442d46572d
SHA512 640ec13bf03715c2e9d514554a2241fc53526040a5c50cd26052dac2664bcd5cc9407d1396a324244835c3209fc21fef8de8adb8005c7aa844ef07994f92fd51

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms

MD5 08c02882f8e4fe3fd3efb8b2c7ba75e5
SHA1 cfa1a1237b9b0cc4cb516aa89a1e66b7772620b9
SHA256 90bf9bfff950f8a7ff1ef1fc0294dadcd031edc66072750738e36ed1fa5de17e
SHA512 434dec55d9b18e8bce78001f518f2fb93f521b3c9a9d442fe31539eb3876e9381bbf7ea73037a1381a7e59af5558c4afab75608aad6e6644ea9c661debd89813

C:\Users\Admin\Downloads\Exela.exe

MD5 480239b4bb04a06f340151b8e0d583f4
SHA1 6ec7267f1933e0fdc95504d8a9867ab387f45748
SHA256 b4ea5811b087651179d90e1dd7b8d33cb68206e98d28b9b2bee6f35033a712fa
SHA512 7d807d56826f173945f5809f644de5ee339d89aae43db99bb1cf80355e2e37766cf1c3889c3103c5a1ea1f054a0d9dc707a69671f73a6886b6e6d7d9fa555777

C:\Users\Admin\AppData\Local\Temp\_MEI4442\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI4442\python310.dll

MD5 196deb9a74e6e9e242f04008ea80f7d3
SHA1 a54373ebad306f3e6f585bcdf1544fbdcf9c0386
SHA256 20b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75
SHA512 8c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68

C:\Users\Admin\AppData\Local\Temp\_MEI4442\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/2072-609-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\base_library.zip

MD5 524a85217dc9edc8c9efc73159ca955d
SHA1 a4238cbde50443262d00a843ffe814435fb0f4e2
SHA256 808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621
SHA512 f5a929b35a63f073bdc7600155ba2f0f262e6f60cf67efb38fa44e8b3be085cf1d5741d66d25a1ecaaf3f94abfe9bbe97d135f8a47c11f2b811d2aac6876f46c

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_ctypes.pyd

MD5 f0077496f3bb6ea93da1d7b5ea1511c2
SHA1 a901ad6e13c1568d023c0dcb2b7d995c68ed2f6a
SHA256 0269ae71e9a7b006aab0802e72987fc308a6f94921d1c9b83c52c636e45035a0
SHA512 4f188746a77ad1c92cefa615278d321912c325a800aa67abb006821a6bdffc145c204c9da6b11474f44faf23376ff7391b94f4a51e6949a1d2576d79db7f27ef

C:\Users\Admin\AppData\Local\Temp\_MEI4442\python3.DLL

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

C:\Users\Admin\AppData\Local\Temp\_MEI4442\libffi-7.dll

MD5 8e1d2a11b94e84eaa382d6a680d93f17
SHA1 07750d78022d387292525a7d8385687229795cf1
SHA256 090a90cd17b74abefddf9f82d145effe5c676e7c62cf1a59834528f512d7ee82
SHA512 213bf92a707b14211941e5e071f1926be4b5795babc6df0d168b623ecd6cb7c7e0ae4320369c51d75c75b38ec282b5bf77f15eb94018ae74c8fd14f328b45a4e

memory/2072-619-0x00007FFA4BF90000-0x00007FFA4BF9F000-memory.dmp

memory/2072-617-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_socket.pyd

MD5 02adf34fc4cf0cbb7da84948c6e0a6ce
SHA1 4d5d1adaf743b6bd324642e28d78331059e3342b
SHA256 e92b5042b4a1ca76b84d3070e4adddf100ba5a56cf8e7fcd4dd1483830d786a5
SHA512 da133fc0f9fefed3b483ba782948fcdc508c50ffc141e5e1e29a7ec2628622cdd606c0b0a949098b48ee3f54cdb604842e3ca268c27bc23f169fced3d2fbd0a5

memory/2072-622-0x00007FFA41710000-0x00007FFA41729000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\select.pyd

MD5 16be2c5990fe8df5a6d98b0ba173084d
SHA1 572cb2107ff287928501dc8f5ae4a748e911d82d
SHA256 65de0eb0f1aa5830a99d46a1b2260aaa0608ed28e33a4b0ffe43fd891f426f76
SHA512 afa991c407548da16150ad6792a5233688cc042585538d510ac99c2cb1a6ee2144f31aa639065da4c2670f54f947947860a90ec1bde7c2afaa250e758b956dbf

memory/2072-625-0x00007FFA4BDB0000-0x00007FFA4BDBD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_bz2.pyd

MD5 d584d4cfc04f616d406ec196997e706c
SHA1 b7fe2283e5b882823ee0ffcf92c4dd05f195dc4c
SHA256 e1ea9bb42b4184bf3ec29cbe10a6d6370a213d7a40aa6d849129b0d8ec50fda4
SHA512 ccf7cfbf4584401bab8c8e7d221308ca438779849a2eea074758be7d7afe9b73880e80f8f0b15e4dc2e8ae1142d389fee386dc58b603853760b0e7713a3d0b9d

memory/2072-629-0x00007FFA416F0000-0x00007FFA41709000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_lzma.pyd

MD5 213a986429a24c61eca7efed8611b28a
SHA1 348f47528a4e8d0a54eb60110db78a6b1543795e
SHA256 457114386ce08d81cb7ac988b1ff60d2fdffc40b3de6d023034b203582d32f5d
SHA512 1e43c2cacc819a2e578437d1329fa1f772fe614167d3ec9b5612b44f216175500e56e3d60a7107b66a5b3121e9e2e49344ebe9ff1b752cae574bb8b60eec42ed

memory/2072-632-0x00007FFA414F0000-0x00007FFA4151D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ee742991b08f550c5d28360dfa347aef
SHA1 670e49824bdc82f73a07453e38ce66e760f8c9f2
SHA256 097417f8e81123e9965eb0b8c0233e6487ca3c062f89f240e3383058029dcef8
SHA512 3328dc01b19950a2228fe3ee529a261b70491fac51c6c290354c948bd96a1f839de7c288611ddae98e3ba42754073a6fde0abab0d98d4b5c552c5c3e66d47857

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_sqlite3.pyd

MD5 b2b86c10944a124a00a6bcfaf6ddb689
SHA1 4971148b2a8d07b74aa616e2dd618aaf2be9e0db
SHA256 874783af90902a7a8f5b90b018b749de7ddb8ec8412c46f7abe2edfe9c7abe84
SHA512 0a44b508d2a9700db84bd395ff55a6fc3d593d2069f04a56b135ba41fc23ea7726ae131056123d06526c14284bce2dbadd4abf992b3eb27bf9af1e083763556f

memory/2072-644-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\sqlite3.dll

MD5 4357c9ab90f329f6cbc8fe6bc44a8a97
SHA1 2ec6992da815dcdb9a009d41d7f2879ea8f8b3f3
SHA256 eb1b1679d90d6114303f490de14931957cdfddf7d4311b3e5bacac4e4dc590ba
SHA512 a245971a4e3f73a6298c949052457fbaece970678362e2e5bf8bd6e2446d18d157ad3f1d934dae4e375ab595c84206381388fb6de6b17b9df9f315042234343a

memory/2072-646-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_ssl.pyd

MD5 1af0fbf618468685c9a9541be14b3d24
SHA1 27e8c76192555a912e402635765df2556c1c2b88
SHA256 a46968ca76d6b17f63672a760f33664c3ea27d9356295122069e23d1c90f296a
SHA512 7382a0d3ec2ce560efd2ddd43db8423637af341ce6889d335165b7876b15d08f4de0f228f959dcb90b47814f9f4e0edd02d38a78ddad152ed7bc86791d46bc36

memory/2072-649-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\libcrypto-1_1.dll

MD5 9c2ffedb0ae90b3985e5cdbedd3363e9
SHA1 a475fbe289a716e1fbe2eab97f76dbba1da322a9
SHA256 7c9418ad6fb6d15acb7d340b7a6533f76337ad302a18e2b4e08d4ee37689913a
SHA512 70d2635d42e24c7426cf5306ed010808f2222049915adb43ffc12c13259c8e7a9fee3a49e096d5ba2b6b733fef18574823d00df2e8d7fb1532e1d65d0c478008

C:\Users\Admin\AppData\Local\Temp\_MEI4442\libssl-1_1.dll

MD5 87bb1a8526b475445b2d7fd298c57587
SHA1 aaad18ea92b132ca74942fd5a9f4c901d02d9b09
SHA256 c35a97d8f24ea84d1e39a8621b6b3027c9ac24885bdd37386c9fcaad1858419d
SHA512 956bd8e9f35c917cbfb570fc633bb2df0d1c2686731fa7179f5e7cd8789e665dd6ff8443e712eafa4e3f8d8661f933cb5675aeb1a2efc195c3bb32211e6d2506

memory/2072-657-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp

memory/2072-656-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp

memory/2072-659-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp

memory/2072-658-0x000001A4DAAB0000-0x000001A4DAE25000-memory.dmp

memory/2072-655-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_asyncio.pyd

MD5 6de61484aaeedf539f73e361eb186e21
SHA1 07a6ae85f68ca9b7ca147bf587b4af547c28e986
SHA256 2c308a887aa14b64f7853730cb53145856bacf40a1b421c0b06ec41e9a8052ff
SHA512 f9c4a6e8d4c5cb3a1947af234b6e3f08c325a97b14adc371f82430ec787cad17052d6f879575fc574abb92fd122a3a6a14004dce80b36e6e066c6bc43607463d

C:\Users\Admin\AppData\Local\Temp\_MEI4442\_overlapped.pyd

MD5 b05bce7e8a1ef69679da7d1b4894208f
SHA1 7b2dd612cf76da09d5bd1a9dcd6ba20051d11595
SHA256 9c8edf15e9f0edbc96e3310572a231cdd1c57c693fbfc69278fbbc7c2fc47197
SHA512 27cef9b35a4560c98b4d72e5144a68d068263506ac97f5f813b0f6c7552f4c206c6f9a239bc1d9161aff79742cd4516c86f5997c27b1bd084e03854d6410b8e2

memory/2072-665-0x00007FFA41710000-0x00007FFA41729000-memory.dmp

memory/2072-666-0x00007FFA45A90000-0x00007FFA45AA0000-memory.dmp

memory/2072-663-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI4442\multidict\_multidict.cp310-win_amd64.pyd

MD5 07adf002b8bab71368fd904e8daa545c
SHA1 bd38ea6cca7f10660725c7df533fe33a349a11ea
SHA256 781496f2ae8d0a1cd2899bd643adee7813b33441f0f2c6177ab108148b5109ba
SHA512 20d4747890c957becb15136b4f16280356b74dcd159dac0f93cf853820a88dab5cb86f6e1ef0eff140f35443cdffe81ae0e05bccc573dbd3f54cda9ce0b2633d

memory/2072-668-0x00007FFA380D0000-0x00007FFA380E4000-memory.dmp

memory/2072-669-0x00007FFA380B0000-0x00007FFA380C4000-memory.dmp

memory/2072-670-0x00007FFA36E20000-0x00007FFA36E42000-memory.dmp

memory/2072-671-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp

memory/2072-672-0x00007FFA2C7A0000-0x00007FFA2C8B8000-memory.dmp

memory/2072-674-0x00007FFA36000000-0x00007FFA3601B000-memory.dmp

memory/2072-673-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp

memory/2072-675-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

memory/2072-676-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp

memory/2072-677-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp

memory/2072-679-0x00007FFA313F0000-0x00007FFA3143D000-memory.dmp

memory/2072-678-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp

memory/2072-683-0x00007FFA457E0000-0x00007FFA457EA000-memory.dmp

memory/2072-682-0x00007FFA313D0000-0x00007FFA313E1000-memory.dmp

memory/2072-681-0x000001A4DAAB0000-0x000001A4DAE25000-memory.dmp

memory/2072-680-0x00007FFA31370000-0x00007FFA313A2000-memory.dmp

memory/2072-685-0x00007FFA30DF0000-0x00007FFA30E0E000-memory.dmp

memory/2072-684-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

memory/2072-686-0x00007FFA2C010000-0x00007FFA2C79A000-memory.dmp

memory/2072-688-0x00007FFA30DB0000-0x00007FFA30DE7000-memory.dmp

memory/2072-687-0x00007FFA380D0000-0x00007FFA380E4000-memory.dmp

memory/2072-700-0x00007FFA380B0000-0x00007FFA380C4000-memory.dmp

memory/2072-730-0x00007FFA36E20000-0x00007FFA36E42000-memory.dmp

memory/2072-735-0x00007FFA2C7A0000-0x00007FFA2C8B8000-memory.dmp

memory/2072-771-0x00007FFA36000000-0x00007FFA3601B000-memory.dmp

memory/2072-772-0x00007FFA489F0000-0x00007FFA489FD000-memory.dmp

memory/4976-783-0x000001E972260000-0x000001E972282000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffbv2xsc.qqk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2072-788-0x00007FFA31370000-0x00007FFA313A2000-memory.dmp

memory/2072-789-0x00007FFA313F0000-0x00007FFA3143D000-memory.dmp

memory/2072-798-0x00007FFA2DB60000-0x00007FFA2DCD1000-memory.dmp

memory/2072-802-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

memory/2072-817-0x00007FFA489F0000-0x00007FFA489FD000-memory.dmp

memory/2072-815-0x00007FFA2C010000-0x00007FFA2C79A000-memory.dmp

memory/2072-809-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp

memory/2072-803-0x00007FFA45A90000-0x00007FFA45AA0000-memory.dmp

memory/2072-801-0x00007FFA2C8C0000-0x00007FFA2CC35000-memory.dmp

memory/2072-800-0x00007FFA30E10000-0x00007FFA30EC8000-memory.dmp

memory/2072-799-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

memory/2072-797-0x00007FFA416D0000-0x00007FFA416EF000-memory.dmp

memory/2072-790-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

memory/2072-816-0x00007FFA30DB0000-0x00007FFA30DE7000-memory.dmp

memory/2072-791-0x00007FFA457F0000-0x00007FFA45814000-memory.dmp

memory/2072-848-0x00007FFA35FE0000-0x00007FFA35FF8000-memory.dmp

memory/2072-841-0x00007FFA40C80000-0x00007FFA40C95000-memory.dmp

memory/2072-838-0x00007FFA380F0000-0x00007FFA3811E000-memory.dmp

memory/2072-829-0x00007FFA2CC40000-0x00007FFA2D0AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupConvert.fon

MD5 2f8a8f99e354e654e50c0bfee72292b3
SHA1 560f4083aaac0c220a7904aa5f5464e7c7a2fd86
SHA256 affe0740a04960423a3fea091c26f8c2136271aa0820e414fe173194bcc558c3
SHA512 ceb76f813bf636a8c55cfba162a30f8b2de4382686764b31d63ceafc3775b1b6033de1ae07e04add33d2cb3e75d2970ea0344d351434e6fee5f244f213278b50

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MoveStop.xls

MD5 4dfc31f6bc1e2060664c472999397db9
SHA1 cb8691f74e3351e9474f5098813da00aca300338
SHA256 abbc08f558c4a8509c5ae3332c1c507a64122ec121db77a562516a452251eb8e
SHA512 95c992f41976f8b93cf4c5c008aa530ee5f342d8765a59baa5e6c4664954bc1c4dd221e9e8fd962a67fa0948b3eae86ec2f7307441bbc653f97181b409a562c6

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\LockApprove.docx

MD5 f5d4dfc70ef3dbfaf1e25eb611ee50ba
SHA1 e2a726c1cf7e6ba8e2e46d8562b00fdb146ab807
SHA256 f5c0fba20d4617ede794aebe2912458311dba14f73b9fb7771fab4b9d2eb0f21
SHA512 3d5eb7fc7ef1a7f8a4d8f60913925124746610961bfbda9cc6d77354ebe8d7394f18ca3dcc803dd2b6271039c8bb7fb18722cb874fabe23c725ae14479411783

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\DisconnectRequest.xlsx

MD5 99c29c88b30e73fbacfd34f38f6cdb72
SHA1 9ecab908261eb0c5a0fad8a9d838b34451e60d20
SHA256 929d9d78deb4868c36e5cb9d59f05b8b59d4b847484b94f13588ed75034af88c
SHA512 1eda86f597f4e941003422bcff596cebffca8203e633800e99d3c20fe1b85b8deabef4128c744524e9e7aa7cfadecd899e2aebb5e58b06ac5b117a73b2b057ba

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\NewSwitch.docx

MD5 71a951e976c73a8d8e5b665f906b14b0
SHA1 02a69d4cafd699cf4d99a154e0c1a22c396fc564
SHA256 542eb0d2f2871916059215ec721a844087f876e4c29a37d663ffa23a59f5e687
SHA512 19edfd7921347b615764e49ce742b7e366b13d5bf7002d2a133757e115a8ff286c975bb5a423c7bcac4562b6327e62bed6f1068a19399890f0c3134940cf7a2e

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\NewCopy.xlsx

MD5 93d5c0451a53435a664a3b6d4c4ce804
SHA1 2339ae3992edce8406ea51b1f6c26886e12ff3c1
SHA256 f2204ec642dda135d1c3739954028f6e1f9a59f68eb4d99e52fc94a52d2a162f
SHA512 7417fd977bd2b1dc82abb0c7b8c6b185be04d266faa4c96a1e4c744a64d7bbca327be362d0bed4e55bfea71e5cacc948eb3cccdca9271debaf13dc10561c283d

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ReceiveApprove.xlsx

MD5 8ff2bfa84f5a98ad2c50f9772884d24c
SHA1 212dfb261e83cea57c93d836e6b57240dab31df7
SHA256 bd25478f6e50299cd2fafa6b55c0c4e00003f6481a3278b91807ea144cb48068
SHA512 bedac23ea281f64d6a95a8815940c0e0357c7ee24fc2b5dc993b4fff72e00827ff12166a24d77bb9ebc6ba6a1ee6d18d238d9669d52d93b8fa28b2873223d4ab

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RestartSync.docx

MD5 83cf49f182a3b982ae366cf638e472bb
SHA1 8070d403a6929dcd4e60ad00f00bfa0fad796558
SHA256 1575d1dcfa119bee4122ed9ba9043f72b656a91093a3c8668e741a67e5ec5d4d
SHA512 3328127847e891ee0c865354ecef8b198d0a2702db14064de1a5a8298bf43b6e74e9c8aef927e93a6e321dbfb9cceb061ccd31030cc892fc9854573260f0dd0c

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SaveRestart.txt

MD5 ae62b309de6ad29fe8442fa3a8d847d9
SHA1 0c97005e70916a4030646c6e06864c98826866c6
SHA256 868e7224b7683614825b710cdfd8928f09ef07281bf800a846aba01868d7d093
SHA512 c19dfd80ebae1b33bf59334d9c2cdd526fe22981c46304ab9c293443412016c8af0d3faff0bf0fbb721156bf94a478a713796d8a81c28d6da8d108faffdd733f

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\WaitClose.pdf

MD5 266560524bd9c92d9dcdfe67f30c4417
SHA1 6004679e1fb2bf57a22260cc3c928b75f537efb3
SHA256 600b6f0f2a971586f65325b5b8503716ca18ab801264ce1c3654a1b4906b7ad3
SHA512 aa43a1aca43d8476b35a61dbf3439de83b5c38da6b5c097e1b7de960d8e75430e75097eb83ab7cd176d0705ac5fd171c712c46e4985689d6c75fdaa517114021

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\HideSelect.docx

MD5 33b01acc87d8700d5f60ecdd2ed84d92
SHA1 0237126aff5a49e5f021bc9528db93b644528d10
SHA256 d3d19f3337f443bb9798ce493c47c2cdba9e68b4d052dbef54ce0ef1f2e90386
SHA512 e7c3817f5963d119077cb5cea264bab04f1fd10c1a33fed52f5235dac57a8795755fd6154f9e10c3e9c4f5882aabc2967b2fe32a6d3ee296a39a413a37b54e11

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupUse.emz

MD5 e688bc1e969891d8f1f2c09ceecb6e9c
SHA1 0ff765b7fb7c332cb3f5338fc13bed33f5d3a125
SHA256 1c73408be4ec0731161c0edfe03e94aef623ab757e808335701dfb8d4725da1d
SHA512 9b1666e8b00efd3dfaa63223124b5e8e7a75fb744c922ca6d5a19610c887b32597e3d6ac97b37d20654e78221999dfa3e3209a0e5d20c5012300864d6a1fb2b9

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\PingPop.txt

MD5 4d4a929b4103f00eba436612e29fae1e
SHA1 bd07ff2f36e21e0c1c8c592045165b00e26328e7
SHA256 270a9527db65fc7447792e4e673bb66ddb439a9f371c531be948fad16b1a81b9
SHA512 f9cd8fde5e24e1023232fc5bb03f2f4f84d6f5ced398d48d9adcc4dfb6fbe2453697d45cb15ed7b86fbb161bf1966902d8821f18895f051a6cbdf825b7f28fdb

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SearchOptimize.png

MD5 7b5b024fc800c2ea2c844cb986c7a274
SHA1 360b311cb57b4596763a711c3685465a96ae9270
SHA256 c137fd68a58a996d1ea82b4d50e46fce979f209ee0a43ec006661122348e32e2
SHA512 164e674bf3d5d69bdb37d999b7f034b3b69d29d700450343fe01e5f2c0f4bf51133a10a36b2033a52e6bf5ded017ff7bddcc44091262fff77fe026801ffe6f16

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SendSync.jpeg

MD5 693641fbbc5697d0e69864a6317c148d
SHA1 4447c0e0ad5ef7e48e44f76dcdf3ba6734af3f23
SHA256 9887a83c9cf8f49a1d76c8efdc4fbba287f6ce257de3db49c3903747daed0a40
SHA512 a9cc9897f32d292236bdd3a67746bc1b444ad771d22f46aa3d40b5914229ec2d3ad2ab7606f8fa71d695c60daef3927a5ba22ef97856186e20d9402dc5852257

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CheckpointSwitch.jpg

MD5 9c7665749ff0d0666e247073f30494fa
SHA1 3d89c50af61b059c5d041e8388510fce866cfdfe
SHA256 7a3d1988fb01891dbc0e97df87242b0cc7cb1b988fa15d4a13781201519553f8
SHA512 4fc634ca01f94b51ebefcb31c878d3768513377cfe529d575442ed89cc93f2821ec937d2bdfd36b6614ee8f325426307756ae88099fb6ba8236b81647c9e438e

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ExportComplete.jpeg

MD5 29f884b7a274aef9597a791041e45fab
SHA1 5f4796b8c13900cafc67be315fe7b2bd23fa7131
SHA256 86f06a3bb62c17c74f383a18050a47afa8560f316ff70eaed990b83f696ed84a
SHA512 131f297369bc032964744cbe7180405f32bb975cee4142d83aac6afc09e90afa7b32b095da64b3af4d1949e1391f517e433e27b3f69a657776160ffcdbfe1775

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ShowExport.png

MD5 4df50fcaf3be03b8145db2cce22f229f
SHA1 afa4e7266a2ca3873c75b736b6a1cbde5799077d
SHA256 884cf4af3ecfec6719411f509c597426c2abc99ef319c6d491c3cbeaafad393d
SHA512 32cc91839184754de8e327d4cd9323beb58f2c5d2b754901726d27b38d9ee70218ba4c78360604f4ee6857c1c27054941a7e1a4e8c6a4c464d6f4870457728f9

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UnlockBackup.png

MD5 825a8e37ed32c17647dcc8c58bfad430
SHA1 fe7344f0d06aa3fe98181c391ae20f4670fee87c
SHA256 a48a0f472ab43f95cde52fd8ae00c3dffe11c9117fb1c9fa916af484d7f16aa7
SHA512 425f2cb4039e579a43afcd2e61dd9e93ab23319c8ae67050fceba67fc6937d563f4adfd7871f334144e1a725d18c2099e803f2f59383a6bdee297aa4a6439994