exelastealer | hxxps://www[.]dosyaupload[.]com/3tC5q/12312[.]exe

Analysis

max time kernel
46s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14-07-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dosyaupload.com/3tC5q/12312.exe

Score

10^/10

exelastealer defense_evasion evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1680	netsh.exe
2032	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
3944	12312.exe
1360	12312.exe
3612	12312.exe
3868	12312.exe

Loads dropped DLL 61 IoCs

pid	Process
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
1360	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe
3868	12312.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023517-324.dat	upx
behavioral1/memory/1360-328-0x00007FFF388D0000-0x00007FFF38D36000-memory.dmp	upx
behavioral1/files/0x00070000000234e8-330.dat	upx
behavioral1/files/0x0007000000023511-336.dat	upx
behavioral1/memory/1360-357-0x00007FFF4FE50000-0x00007FFF4FE5F000-memory.dmp	upx
behavioral1/memory/1360-356-0x00007FFF4AC60000-0x00007FFF4AC84000-memory.dmp	upx
behavioral1/files/0x00070000000234f1-354.dat	upx
behavioral1/files/0x00070000000234f0-353.dat	upx
behavioral1/files/0x00070000000234ef-352.dat	upx
behavioral1/files/0x00070000000234ed-350.dat	upx
behavioral1/files/0x00070000000234ec-349.dat	upx
behavioral1/files/0x00070000000234eb-348.dat	upx
behavioral1/files/0x00070000000234ea-347.dat	upx
behavioral1/files/0x00070000000234e9-346.dat	upx
behavioral1/files/0x00070000000234e7-345.dat	upx
behavioral1/files/0x00070000000234e6-344.dat	upx
behavioral1/files/0x00070000000234e5-343.dat	upx
behavioral1/files/0x000700000002351a-342.dat	upx
behavioral1/files/0x0007000000023519-341.dat	upx
behavioral1/files/0x0007000000023518-340.dat	upx
behavioral1/files/0x0007000000023515-339.dat	upx
behavioral1/files/0x0007000000023512-338.dat	upx
behavioral1/files/0x0007000000023510-337.dat	upx
behavioral1/memory/1360-361-0x00007FFF4BB20000-0x00007FFF4BB2D000-memory.dmp	upx
behavioral1/memory/1360-360-0x00007FFF4AC40000-0x00007FFF4AC59000-memory.dmp	upx
behavioral1/memory/1360-363-0x00007FFF49940000-0x00007FFF49958000-memory.dmp	upx
behavioral1/memory/1360-366-0x00007FFF48680000-0x00007FFF486AC000-memory.dmp	upx
behavioral1/memory/1360-367-0x00007FFF47340000-0x00007FFF4735F000-memory.dmp	upx
behavioral1/memory/1360-369-0x00007FFF3BD40000-0x00007FFF3BEBA000-memory.dmp	upx
behavioral1/memory/1360-444-0x00007FFF47310000-0x00007FFF4733E000-memory.dmp	upx
behavioral1/memory/1360-448-0x00007FFF3BC80000-0x00007FFF3BD38000-memory.dmp	upx
behavioral1/memory/1360-460-0x00007FFF38550000-0x00007FFF388C9000-memory.dmp	upx
behavioral1/memory/1360-497-0x00007FFF4BA70000-0x00007FFF4BA80000-memory.dmp	upx
behavioral1/memory/1360-496-0x00007FFF472F0000-0x00007FFF47304000-memory.dmp	upx
behavioral1/memory/1360-498-0x00007FFF388D0000-0x00007FFF38D36000-memory.dmp	upx
behavioral1/memory/1360-501-0x00007FFF3BB60000-0x00007FFF3BC78000-memory.dmp	upx
behavioral1/memory/1360-500-0x00007FFF4B8E0000-0x00007FFF4B8F5000-memory.dmp	upx
behavioral1/memory/1360-499-0x00007FFF4B900000-0x00007FFF4B914000-memory.dmp	upx
behavioral1/memory/1360-502-0x00007FFF4AC40000-0x00007FFF4AC59000-memory.dmp	upx
behavioral1/memory/1360-503-0x00007FFF50050000-0x00007FFF50072000-memory.dmp	upx
behavioral1/memory/1360-506-0x00007FFF54660000-0x00007FFF54677000-memory.dmp	upx
behavioral1/memory/1360-508-0x00007FFF545F0000-0x00007FFF54609000-memory.dmp	upx
behavioral1/memory/1360-507-0x00007FFF47340000-0x00007FFF4735F000-memory.dmp	upx
behavioral1/memory/1360-509-0x00007FFF3BD40000-0x00007FFF3BEBA000-memory.dmp	upx
behavioral1/memory/1360-512-0x00007FFF47310000-0x00007FFF4733E000-memory.dmp	upx
behavioral1/memory/1360-511-0x00007FFF50F40000-0x00007FFF50F51000-memory.dmp	upx
behavioral1/memory/1360-510-0x00007FFF50000000-0x00007FFF50049000-memory.dmp	upx
behavioral1/memory/1360-514-0x00007FFF4FF90000-0x00007FFF4FFAE000-memory.dmp	upx
behavioral1/memory/1360-513-0x00007FFF3BC80000-0x00007FFF3BD38000-memory.dmp	upx
behavioral1/memory/1360-515-0x00007FFF38550000-0x00007FFF388C9000-memory.dmp	upx
behavioral1/memory/1360-517-0x00007FFF3B460000-0x00007FFF3BB55000-memory.dmp	upx
behavioral1/memory/1360-518-0x00007FFF472F0000-0x00007FFF47304000-memory.dmp	upx
behavioral1/memory/1360-519-0x00007FFF4B830000-0x00007FFF4B868000-memory.dmp	upx
behavioral1/memory/1360-580-0x00007FFF3BB60000-0x00007FFF3BC78000-memory.dmp	upx
behavioral1/memory/1360-590-0x00007FFF50050000-0x00007FFF50072000-memory.dmp	upx
behavioral1/memory/1360-661-0x00007FFF4B830000-0x00007FFF4B868000-memory.dmp	upx
behavioral1/memory/3868-663-0x00007FFF3A630000-0x00007FFF3AA96000-memory.dmp	upx
behavioral1/memory/1360-662-0x00007FFF54660000-0x00007FFF54677000-memory.dmp	upx
behavioral1/memory/1360-660-0x00007FFF3B460000-0x00007FFF3BB55000-memory.dmp	upx
behavioral1/memory/1360-657-0x00007FFF50000000-0x00007FFF50049000-memory.dmp	upx
behavioral1/memory/1360-656-0x00007FFF545F0000-0x00007FFF54609000-memory.dmp	upx
behavioral1/memory/1360-654-0x00007FFF50050000-0x00007FFF50072000-memory.dmp	upx
behavioral1/memory/1360-650-0x00007FFF4BA70000-0x00007FFF4BA80000-memory.dmp	upx
behavioral1/memory/1360-649-0x00007FFF472F0000-0x00007FFF47304000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
104	discord.com
105	discord.com
106	discord.com
107	discord.com
108	discord.com
109	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
84	ip-api.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2464	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2676	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00080000000234d9-241.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
2212	WMIC.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
1132	tasklist.exe
4864	tasklist.exe
3488	tasklist.exe
1572	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1136	ipconfig.exe
3236	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1140	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1584	taskkill.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 586958.crdownload:SmartScreen	msedge.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4416	schtasks.exe
1208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
2552	msedge.exe
2552	msedge.exe
3996	identity_helper.exe
3996	identity_helper.exe
2832	msedge.exe
2832	msedge.exe
2336	powershell.exe
2336	powershell.exe
2336	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2960	WMIC.exe
Token: SeSecurityPrivilege	2960	WMIC.exe
Token: SeTakeOwnershipPrivilege	2960	WMIC.exe
Token: SeLoadDriverPrivilege	2960	WMIC.exe
Token: SeSystemProfilePrivilege	2960	WMIC.exe
Token: SeSystemtimePrivilege	2960	WMIC.exe
Token: SeProfSingleProcessPrivilege	2960	WMIC.exe
Token: SeIncBasePriorityPrivilege	2960	WMIC.exe
Token: SeCreatePagefilePrivilege	2960	WMIC.exe
Token: SeBackupPrivilege	2960	WMIC.exe
Token: SeRestorePrivilege	2960	WMIC.exe
Token: SeShutdownPrivilege	2960	WMIC.exe
Token: SeDebugPrivilege	2960	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2960	WMIC.exe
Token: SeRemoteShutdownPrivilege	2960	WMIC.exe
Token: SeUndockPrivilege	2960	WMIC.exe
Token: SeManageVolumePrivilege	2960	WMIC.exe
Token: 33	2960	WMIC.exe
Token: 34	2960	WMIC.exe
Token: 35	2960	WMIC.exe
Token: 36	2960	WMIC.exe
Token: SeDebugPrivilege	3488	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2960	WMIC.exe
Token: SeSecurityPrivilege	2960	WMIC.exe
Token: SeTakeOwnershipPrivilege	2960	WMIC.exe
Token: SeLoadDriverPrivilege	2960	WMIC.exe
Token: SeSystemProfilePrivilege	2960	WMIC.exe
Token: SeSystemtimePrivilege	2960	WMIC.exe
Token: SeProfSingleProcessPrivilege	2960	WMIC.exe
Token: SeIncBasePriorityPrivilege	2960	WMIC.exe
Token: SeCreatePagefilePrivilege	2960	WMIC.exe
Token: SeBackupPrivilege	2960	WMIC.exe
Token: SeRestorePrivilege	2960	WMIC.exe
Token: SeShutdownPrivilege	2960	WMIC.exe
Token: SeDebugPrivilege	2960	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2960	WMIC.exe
Token: SeRemoteShutdownPrivilege	2960	WMIC.exe
Token: SeUndockPrivilege	2960	WMIC.exe
Token: SeManageVolumePrivilege	2960	WMIC.exe
Token: 33	2960	WMIC.exe
Token: 34	2960	WMIC.exe
Token: 35	2960	WMIC.exe
Token: 36	2960	WMIC.exe
Token: SeDebugPrivilege	1572	tasklist.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	1132	tasklist.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeIncreaseQuotaPrivilege	2212	WMIC.exe
Token: SeSecurityPrivilege	2212	WMIC.exe
Token: SeTakeOwnershipPrivilege	2212	WMIC.exe
Token: SeLoadDriverPrivilege	2212	WMIC.exe
Token: SeSystemProfilePrivilege	2212	WMIC.exe
Token: SeSystemtimePrivilege	2212	WMIC.exe
Token: SeProfSingleProcessPrivilege	2212	WMIC.exe
Token: SeIncBasePriorityPrivilege	2212	WMIC.exe
Token: SeCreatePagefilePrivilege	2212	WMIC.exe
Token: SeBackupPrivilege	2212	WMIC.exe
Token: SeRestorePrivilege	2212	WMIC.exe
Token: SeShutdownPrivilege	2212	WMIC.exe
Token: SeDebugPrivilege	2212	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2212	WMIC.exe
Token: SeRemoteShutdownPrivilege	2212	WMIC.exe
Token: SeUndockPrivilege	2212	WMIC.exe
Token: SeManageVolumePrivilege	2212	WMIC.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
1360	12312.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 1984	2552	msedge.exe	83
PID 2552 wrote to memory of 1984	2552	msedge.exe	83
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 64	2552	msedge.exe	84
PID 2552 wrote to memory of 4624	2552	msedge.exe	85
PID 2552 wrote to memory of 4624	2552	msedge.exe	85
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86
PID 2552 wrote to memory of 3220	2552	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4056	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dosyaupload.com/3tC5q/12312.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4b2d46f8,0x7fff4b2d4708,0x7fff4b2d4718
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,2130595658575984393,14195202795747487130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Users\Admin\Downloads\12312.exe
  "C:\Users\Admin\Downloads\12312.exe"
  2⤵
  - Executes dropped EXE
  PID:3944
- - C:\Users\Admin\Downloads\12312.exe
    "C:\Users\Admin\Downloads\12312.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:1360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3180
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:220
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      PID:2464
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
      4⤵
      PID:396
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /TN "ExelaUpdateService"
        5⤵
        
        PID:2328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      PID:2212
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      PID:4632
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:5020
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1984"
      4⤵
      PID:4064
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1984
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:4372
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:3480
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:3716
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:1968
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2224
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      PID:704
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      PID:4576
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:1140
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:4444
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:1988
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:1964
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:1808
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:368
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:532
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:4184
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:32
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:5060
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:1984
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:116
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:2844
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:4784
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:5052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:4864
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:1136
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:3256
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        
        PID:2100
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        Gathers network information
        
        PID:3236
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:2676
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1680
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      PID:4972
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:4816
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:1968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3516
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5084

C:\Users\Admin\Downloads\12312.exe
"C:\Users\Admin\Downloads\12312.exe"
1⤵
- Executes dropped EXE
PID:3612
- C:\Users\Admin\Downloads\12312.exe
  "C:\Users\Admin\Downloads\12312.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
20KB

MD5
261fde3726e10ce16c8c064a911b063f

SHA1
aa00c171e26c3adfe81ce92ff0d69a9ae2221819

SHA256
752c5bddc58e3f7d6670d7c92c5731e627f963a7c44ff1c2e985129b5f4333f7

SHA512
1cee8c21fc32320d056f2cbd9300c72204907297000b3d3c5f2c1d1124e46db29d23d7d0e13a8fc1b1b4802f6c15bbb24c402439a4c106bb00d98dbe5ed3a9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
343edb4e9488330634411c3fbc0f3772

SHA1
887a9cc741f92e42fab137caf2cb4632e526be15

SHA256
d46dbe6bb22687c6a6b2a121de60e41f9c6102bb13992124cbb5dea7d1978a86

SHA512
bd175a5b2183e3358af0126f8102c49d7c79bed739595a786747e9c130bba0bfad459cecf723b7de4ddd42ad946db3e29307df10ff2297a2c9b4799999e274c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
977a9ef6262bdb16bd602b569c443c04

SHA1
fa6b23ec47e4e065db66ee8392b80fcec396ca34

SHA256
29f4104cf0cb9b1af104a3d482b72ae6993928bbb8d76f22b23700db1057e61a

SHA512
aca3c0906ddbbb145551694c8ec35ea7eeff5de93338b7cbc9372927e78964ccbe4240b096934f05fcb38d6b3111fae979fff3ad7dcf2fe452c15f22a621acb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
30bd8506daaae70a06bf979cbfb0ccea

SHA1
95f0e2bf10214a65ccc8609d3f0e9cf8ae4a0e7c

SHA256
9e28dfd873644e4691693963014ba7c32d93e58d727bb5d389d5ed1846945b39

SHA512
f0ee9ccd4ae0b6ab0df81defb920cd98a7fca8c63bd40b7fb5a1ab959741ccd25ab61e7e6b0016698b7a16f595c1e2a2b8d8db7753a90ab7674dd04636ef9434

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
68180927b0b090b4d5ec11e43e73e72a

SHA1
19fd6deaff37809f130406232573531a2a3a7047

SHA256
84da2c5f178f28d5163b88419fe5b16299374b804e1ffa174605d1870f8f76d5

SHA512
fe570182062c46a6d2aeea5098bd768a44d58fcebf7be5a583b6152c576e0181afa945383829e22fae5170ce2febd3880814abff34f34ac40b16b143ef39fe7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1d13d8f192869ec0b8903316712e48ad

SHA1
7dcdf3ee055f1eded2c6faf32a96955bc1af0d58

SHA256
b6c4ea01ed0b47a982138bc7f2ed251dcb1cbb7811c8f7c0af837254b77ff9aa

SHA512
42dc5f490c9a761f99a2c865e7cfe622029795f2b863b1b2540172c48a12dc96cc7be9b592bee9950d6457981bb60b1af53fcf6aad5f945af81ffbd470f18c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
cc98bb4e11d17cf846163a972c072045

SHA1
b0a4a5c0f481ac637931ec41d257b303260e52c2

SHA256
443afcbc6197cd9be99d010f4f287ae2b6472fcee70cd5c748faae1ea5c6dc84

SHA512
fe8f761f2a9791bebfc9430052826a99728583ac775da06beca212dca1285d00033f24b5c0238b051af7b1c3df289a2cd45c4fe51940213ded4a1d31bcc6413b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22ab4b9301adeba29b20a3a0ad30c7ca

SHA1
851db2352378ffec68da1992367b10f73e5f6382

SHA256
09148f71b03cc80ab3b867e6ae2bc145b0dca24f203bde5e5dc4703afa54bcd9

SHA512
7b06bf415c16f33f3786c66eb5cf2e9d81b56f6089cec192d499d94677bd321281c50bee7c5c7269466368ed1d70d6638816d53104b634ae093a2b429336e8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c2892112f2628270f00df2b8c3f6796

SHA1
0a127c5ffe398440ed24c60f915da798473c6d71

SHA256
358b163cb5a726939a12bfd8a9bf6f9629e25a0c99621de8a2b963fc00706345

SHA512
fe2fe897e8a0342da7b94dbc792cbd5bac0f836741e8e7d698daebe82f3d713eb526d417738181dc45bb271aac76c4359690119919955198e4b53e55b9866523

Download Submit
C:\Users\Admin\AppData\Local\Temp\DownloadData.db

Filesize
124KB

MD5
c0b85c272096e28aa9d97ff581af3bc7

SHA1
0826bb1cb4ef49080b040cf9c98a227567aedaa5

SHA256
a601851d901c4b09409c0c593bbbab241f63892ea82618dff268fc7a0b78750e

SHA512
635f2a215617800816dd5ea62e4f50dc6448cb239961ef45c0c8bf4a22f57bf8910ae068b9eb22b5164f7d77bf17a4c89f7987dd12581d08f061b45a37ff1e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_asyncio.pyd

Filesize
35KB

MD5
021e66464fe95e60f9cf4169fb1c32a7

SHA1
ec9d69871aab3d739b6451f6fb3f7cf2b7693a5c

SHA256
5806f8f55e9634f09f5cf8ac6dd8f2fd19101c748f0f4b9cfab111068616f05b

SHA512
ce9602902015cd0a458fe73d9b5474bdf36b3bbdf6ae4231a9e319663edac5ece5cab2ebf0744cff83caf0ccdd91cba1ee869ae808a6b18271be2701fbd709c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_bz2.pyd

Filesize
47KB

MD5
9711532245f60f4a23eccf7ccac3621e

SHA1
6918ff56c1399532ef02cec3b22a18ffee20e1b2

SHA256
8da059307d40bcc3e58d991e9ca1e2fc081b8dd83e14d608b8f6e0c0a14a0da5

SHA512
2ed9aadbbd5c2eed7f81e97a5c0ba6efce6d73abcea43011b459c0a656c4c3b3acfa8fee7d3ca3fa2192356b6565099256a366286adb51000ac668023c7e36f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_cffi_backend.cp310-win_amd64.pyd

Filesize
71KB

MD5
641e49ce0c4fa963d347fbf915aabdbe

SHA1
1351f6c4ac5dcda7e3ffbf3d5e355b4bb864eb10

SHA256
1c795df278c7f64be8e6973f8dbf1a625997cb39ae2dcb5bee0ca4c1b90c8906

SHA512
766b9adb5143e89d663177c2fb0e951afb84c0a43ec690ae2c477ee0bbe036df6f4161a6012430d42e4913fd5fbe7e49af6d13ac7c62d042a484861fc5a04616

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ctypes.pyd

Filesize
58KB

MD5
1a58dc0b5a50bddb05d0460150609fd1

SHA1
75044b6ada8f3480e6af1e47fe6521c7d0ebed16

SHA256
8186961915fdba316711fbe6154edc59f814b38df5b4e46d71312652bdb2813a

SHA512
0d915d407a80e8f703b5b85470c695cefb3d0b5f91537b367968625a4756667c0911b2ad6c168c224a3ae9facb44b20e629ee7f9f413b684dcaf98001cfd5cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_decimal.pyd

Filesize
106KB

MD5
dd2894f65c817ddb3b7126011e83d80b

SHA1
a8c0575717b5b13f35e9a734789c79ccec2b1eb9

SHA256
7034c2c953606fb58c62e859e8ff439ea2df9c6000c0ef8a365901308d046635

SHA512
9e32e87b4c627d0503a69169067e04711b8045f5060a7240e83c49dbe8932bdb0636330e2212ca381f99105db0d24687291c5105be53dd73867e14e97119f86c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_hashlib.pyd

Filesize
35KB

MD5
3757e7b512c4c723c926704e0be7c7f7

SHA1
a5627d21817363e15ce11208d3ec0f417e286553

SHA256
a78348ab8177b0f19d9ad1ce377fef42847c076faa80044a5da58f3e6439b413

SHA512
693417c74c6875f0d9e5aec9c721b01f55797b126cdd2c0412d6304fcb4c3421cc48174d0c0149999d3229161c581f96e3cff09357f3277bf4456d1013ad2b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_lzma.pyd

Filesize
85KB

MD5
5a8808031ef92fb5fc3126c13e1c6581

SHA1
a448355972d23805401b68ac0acbcc72029e5419

SHA256
34cca698a21b6220368234788b4451c757ba58729dd13e9db55b6711027589f4

SHA512
f15b3e33f495ed3462ac5fe114b9640067928aad9ef70b51f08666f05f0a2444141d289bd46028f4eb4d3b6101e87c3c720886ca8c463a91e53c94d4329e8a1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_multiprocessing.pyd

Filesize
26KB

MD5
2d7a90548342971007c71df865035277

SHA1
ebd940079f4b3971b02c9d688ccb4fa555badde5

SHA256
c9b3ac4e1f1814b7d979592f94d66007c487c69ba80f5a218319439115f0e8ae

SHA512
112fcd6b90c78a2b741a5b32dad1ce28432bbb9cbc170bbd4c1d56cf4ab024f5ada00af809c887b1fbeb3ed3054635638c75c6b279e8ce1ba810d72e31ca27c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_overlapped.pyd

Filesize
31KB

MD5
4ab2d8f0651fae7ae9b7c97dc4dc6101

SHA1
6eb60d76e1f49887c5748b8f46b370c9132caa5f

SHA256
e3746290cbb81127cbb14cf91da96f6270733d2dc9458218b4f9cb5bd36199af

SHA512
808b304163d43865fb317a2543ca406a7b57d1fddbab54d1349ee82a7b5360ac5b72bc34c7e2cdf0f4584afeb22389624568b34f7b523cfb836f2e040abc617f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_queue.pyd

Filesize
30KB

MD5
d8c1b81bbc125b6ad1f48a172181336e

SHA1
3ff1d8dcec04ce16e97e12263b9233fbf982340c

SHA256
925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14

SHA512
ccc9f0d3aca66729832f26be12f8e7021834bbee1f4a45da9451b1aa5c2e63126c0031d223af57cf71fad2c85860782a56d78d8339b35720194df139076e0772

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_socket.pyd

Filesize
42KB

MD5
a399c9c68d60ff43517969a0373484bb

SHA1
cc66e36258ccdcc6342f0900c2059e0d84191629

SHA256
828a04c15d4700b3d6fdb3e03a826c08a097600750e53e8417707b4530bd5834

SHA512
1ec0cb9ee3921d8bc17bc00c68a42a929c116263bafb1da19fec1b48cc0b7eb3ba271bce327fcbf43aa6c6bd3d75b82cde637d6265a5642a5a79eca4aa51d6ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_sqlite3.pyd

Filesize
50KB

MD5
7f32dc5378d3ecb01a9b5573ce85860a

SHA1
ac5a2a0f375e0c5d5b57d53b851eef11c54e5cc8

SHA256
51321be399f0a761f8e59825f61717a93998a9c8797edbcce553a20479832bd5

SHA512
e4e857419c91f19bee36088f069089eefb527162713c43cb6e536445975f40fa9b7617d09a359c2daf7990628950fcac21074f161fc049d9434440dd7ed00862

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ssl.pyd

Filesize
62KB

MD5
3ba00e92bb341d31a62159845b6a66bb

SHA1
57eaa1fb60d9c02b7f96b49305199c04e336a411

SHA256
93c2915275df8fd65aa3d69ac96c80266fdab107d50714b685d7f2d4cf122c66

SHA512
2c22116b7e21b6fafb038d56aeaf4e58b0606ff341cb2f31d7b3544bb9a4c2f3feda44a2fe3b9398812d5648df89101ae7ae7626e0271c54ad057fd1bd0b70b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_uuid.pyd

Filesize
24KB

MD5
b68c98113c8e7e83af56ba98ff3ac84a

SHA1
448938564559570b269e05e745d9c52ecda37154

SHA256
990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2

SHA512
33c69199cba8e58e235b96684346e748a17cc7f03fc068cfa8a7ec7b5f9f6fa90d90b5cdb43285abf8b4108e71098d4e87fb0d06b28e2132357964b3eea3a4f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\base_library.zip

Filesize
859KB

MD5
483d9675ef53a13327e7dfc7d09f23fe

SHA1
2378f1db6292cd8dc4ad95763a42ad49aeb11337

SHA256
70c28ec0770edefcef46fa27aaa08ba8dc22a31acd6f84cb0b99257dca1b629e

SHA512
f905eb1817d7d4cc1f65e3a5a01bade761bca15c4a24af7097bc8f3f2b43b00e000d6ea23cd054c391d3fdc2f1114f2af43c8bb6d97c1a0ce747763260a864f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\libcrypto-1_1.dll

Filesize
1.1MB

MD5
bc7992a363713cdbdaabcef122b3024e

SHA1
ebb3447ec249fb6cb099c2c307465aedaa7b4119

SHA256
438caa81611797f8185be0657d36270bdd1c0b83414042421c48d4bbc58173ae

SHA512
78887b40cfad5d0f9136cc6e8dcd1e9e105b7b8405f7f06e7abf84e8d1a85a0aa327ec96e505ab14c9f98c4304b6286e461bc182fcf390dba36387091b4ff357

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\libffi-7.dll

Filesize
23KB

MD5
d50ebf567149ead9d88933561cb87d09

SHA1
171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

SHA256
6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

SHA512
7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\libssl-1_1.dll

Filesize
204KB

MD5
4ea5db623558b462d54d95b91265ae88

SHA1
d3a60c24e6ebabee2e43611a8d97672ef5a0fcaf

SHA256
6abff5f7de8d524dafb0b7ba0543f5774c1efcbcbe7d61f7cce5941c1d1274c1

SHA512
a90f0909bb1e2528fad0fc5e48f0cabbbe3eed62a3673be7a10751e6c396fce043a8a105d967c78858659a4ea169e8811d58a0ba01ced5dbd9d78a844f247e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\pyexpat.pyd

Filesize
87KB

MD5
452a36a103dd499a19cb6fe52e037d9f

SHA1
2575ef57581eb1b34481e35df31f86900b8d3634

SHA256
c4986479a7e3a026ccb66246fea6caee59365d680a9d04231600294f870d7ace

SHA512
8e2c76eb1030c85bb6d234ce3507f3cf230c6e8a2d9ab661370b48e2d28f56616e642ab0e02d5280141157a27213efe970b189183974901b47fda38dc530cc0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\python3.DLL

Filesize
64KB

MD5
fd4a39e7c1f7f07cf635145a2af0dc3a

SHA1
05292ba14acc978bb195818499a294028ab644bd

SHA256
dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9

SHA512
37d3218bc767c44e8197555d3fa18d5aad43a536cfe24ac17bf8a3084fb70bd4763ccfd16d2df405538b657f720871e0cd312dfeb7f592f3aac34d9d00d5a643

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\python310.dll

Filesize
1.4MB

MD5
b9e7c60cf489b8911885c9431d59dc7d

SHA1
1d1515084c607b166bbba717bae1f92407bce98c

SHA256
f41e60314305e70412ebae0f5ca944c4dec3c52101583948456f310ac8d0e5cf

SHA512
0783e57fbd4e3c75014cb747bc04c749c6ffce571eea5e75cbea35a65a4922caf4e904cf71745b80ef97dddb398791207457945c8f0c0a4aa27c3e7ba967a81f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\select.pyd

Filesize
25KB

MD5
2de5ffb36a347c49789c35b322ba94f3

SHA1
3a5662ec40abd74d91ed46738ad7b7938f9958a0

SHA256
95629553202ffdb15cd8b5263a085a743d05dd93e154b338204f8ac5becfc49b

SHA512
4bc65f00176ffb0c64a2e7bdff111a91e242fcdc78b2a842f97f88bd3c3f4b408844c1f4a11a154a331933a3379d40ff4a690257bdb80a426021140f05f817d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\sqlite3.dll

Filesize
622KB

MD5
a1d20ae7e9808bc2aaa13c4e25022913

SHA1
7acaf99752e58831494c9bfcbb26668bf24e4250

SHA256
354ca08eaa7ceb6ab4e1739644707ccaab85992aed791205eff3c2034f197971

SHA512
2517e2a29edd0bf32985bf402288a57837f68b369227aed1805012de468946e5b5b2fc6336e97db8500a6c7d30ef825a515858f260b8509e3ea61d5c5a149990

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\unicodedata.pyd

Filesize
289KB

MD5
d569c3635f5d76d21ce0b5319cdd627b

SHA1
9e3f6fb6edb2f7b68054df3226f6bfd0d7a2c9bb

SHA256
341f18eaec783392bd3468fe26e874d53b5e00fbb9b551e69c9a5334ea8bb2c4

SHA512
c5cc50fcb36fb3fa6f51ffa956d395b884ffd9e0cfee11b4da902b7bbf2da3e13059d2c7b5074daf7aba4a41bd1578bfff540dcc5ca39f063f7ede9674aad49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4frasb21.xu4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 586958.crdownload

Filesize
9.4MB

MD5
6051f4511059448a1447460a1f2cc76f

SHA1
f5dd5151c773d4040ca09c2dc088fccb806a608c

SHA256
d1eb822518f773d1125b035c31528a6d0d33bf3628ed3a29875a18fbd7ccd7d3

SHA512
a709f397906c57a69064d596e77fe30d3c74243d9cdfb8dffc77324cfdeb7b1206a7c9cdc8f37cc2282e639f0ad77e4248babdf53083ab86b8bcfb2adf47a401

Download Submit
memory/1360-662-0x00007FFF54660000-0x00007FFF54677000-memory.dmp

Filesize
92KB

Download
memory/1360-367-0x00007FFF47340000-0x00007FFF4735F000-memory.dmp

Filesize
124KB

Download
memory/1360-369-0x00007FFF3BD40000-0x00007FFF3BEBA000-memory.dmp

Filesize
1.5MB

Download
memory/1360-366-0x00007FFF48680000-0x00007FFF486AC000-memory.dmp

Filesize
176KB

Download
memory/1360-363-0x00007FFF49940000-0x00007FFF49958000-memory.dmp

Filesize
96KB

Download
memory/1360-360-0x00007FFF4AC40000-0x00007FFF4AC59000-memory.dmp

Filesize
100KB

Download
memory/1360-444-0x00007FFF47310000-0x00007FFF4733E000-memory.dmp

Filesize
184KB

Download
memory/1360-361-0x00007FFF4BB20000-0x00007FFF4BB2D000-memory.dmp

Filesize
52KB

Download
memory/1360-448-0x00007FFF3BC80000-0x00007FFF3BD38000-memory.dmp

Filesize
736KB

Download
memory/1360-461-0x000002058F380000-0x000002058F6F9000-memory.dmp

Filesize
3.5MB

Download
memory/1360-460-0x00007FFF38550000-0x00007FFF388C9000-memory.dmp

Filesize
3.5MB

Download
memory/1360-497-0x00007FFF4BA70000-0x00007FFF4BA80000-memory.dmp

Filesize
64KB

Download
memory/1360-496-0x00007FFF472F0000-0x00007FFF47304000-memory.dmp

Filesize
80KB

Download
memory/1360-498-0x00007FFF388D0000-0x00007FFF38D36000-memory.dmp

Filesize
4.4MB

Download
memory/1360-501-0x00007FFF3BB60000-0x00007FFF3BC78000-memory.dmp

Filesize
1.1MB

Download
memory/1360-500-0x00007FFF4B8E0000-0x00007FFF4B8F5000-memory.dmp

Filesize
84KB

Download
memory/1360-499-0x00007FFF4B900000-0x00007FFF4B914000-memory.dmp

Filesize
80KB

Download
memory/1360-502-0x00007FFF4AC40000-0x00007FFF4AC59000-memory.dmp

Filesize
100KB

Download
memory/1360-503-0x00007FFF50050000-0x00007FFF50072000-memory.dmp

Filesize
136KB

Download
memory/1360-506-0x00007FFF54660000-0x00007FFF54677000-memory.dmp

Filesize
92KB

Download
memory/1360-508-0x00007FFF545F0000-0x00007FFF54609000-memory.dmp

Filesize
100KB

Download
memory/1360-507-0x00007FFF47340000-0x00007FFF4735F000-memory.dmp

Filesize
124KB

Download
memory/1360-509-0x00007FFF3BD40000-0x00007FFF3BEBA000-memory.dmp

Filesize
1.5MB

Download
memory/1360-512-0x00007FFF47310000-0x00007FFF4733E000-memory.dmp

Filesize
184KB

Download
memory/1360-511-0x00007FFF50F40000-0x00007FFF50F51000-memory.dmp

Filesize
68KB

Download
memory/1360-510-0x00007FFF50000000-0x00007FFF50049000-memory.dmp

Filesize
292KB

Download
memory/1360-514-0x00007FFF4FF90000-0x00007FFF4FFAE000-memory.dmp

Filesize
120KB

Download
memory/1360-513-0x00007FFF3BC80000-0x00007FFF3BD38000-memory.dmp

Filesize
736KB

Download
memory/1360-516-0x000002058F380000-0x000002058F6F9000-memory.dmp

Filesize
3.5MB

Download
memory/1360-515-0x00007FFF38550000-0x00007FFF388C9000-memory.dmp

Filesize
3.5MB

Download
memory/1360-517-0x00007FFF3B460000-0x00007FFF3BB55000-memory.dmp

Filesize
7.0MB

Download
memory/1360-518-0x00007FFF472F0000-0x00007FFF47304000-memory.dmp

Filesize
80KB

Download
memory/1360-519-0x00007FFF4B830000-0x00007FFF4B868000-memory.dmp

Filesize
224KB

Download
memory/1360-356-0x00007FFF4AC60000-0x00007FFF4AC84000-memory.dmp

Filesize
144KB

Download
memory/1360-357-0x00007FFF4FE50000-0x00007FFF4FE5F000-memory.dmp

Filesize
60KB

Download
memory/1360-580-0x00007FFF3BB60000-0x00007FFF3BC78000-memory.dmp

Filesize
1.1MB

Download
memory/1360-590-0x00007FFF50050000-0x00007FFF50072000-memory.dmp

Filesize
136KB

Download
memory/1360-661-0x00007FFF4B830000-0x00007FFF4B868000-memory.dmp

Filesize
224KB

Download
memory/1360-803-0x00007FFF4AC60000-0x00007FFF4AC84000-memory.dmp

Filesize
144KB

Download
memory/1360-328-0x00007FFF388D0000-0x00007FFF38D36000-memory.dmp

Filesize
4.4MB

Download
memory/1360-660-0x00007FFF3B460000-0x00007FFF3BB55000-memory.dmp

Filesize
7.0MB

Download
memory/1360-657-0x00007FFF50000000-0x00007FFF50049000-memory.dmp

Filesize
292KB

Download
memory/1360-656-0x00007FFF545F0000-0x00007FFF54609000-memory.dmp

Filesize
100KB

Download
memory/1360-654-0x00007FFF50050000-0x00007FFF50072000-memory.dmp

Filesize
136KB

Download
memory/1360-650-0x00007FFF4BA70000-0x00007FFF4BA80000-memory.dmp

Filesize
64KB

Download
memory/1360-649-0x00007FFF472F0000-0x00007FFF47304000-memory.dmp

Filesize
80KB

Download
memory/1360-648-0x00007FFF38550000-0x00007FFF388C9000-memory.dmp

Filesize
3.5MB

Download
memory/1360-647-0x00007FFF3BC80000-0x00007FFF3BD38000-memory.dmp

Filesize
736KB

Download
memory/1360-646-0x00007FFF47310000-0x00007FFF4733E000-memory.dmp

Filesize
184KB

Download
memory/1360-645-0x00007FFF3BD40000-0x00007FFF3BEBA000-memory.dmp

Filesize
1.5MB

Download
memory/1360-644-0x00007FFF47340000-0x00007FFF4735F000-memory.dmp

Filesize
124KB

Download
memory/1360-638-0x00007FFF4AC60000-0x00007FFF4AC84000-memory.dmp

Filesize
144KB

Download
memory/1360-637-0x00007FFF388D0000-0x00007FFF38D36000-memory.dmp

Filesize
4.4MB

Download
memory/1360-804-0x00007FFF4FE50000-0x00007FFF4FE5F000-memory.dmp

Filesize
60KB

Download
memory/1360-805-0x00007FFF4AC40000-0x00007FFF4AC59000-memory.dmp

Filesize
100KB

Download
memory/1360-806-0x00007FFF4BB20000-0x00007FFF4BB2D000-memory.dmp

Filesize
52KB

Download
memory/1360-807-0x00007FFF49940000-0x00007FFF49958000-memory.dmp

Filesize
96KB

Download
memory/1360-802-0x00007FFF3BB60000-0x00007FFF3BC78000-memory.dmp

Filesize
1.1MB

Download
memory/2336-570-0x0000027401DB0000-0x0000027401DD2000-memory.dmp

Filesize
136KB

Download
memory/3868-671-0x00007FFF4B380000-0x00007FFF4B39F000-memory.dmp

Filesize
124KB

Download
memory/3868-722-0x00007FFF37E50000-0x00007FFF38545000-memory.dmp

Filesize
7.0MB

Download
memory/3868-668-0x00007FFF4B780000-0x00007FFF4B798000-memory.dmp

Filesize
96KB

Download
memory/3868-672-0x00007FFF3A600000-0x00007FFF3A62E000-memory.dmp

Filesize
184KB

Download
memory/3868-674-0x00007FFF3A1C0000-0x00007FFF3A539000-memory.dmp

Filesize
3.5MB

Download
memory/3868-675-0x000001B5724A0000-0x000001B572819000-memory.dmp

Filesize
3.5MB

Download
memory/3868-673-0x00007FFF3A540000-0x00007FFF3A5F8000-memory.dmp

Filesize
736KB

Download
memory/3868-676-0x00007FFF4AD50000-0x00007FFF4AD64000-memory.dmp

Filesize
80KB

Download
memory/3868-677-0x00007FFF3A630000-0x00007FFF3AA96000-memory.dmp

Filesize
4.4MB

Download
memory/3868-681-0x00007FFF41F20000-0x00007FFF41F35000-memory.dmp

Filesize
84KB

Download
memory/3868-680-0x00007FFF4B3F0000-0x00007FFF4B414000-memory.dmp

Filesize
144KB

Download
memory/3868-679-0x00007FFF45580000-0x00007FFF45594000-memory.dmp

Filesize
80KB

Download
memory/3868-678-0x00007FFF4B640000-0x00007FFF4B650000-memory.dmp

Filesize
64KB

Download
memory/3868-683-0x00007FFF3A0A0000-0x00007FFF3A1B8000-memory.dmp

Filesize
1.1MB

Download
memory/3868-682-0x00007FFF4B810000-0x00007FFF4B829000-memory.dmp

Filesize
100KB

Download
memory/3868-684-0x00007FFF3A070000-0x00007FFF3A092000-memory.dmp

Filesize
136KB

Download
memory/3868-685-0x00007FFF3BFB0000-0x00007FFF3C12A000-memory.dmp

Filesize
1.5MB

Download
memory/3868-688-0x00007FFF3A030000-0x00007FFF3A049000-memory.dmp

Filesize
100KB

Download
memory/3868-687-0x00007FFF4B380000-0x00007FFF4B39F000-memory.dmp

Filesize
124KB

Download
memory/3868-686-0x00007FFF3A050000-0x00007FFF3A067000-memory.dmp

Filesize
92KB

Download
memory/3868-689-0x00007FFF3A600000-0x00007FFF3A62E000-memory.dmp

Filesize
184KB

Download
memory/3868-696-0x00007FFF4AD50000-0x00007FFF4AD64000-memory.dmp

Filesize
80KB

Download
memory/3868-695-0x00007FFF39FA0000-0x00007FFF39FBE000-memory.dmp

Filesize
120KB

Download
memory/3868-694-0x000001B5724A0000-0x000001B572819000-memory.dmp

Filesize
3.5MB

Download
memory/3868-693-0x00007FFF3A1C0000-0x00007FFF3A539000-memory.dmp

Filesize
3.5MB

Download
memory/3868-692-0x00007FFF3A540000-0x00007FFF3A5F8000-memory.dmp

Filesize
736KB

Download
memory/3868-691-0x00007FFF39FC0000-0x00007FFF39FD1000-memory.dmp

Filesize
68KB

Download
memory/3868-690-0x00007FFF39FE0000-0x00007FFF3A029000-memory.dmp

Filesize
292KB

Download
memory/3868-697-0x00007FFF37E50000-0x00007FFF38545000-memory.dmp

Filesize
7.0MB

Download
memory/3868-698-0x00007FFF39F60000-0x00007FFF39F98000-memory.dmp

Filesize
224KB

Download
memory/3868-734-0x00007FFF3A540000-0x00007FFF3A5F8000-memory.dmp

Filesize
736KB

Download
memory/3868-670-0x00007FFF3BFB0000-0x00007FFF3C12A000-memory.dmp

Filesize
1.5MB

Download
memory/3868-738-0x00007FFF4B640000-0x00007FFF4B650000-memory.dmp

Filesize
64KB

Download
memory/3868-737-0x00007FFF4AD50000-0x00007FFF4AD64000-memory.dmp

Filesize
80KB

Download
memory/3868-736-0x00007FFF39FA0000-0x00007FFF39FBE000-memory.dmp

Filesize
120KB

Download
memory/3868-735-0x00007FFF3A1C0000-0x00007FFF3A539000-memory.dmp

Filesize
3.5MB

Download
memory/3868-733-0x00007FFF3A600000-0x00007FFF3A62E000-memory.dmp

Filesize
184KB

Download
memory/3868-732-0x00007FFF3A030000-0x00007FFF3A049000-memory.dmp

Filesize
100KB

Download
memory/3868-731-0x00007FFF472C0000-0x00007FFF472EC000-memory.dmp

Filesize
176KB

Download
memory/3868-730-0x00007FFF4B780000-0x00007FFF4B798000-memory.dmp

Filesize
96KB

Download
memory/3868-729-0x00007FFF4FE60000-0x00007FFF4FE6D000-memory.dmp

Filesize
52KB

Download
memory/3868-728-0x00007FFF4B810000-0x00007FFF4B829000-memory.dmp

Filesize
100KB

Download
memory/3868-727-0x00007FFF4FF80000-0x00007FFF4FF8F000-memory.dmp

Filesize
60KB

Download
memory/3868-726-0x00007FFF41F20000-0x00007FFF41F35000-memory.dmp

Filesize
84KB

Download
memory/3868-725-0x00007FFF45580000-0x00007FFF45594000-memory.dmp

Filesize
80KB

Download
memory/3868-724-0x00007FFF4B380000-0x00007FFF4B39F000-memory.dmp

Filesize
124KB

Download
memory/3868-723-0x00007FFF39F60000-0x00007FFF39F98000-memory.dmp

Filesize
224KB

Download
memory/3868-720-0x00007FFF39FC0000-0x00007FFF39FD1000-memory.dmp

Filesize
68KB

Download
memory/3868-719-0x00007FFF39FE0000-0x00007FFF3A029000-memory.dmp

Filesize
292KB

Download
memory/3868-717-0x00007FFF3A050000-0x00007FFF3A067000-memory.dmp

Filesize
92KB

Download
memory/3868-716-0x00007FFF3A070000-0x00007FFF3A092000-memory.dmp

Filesize
136KB

Download
memory/3868-715-0x00007FFF3A0A0000-0x00007FFF3A1B8000-memory.dmp

Filesize
1.1MB

Download
memory/3868-707-0x00007FFF3BFB0000-0x00007FFF3C12A000-memory.dmp

Filesize
1.5MB

Download
memory/3868-700-0x00007FFF4B3F0000-0x00007FFF4B414000-memory.dmp

Filesize
144KB

Download
memory/3868-699-0x00007FFF3A630000-0x00007FFF3AA96000-memory.dmp

Filesize
4.4MB

Download
memory/3868-669-0x00007FFF472C0000-0x00007FFF472EC000-memory.dmp

Filesize
176KB

Download
memory/3868-667-0x00007FFF4FE60000-0x00007FFF4FE6D000-memory.dmp

Filesize
52KB

Download
memory/3868-666-0x00007FFF4B810000-0x00007FFF4B829000-memory.dmp

Filesize
100KB

Download
memory/3868-665-0x00007FFF4FF80000-0x00007FFF4FF8F000-memory.dmp

Filesize
60KB

Download
memory/3868-664-0x00007FFF4B3F0000-0x00007FFF4B414000-memory.dmp

Filesize
144KB

Download
memory/3868-663-0x00007FFF3A630000-0x00007FFF3AA96000-memory.dmp

Filesize
4.4MB

Download