exelastealer | 05eb96594a5dd8b1f7aa1ed1940141687d5afd65e873e5260bde36dba6d840d8

Analysis

max time kernel
18s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CCGen&Checker.exe
Size

21.7MB
MD5

e17e00443cf43f0e1cf5b933aca4c3bc
SHA1

a4b2aa57df313a3ad7eefb4d0bad6afe73b5b96b
SHA256

05eb96594a5dd8b1f7aa1ed1940141687d5afd65e873e5260bde36dba6d840d8
SHA512

1730ee22ad569d0563466a6d76575043753db3540013c56d2fd28d53e3113adfb618aa7cafe5c9c667e62bf143c94b28c13d562eeaef3d432dbba1ec7ed88b2e
SSDEEP

196608:Pa0zvsGESmDgfJXE3JuMhmAv8JLk+7r8ZaELdzsrRAvH+BVVWcYKMcn4Uc+4YLb:ShGESmDgBjMp0xk+coryvH+yKMcR44b

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3020	netsh.exe
2520	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1928	cmd.exe
1540	powershell.exe

Loads dropped DLL 33 IoCs

pid	Process
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe
4596	CCGen&Checker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
28	discord.com
30	discord.com
34	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1908	cmd.exe
1136	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3788	tasklist.exe
3148	tasklist.exe
2736	tasklist.exe
3588	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3316	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3680	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HOSTNAME.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCGen&Checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CCGen&Checker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NETSTAT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4168	cmd.exe
4548	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5060	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4148	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4432	ipconfig.exe
5060	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4724	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	powershell.exe
1540	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2016	WMIC.exe
Token: SeSecurityPrivilege	2016	WMIC.exe
Token: SeTakeOwnershipPrivilege	2016	WMIC.exe
Token: SeLoadDriverPrivilege	2016	WMIC.exe
Token: SeSystemProfilePrivilege	2016	WMIC.exe
Token: SeSystemtimePrivilege	2016	WMIC.exe
Token: SeProfSingleProcessPrivilege	2016	WMIC.exe
Token: SeIncBasePriorityPrivilege	2016	WMIC.exe
Token: SeCreatePagefilePrivilege	2016	WMIC.exe
Token: SeBackupPrivilege	2016	WMIC.exe
Token: SeRestorePrivilege	2016	WMIC.exe
Token: SeShutdownPrivilege	2016	WMIC.exe
Token: SeDebugPrivilege	2016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2016	WMIC.exe
Token: SeRemoteShutdownPrivilege	2016	WMIC.exe
Token: SeUndockPrivilege	2016	WMIC.exe
Token: SeManageVolumePrivilege	2016	WMIC.exe
Token: 33	2016	WMIC.exe
Token: 34	2016	WMIC.exe
Token: 35	2016	WMIC.exe
Token: 36	2016	WMIC.exe
Token: SeDebugPrivilege	3788	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2016	WMIC.exe
Token: SeSecurityPrivilege	2016	WMIC.exe
Token: SeTakeOwnershipPrivilege	2016	WMIC.exe
Token: SeLoadDriverPrivilege	2016	WMIC.exe
Token: SeSystemProfilePrivilege	2016	WMIC.exe
Token: SeSystemtimePrivilege	2016	WMIC.exe
Token: SeProfSingleProcessPrivilege	2016	WMIC.exe
Token: SeIncBasePriorityPrivilege	2016	WMIC.exe
Token: SeCreatePagefilePrivilege	2016	WMIC.exe
Token: SeBackupPrivilege	2016	WMIC.exe
Token: SeRestorePrivilege	2016	WMIC.exe
Token: SeShutdownPrivilege	2016	WMIC.exe
Token: SeDebugPrivilege	2016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2016	WMIC.exe
Token: SeRemoteShutdownPrivilege	2016	WMIC.exe
Token: SeUndockPrivilege	2016	WMIC.exe
Token: SeManageVolumePrivilege	2016	WMIC.exe
Token: 33	2016	WMIC.exe
Token: 34	2016	WMIC.exe
Token: 35	2016	WMIC.exe
Token: 36	2016	WMIC.exe
Token: SeDebugPrivilege	3148	tasklist.exe
Token: SeDebugPrivilege	2736	tasklist.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeIncreaseQuotaPrivilege	4148	WMIC.exe
Token: SeSecurityPrivilege	4148	WMIC.exe
Token: SeTakeOwnershipPrivilege	4148	WMIC.exe
Token: SeLoadDriverPrivilege	4148	WMIC.exe
Token: SeSystemProfilePrivilege	4148	WMIC.exe
Token: SeSystemtimePrivilege	4148	WMIC.exe
Token: SeProfSingleProcessPrivilege	4148	WMIC.exe
Token: SeIncBasePriorityPrivilege	4148	WMIC.exe
Token: SeCreatePagefilePrivilege	4148	WMIC.exe
Token: SeBackupPrivilege	4148	WMIC.exe
Token: SeRestorePrivilege	4148	WMIC.exe
Token: SeShutdownPrivilege	4148	WMIC.exe
Token: SeDebugPrivilege	4148	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4148	WMIC.exe
Token: SeRemoteShutdownPrivilege	4148	WMIC.exe
Token: SeUndockPrivilege	4148	WMIC.exe
Token: SeManageVolumePrivilege	4148	WMIC.exe
Token: 33	4148	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4596	4332	CCGen&Checker.exe	82
PID 4332 wrote to memory of 4596	4332	CCGen&Checker.exe	82
PID 4332 wrote to memory of 4596	4332	CCGen&Checker.exe	82
PID 4596 wrote to memory of 696	4596	CCGen&Checker.exe	84
PID 4596 wrote to memory of 696	4596	CCGen&Checker.exe	84
PID 4596 wrote to memory of 696	4596	CCGen&Checker.exe	84
PID 4596 wrote to memory of 1332	4596	CCGen&Checker.exe	85
PID 4596 wrote to memory of 1332	4596	CCGen&Checker.exe	85
PID 4596 wrote to memory of 1332	4596	CCGen&Checker.exe	85
PID 1332 wrote to memory of 3788	1332	cmd.exe	88
PID 1332 wrote to memory of 3788	1332	cmd.exe	88
PID 1332 wrote to memory of 3788	1332	cmd.exe	88
PID 696 wrote to memory of 2016	696	cmd.exe	89
PID 696 wrote to memory of 2016	696	cmd.exe	89
PID 696 wrote to memory of 2016	696	cmd.exe	89
PID 4596 wrote to memory of 3316	4596	CCGen&Checker.exe	90
PID 4596 wrote to memory of 3316	4596	CCGen&Checker.exe	90
PID 4596 wrote to memory of 3316	4596	CCGen&Checker.exe	90
PID 3316 wrote to memory of 1616	3316	cmd.exe	92
PID 3316 wrote to memory of 1616	3316	cmd.exe	92
PID 3316 wrote to memory of 1616	3316	cmd.exe	92
PID 4596 wrote to memory of 3396	4596	CCGen&Checker.exe	93
PID 4596 wrote to memory of 3396	4596	CCGen&Checker.exe	93
PID 4596 wrote to memory of 3396	4596	CCGen&Checker.exe	93
PID 3396 wrote to memory of 1228	3396	cmd.exe	95
PID 3396 wrote to memory of 1228	3396	cmd.exe	95
PID 3396 wrote to memory of 1228	3396	cmd.exe	95
PID 4596 wrote to memory of 1636	4596	CCGen&Checker.exe	96
PID 4596 wrote to memory of 1636	4596	CCGen&Checker.exe	96
PID 4596 wrote to memory of 1636	4596	CCGen&Checker.exe	96
PID 4596 wrote to memory of 2392	4596	CCGen&Checker.exe	97
PID 4596 wrote to memory of 2392	4596	CCGen&Checker.exe	97
PID 4596 wrote to memory of 2392	4596	CCGen&Checker.exe	97
PID 2392 wrote to memory of 3148	2392	cmd.exe	100
PID 2392 wrote to memory of 3148	2392	cmd.exe	100
PID 2392 wrote to memory of 3148	2392	cmd.exe	100
PID 1636 wrote to memory of 4876	1636	cmd.exe	101
PID 1636 wrote to memory of 4876	1636	cmd.exe	101
PID 1636 wrote to memory of 4876	1636	cmd.exe	101
PID 4596 wrote to memory of 1304	4596	CCGen&Checker.exe	102
PID 4596 wrote to memory of 1304	4596	CCGen&Checker.exe	102
PID 4596 wrote to memory of 1304	4596	CCGen&Checker.exe	102
PID 4596 wrote to memory of 1564	4596	CCGen&Checker.exe	103
PID 4596 wrote to memory of 1564	4596	CCGen&Checker.exe	103
PID 4596 wrote to memory of 1564	4596	CCGen&Checker.exe	103
PID 4596 wrote to memory of 3344	4596	CCGen&Checker.exe	104
PID 4596 wrote to memory of 3344	4596	CCGen&Checker.exe	104
PID 4596 wrote to memory of 3344	4596	CCGen&Checker.exe	104
PID 4596 wrote to memory of 1928	4596	CCGen&Checker.exe	105
PID 4596 wrote to memory of 1928	4596	CCGen&Checker.exe	105
PID 4596 wrote to memory of 1928	4596	CCGen&Checker.exe	105
PID 3344 wrote to memory of 2736	3344	cmd.exe	111
PID 3344 wrote to memory of 2736	3344	cmd.exe	111
PID 3344 wrote to memory of 2736	3344	cmd.exe	111
PID 1304 wrote to memory of 3760	1304	cmd.exe	112
PID 1304 wrote to memory of 3760	1304	cmd.exe	112
PID 1304 wrote to memory of 3760	1304	cmd.exe	112
PID 1928 wrote to memory of 1540	1928	cmd.exe	113
PID 1928 wrote to memory of 1540	1928	cmd.exe	113
PID 1928 wrote to memory of 1540	1928	cmd.exe	113
PID 1564 wrote to memory of 4208	1564	cmd.exe	114
PID 1564 wrote to memory of 4208	1564	cmd.exe	114
PID 1564 wrote to memory of 4208	1564	cmd.exe	114
PID 4208 wrote to memory of 920	4208	cmd.exe	115

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1616	attrib.exe

C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe
"C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe
  "C:\Users\Admin\AppData\Local\Temp\CCGen&Checker.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\SysWOW64\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c chcp
      4⤵
      System Location Discovery: System Language Discovery
      PID:3760
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c chcp
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4168
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1908
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      System Location Discovery: System Language Discovery
      Gathers system information
      PID:4724
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      System Location Discovery: System Language Discovery
      PID:4124
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      System Location Discovery: System Language Discovery
      Collects information from the system
      Suspicious use of AdjustPrivilegeToken
      PID:4148
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      System Location Discovery: System Language Discovery
      PID:3972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3528
  - - C:\Windows\SysWOW64\net.exe
      net localgroup
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1204
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      System Location Discovery: System Language Discovery
      PID:532
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1612
  - - C:\Windows\SysWOW64\net.exe
      net user guest
      4⤵
      System Location Discovery: System Language Discovery
      PID:2004
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
  - - C:\Windows\SysWOW64\net.exe
      net user administrator
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1444
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      System Location Discovery: System Language Discovery
      PID:3592
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:3588
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:4432
  - - C:\Windows\SysWOW64\ROUTE.EXE
      route print
      4⤵
      System Location Discovery: System Language Discovery
      PID:208
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      PID:1136
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      System Location Discovery: System Language Discovery
      System Network Connections Discovery
      Gathers network information
      PID:5060
  - - C:\Windows\SysWOW64\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3680
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3020
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1228
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2280
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI43322\VCRUNTIME140.dll

Filesize
87KB

MD5
656ffcbfe10e81b64a59f7bfc86581ea

SHA1
765fe7b0bd404cb6fabb1b16372f2e41889f087b

SHA256
e72cb60bc3afaed6f38fa28d7111938067a9e4bed38a36f7a1ac6b9c1f16d0e2

SHA512
c5dfc2991cc382d5f9a03219f3e58c3c51b1baa77972d97548fa89b2c5a37d3eb80b1c7e2dae3e3336d02b755a53d78751f49d60250c4cb6ebcaa7a7756e1a18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_asyncio.pyd

Filesize
62KB

MD5
45a6e30198ece1dc464a170a07379021

SHA1
5b90acb1616fd7e94b25446d9c9dc5bc38765f08

SHA256
3f344c5d7e18e56aaa9c1b955fb684e8e7b6bc6ffd1fb3fc37342d3f7e282eb3

SHA512
64b11cb162e9505375cfa0bb778d2d776c014613ecdda84e8817d9fcc937f49112d9a5de681d175080d9f3417559eb49c3adf82ddfd2a0788a2d914ad05b9f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_bz2.pyd

Filesize
81KB

MD5
adfc86be452499e216b2929a7c18dd74

SHA1
94f3ddb57b35a523b9aaa745aa193332375b1add

SHA256
1526dafa789fb3217c964f26dc4bd6db58d3cbc9039943f8ce84f6a9e81a831c

SHA512
8f6f9ea9d246a6f7c7e05244c6fa230db13f00f2585c7351928af95208fb06a3bb62bfd97721fae8a1c4a2695cbd3ceeccd4fe556e1e4799b14ec7b804ab0ebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_cffi_backend.cp312-win32.pyd

Filesize
150KB

MD5
6341927c31792729d4f2bbd7f307cad7

SHA1
abab6ce59f38398389bad5e9a2b458671a3af497

SHA256
cb72f269c7246fbdabd1e28a8ad5c2e2fc3873b61d3fbc1b9f250095e3f180c7

SHA512
431122c404ad2bb620c4ba3cf6122c88d8f7c0b210227238350b6bb38eaa0a15d3f7026dc94c5663cb6eb1dc61992edc99366641bec0874ca4c885c15859c7da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_ctypes.pyd

Filesize
112KB

MD5
33ff9cb7552d6eeee148c0fbd81d642b

SHA1
78c690a28fb09a05a4f3bcb8268b6708e23ecc45

SHA256
3c067b41ea6bd14e18862d5fd1b6248c820704bd16d6e7178879416c3f3d83bd

SHA512
c0d2b27b396a2b0e815c80f5d31f87afb7a609e8739460c09dffb95314043cf95c9586cd71f9898734d120e5661c523197999119bbe1a4cdb209a1d44156d248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_decimal.pyd

Filesize
199KB

MD5
8489b11f716d3c6002173648f3d26cb3

SHA1
8d9d909347952a084260e81ff07582f25a7978b9

SHA256
636e30342cb24412420f6f31423e68a5c6b7ff4b6885ddbda59efa43a3aef73b

SHA512
9a6910595145d5b7bb695357d4f15d1e281d3c335c97fa16a351bc1a751ee079d01733514d5984ff4e97fd4683eeac3427cfd8b518208d450e370f1b4a42c8c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_hashlib.pyd

Filesize
51KB

MD5
4d501424d232a736c466e4ab1acfc4e9

SHA1
54c5598eb7a36d655f68dddbb922851c949e21ee

SHA256
5d1efa85f7452f4a6527733a133fd3596527ecaed2a660d2b92640d73af52e2e

SHA512
1bbece90c9f43767ea57706214c2bf6322a2485ef848e8ef3f854560b5db80b1a9d26c586ddf51e35b62af3c24f3f01d08a40e85aa2d34b7bffdb379733406cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_lzma.pyd

Filesize
144KB

MD5
017792b6a7b2ea92801d6a4a22cc0aac

SHA1
306e0d67fe9cc9362a8daec14eed0a8dc31b1df6

SHA256
286baa9939bdd5b906c042fb1b3ff23f60b70f02c5c535de1714798291a4c614

SHA512
626e6e607846a1981954b0c0e683d7bac19a8d841c7cbb2183bad4ec3d4dd3ba42f68cbe7ad65ea06b10318b5fad5ceceb0c01da85a99f15b151ba867706c637

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_multiprocessing.pyd

Filesize
31KB

MD5
aa2bcbc455c7954b33e2b7cafe0b2129

SHA1
7f1f693418c94274683681465026b0675f635694

SHA256
756bf0dffa84f95f357bfcc82ac43f7be7512d236066ad6d3effde76210a3b89

SHA512
446857a0cd1742637fc6cdb5bd8a750e53b2afd3974d0c48f6c175bbbe29c4a1a3f5813a593b3c259ebf5ef62467da0868dfe34db9650c73ace41b8ee1d146a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_overlapped.pyd

Filesize
45KB

MD5
0287bde7314fb8c972f5aeaa51b54499

SHA1
3a1dbf10146b85e0eca06aac34dfa3d94160503b

SHA256
d7ce78b0adda307a5e0cec5b6b15ce5614c10f1c7d5f4abfd7d95d8842127743

SHA512
301e6d35a541549958b58ba62369a419efad4d2d48075a45b18a4778aff6efda3a75613d01ee1b7675c9b72fbc06f2ff88b173608e7e100b779a750eaee0c5d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_queue.pyd

Filesize
30KB

MD5
afebd7071c45feb3f206d4ebeb720449

SHA1
87deeedb7f7c1394aa322b01bbe01ca4045c1d04

SHA256
8be339abaf7e20682fbb15d7e794c42d737df0ce496401f96fc97eb798a081a6

SHA512
2dffc5caa4a6b6f6340840bc26b396d7f148569509f33a9647d4f26faa63dc2c536eadf30894240c0bfa2a115ca9884ec7459c4d08f5d5253fc44330d1b62a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_socket.pyd

Filesize
72KB

MD5
cef898778bfa3710b449b36486bebb19

SHA1
d454e0a5ec759e14576d4b77e9cfdae501dc7c0b

SHA256
6911acb804b0c70545f5e434ae3d28d1d9abec2405dd28958adb07fd5e5692f3

SHA512
bed03d43fd7a1d308db06700d4a7bc3608c9552e370833887b31d31176cfb90be5232a86c4f72cba740f308393cdd25e8bde2e9d81d26e08706f6aa329ecee9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_sqlite3.pyd

Filesize
96KB

MD5
f76e5cf650e2d507072de34252d43c02

SHA1
3703c45fe629a32f84cd062b2343a5f4bee33ce6

SHA256
1396663c219f7e78147230ff772b530fd1024f3a446afc364b580cb90774b01d

SHA512
8a2485ae0a3911373a1f0f545efb0fe7783d081c8ef29d7aa1a422cf425928a926ab35e58d5c5e84878ba68464ed35abc626449020e1495bbe27722969015300

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_ssl.pyd

Filesize
156KB

MD5
0808962ae6ea3dd0347ded3a79bc5435

SHA1
ad57dfe1faa787f9d019aee35685c085ed87fe83

SHA256
72fcc3d3a630b5ac9c9f2eff16d4d9e2fb5277381b54a8e7fa001cf26dd9ff51

SHA512
51b4a270fe0edbc37b5408c161abe04ba08a7268f237ad11986e0c9f1ec6e15de55375b9ee0a226997ebd0b4b06a6e272943a37f4b386df3b88573c3d19d387b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_uuid.pyd

Filesize
25KB

MD5
b97484afab5612fff295c59ddeb7071b

SHA1
95f34b5f9c4d39412f9a2eb449add6010d65f792

SHA256
689a578f93e54561b2f57c0afcfe73584b1f84696aff796e7104fd8daa57a455

SHA512
127d0d7bd461e7dec21f80ab624c650e0c2384edc5831212f1a1c6bb19179366857af845aef315caf656da890fd74dfdeae9a230429f96761ec5e272cfe7f792

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\_wmi.pyd

Filesize
34KB

MD5
33e7c8aff00646bb1012f2e3f8503121

SHA1
4ee24df2b7c82f5226a70eb96b451d056b1237e3

SHA256
8ed6d1a66053d57a84d93f688b4e659279e16dd86b00e54629f4c1328e963830

SHA512
296be7662a1525fabb615a0e71c73a0a7c3b07d06e706f5179c459ae822a5ee88b6049f92a81b2b0267968f712110522e9ffe9a51b393ffbdbfa6effd2d03f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\aiohttp\_http_parser.cp312-win32.pyd

Filesize
241KB

MD5
dd751d7da6d8cf9731b20ad40a29eb20

SHA1
797645480168bc653301ba2d4b443db539d6e133

SHA256
18a196871cf9c6225e27d90f0efe4a29fab163d695cea40b0624d4acd43da150

SHA512
4fe1fc5b8074e8031da34ff7e7807b31ca3324c8e5b9f664abcb41e0c4301fe8f23d974d148a94fd15ed59eed2b46c19203954c7ad688d18101f3ea892ce9f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\aiohttp\_http_writer.cp312-win32.pyd

Filesize
42KB

MD5
bc33055297adcfb5834ab08c0af915fd

SHA1
6c42e45253fc89a32d74688d6c3c1feec1aad746

SHA256
b4e4323674218ab05995e1b54f7ec9721605dc79ce2a9d7f5d2ffa37ba722a36

SHA512
1d385f481b452354cf2368c72e77cce1f7681746505073e2391f07d7356742285127e170c0734a1479a9a71bb7938ff8d83340402dbe6f0e10b5b96ed73b9484

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\aiohttp\_websocket\mask.cp312-win32.pyd

Filesize
30KB

MD5
253ff5073669ae56e055e7afb49136dd

SHA1
5c13528e7fc257ce0a660af2bbb8295e169dd4e2

SHA256
f2cf0cd79e56b59cb603cad70c67161a7394b16521daf94c72006c1c21eeccdd

SHA512
cc4e263cc87d6e8fff4b8aeba44e4d4c27a0b8bac2de68c3f5c5771f75a2edc319fe4f66b1a7921be83330694a0e832ab7a5c38736954de53deb263c3edc9057

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\aiohttp\_websocket\reader_c.cp312-win32.pyd

Filesize
147KB

MD5
b23b0ee1bff39de3b3726966f1f7ac22

SHA1
57d241e6c5437d9064aefd917ef72b60f577cfb9

SHA256
8f46164be8f4b2376199f8cb7ebb5708c54a69e505cea78587ff625ecfc0cc2a

SHA512
6197c8a4e1a3897bebc095280c1b518f0d8e7f06232ce3034647e8c6b53222d87b70fd054924e6d8d44a884d2030d668f73dd997cc56ec90c1ae32977a2c4306

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\base_library.zip

Filesize
1.3MB

MD5
0cb8186855e5a17427aa0f2d16e491a9

SHA1
8e370a2a864079366d329377bec1a9bbc54b185c

SHA256
13e24b36c20b3da9914c67b61614b262f3fc1ca7b2ee205ded41acc57865bfef

SHA512
855ff87e74e4bd4719db5b17e577e5ae6ca5eedd539b379625b28bccdf417f15651a3bacf06d6188c3fcaac5814dee753bf058f59f73c7050a0716aa7e718168

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\cryptography\hazmat\bindings\_rust.pyd

Filesize
5.8MB

MD5
dd421612b893c6b1aabb34de204ec9da

SHA1
e68887e45727a0415178d0e34f3283df0987ecde

SHA256
14a4ebd3043a46a4632c35c2cd820e540b3a9a8d9b97855f0e6a3a16a2a2941d

SHA512
82bfe51ce530e6ba9b1ca042029d6b8ad9a16e6e39ae0e52d79853e64335a708f8251beff00b24da5d7e6f5d6b6586261d86d27b803124a7139478eb2fd76b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\libcrypto-3.dll

Filesize
3.3MB

MD5
6a0059679746758aeae70c68128d6125

SHA1
176b3161828d43442864825132fe5e7fd77c3bbb

SHA256
36c1a3b66539e072e43579bfcdef4375c49bf55bb1b3d264939757a9a77fa288

SHA512
5f85507e0aeb16eda8c1b7afe8531622e2f2d29379aec3ce1bfe263b8e4f24ce2ec20877b4870b657366a1a6e5650879db9ae6a02685c1a6e26e3234e9f93d2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\libffi-8.dll

Filesize
34KB

MD5
74d2b5e0120a6faae57042a9894c4430

SHA1
592f115016a964b7eb42860b589ed988e9fff314

SHA256
b982741576a050860c3f3608c7b269dbd35ab296429192b8afa53f1f190069c0

SHA512
f3c62f270488d224e24e29a078439736fa51c9ac7b0378dd8ac1b6987c8b8942a0131062bd117977a37046d4b1488f0f719f355039692bc21418fdfbb182e231

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\libssl-3.dll

Filesize
622KB

MD5
4d465b99ecdd48ee5bd7da05261895b3

SHA1
edbf439794cc6f47139ab6c8220a837a26d5fa0e

SHA256
a9cf2bb4b3aa5c07f77cd1ed0bcd8ab3ccd2d0616f6eb5f5bd809a41708b37b7

SHA512
9b939d818141410ce67ce1390dd5ffec35159eb68eb77a697318ef29df7baa4494e27c697e24d32cfbad625a59e8b80a26840292ba6a06f5b37a2b86ee6061ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\multidict\_multidict.cp312-win32.pyd

Filesize
37KB

MD5
74d90e7f15b676c6dc12f54b79592721

SHA1
005018279bcc58aa79e128c8d4170758dca7f3b5

SHA256
8ee9a90e5cbbe9323050ada4cce9ef51901f76b962b6f5913c68d3756a3d0d0e

SHA512
8787c0962cd45c2990c1ef26339429c79cc13bdbd9030d5eb179284bc139753f7cf29872552a1b6a8e443e0d21df7cc63b0da508c6b2c2c2fae7c7c005cfd4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\propcache\_helpers_c.cp312-win32.pyd

Filesize
62KB

MD5
6115a9852aa1fd3ec8c8b5bd815c5fae

SHA1
b7954f087d5070408606cb06d6ec9feea8cb9747

SHA256
aabf80573dd277a6ea00c446da870a2610730106db6391717c0f8cc701221fbc

SHA512
63d42c4b86e404d3c4e346f4f6d656f4f065f7085bde6a717759ad2fc66b71a100655d28a94c7711f8d1bf393aa025faabd35fcdc555a28907d311371201598a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\pyexpat.pyd

Filesize
174KB

MD5
e5931829327b6ce66e329777fc91aa6c

SHA1
60a542a501e8381aae4aa13827a4f55d27a5826c

SHA256
6e68bebb29721d8c63b2049b6e0219cd53091dd99f17d5f017a315209cd9f8ec

SHA512
55e632aead42588ba931317278508f20ed5843cee255f3348c4ba307eb7f77cb0253f6bf9ccef2990a0997bceaf7c27ded1b804a7395730d368740a0e63dd63b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\python3.DLL

Filesize
68KB

MD5
4945b93f8dd31e0b888d740a8e4cc654

SHA1
24428213793148c219e5998ad3883f88861a92bc

SHA256
2fd506d5e68fc684254efde205f950f64e075d573df3531737bc8b52e2fd9f5d

SHA512
8dc46ded06702a3539b5fdd3f2c09c7ab7bb5dbafa7949039843f6dc90169b805ae66bfa503682ed7f0c589fff8754a44b9a4a34bd9a07d32723918d8d13d6d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\python312.dll

Filesize
5.6MB

MD5
7b82b2c836d5eb583b08f2545448f4e4

SHA1
53d9bac84ee353139087bd70a0bf75a366d3d470

SHA256
4a9f35b5c403b755fafacfe04dc9dd965df02d17710dade9a7b105af6aa75f3e

SHA512
af8e07bcf55d9f867772a02416f87c9ca7035154cf4e64859272babc8ab637258f85228dcc356bd5b1c4504d82aed9b93bed42fd4446dfa6513291ba9977ab89

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\select.pyd

Filesize
29KB

MD5
5b8da401e5e45118f4194ded80457fd0

SHA1
a11fbcb70d366474aee6768e8b85cca4a55cedb7

SHA256
1f89d0e6b84e469f2d3ccb5ffa61fed28a11bc68373e5cebb34e94ba1076f23f

SHA512
5b12b78c0c312a072db0228d342fa39e218ed177e56cf4c9e857592f5999caf5a3151559b798ef4991298818b1e44b18daf39c596e2b5535633e1cecc4344c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\sqlite3.dll

Filesize
1.2MB

MD5
b34a9f6eca7f42b4464f1099e593bc60

SHA1
1789b2ef0986ec48f33b0cd4590edeab68f6a389

SHA256
e3c4fd609ab58be644f2fed45ac468790d549710fc5c430db787328fdedcb16d

SHA512
ae0268110ec73edfc2999779e2a7f13c8ecc11af8bee082a666ff00e2bfdcd6e74f73286d423ad374f59b9797470724f3a6ecee5df50f6bd34ac9b43e359cf0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\unicodedata.pyd

Filesize
1.1MB

MD5
6448a6918f0df053e35c21f4b31993d1

SHA1
af0db0cbb1f363cd8df1ae5bdce83cb55434eccb

SHA256
934bdeb4477ee2303ea2d5e4be6e50b31ea35dea34f8ce38e59303e5683cfac1

SHA512
7425ccaa842f796a18dc410a4658a78c3f9a6f8ba96dcd661261ad30a9d2e0a20d734267d2730cc50cfd1f354640f8e858fbb8e6bf4cfbd972ec3f9349f9bb07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43322\yarl\_quoting_c.cp312-win32.pyd

Filesize
84KB

MD5
226c4b92a771116bedfb8686f6e9fc99

SHA1
1ba399bcf0f3e024198b80d3be78a4ea1d69d9fe

SHA256
7d5e6c7b527ea1e4dbfeb64ca58cb0615289eb1964ff0a21e8e38170899befd6

SHA512
50b937c63c9982532c1c248155d2d3bd6858d92db0bf2ed986c0a969bdb8c94fb86469f8e72e77b4c5addbc1d17db09a9013c23da678d383beba1674ba919ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qcl4jwtd.qqf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1540-158-0x0000000005750000-0x00000000057B6000-memory.dmp

Filesize
408KB

Download
memory/1540-156-0x0000000005640000-0x0000000005662000-memory.dmp

Filesize
136KB

Download
memory/1540-157-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/1540-155-0x0000000004FA0000-0x00000000055C8000-memory.dmp

Filesize
6.2MB

Download
memory/1540-154-0x0000000004930000-0x0000000004966000-memory.dmp

Filesize
216KB

Download
memory/1540-168-0x0000000005890000-0x0000000005BE4000-memory.dmp

Filesize
3.3MB

Download
memory/1540-169-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Filesize
120KB

Download
memory/1540-170-0x0000000005F20000-0x0000000005F6C000-memory.dmp

Filesize
304KB

Download
memory/1540-173-0x0000000006450000-0x00000000064E6000-memory.dmp

Filesize
600KB

Download
memory/1540-174-0x00000000063D0000-0x00000000063EA000-memory.dmp

Filesize
104KB

Download
memory/1540-175-0x0000000006420000-0x0000000006442000-memory.dmp

Filesize
136KB

Download
memory/1540-176-0x0000000007650000-0x0000000007BF4000-memory.dmp

Filesize
5.6MB

Download
memory/1540-177-0x0000000007190000-0x0000000007222000-memory.dmp

Filesize
584KB

Download