exelastealer | 7e4f9d5d089ba72289b344a54b607150241b2c03090308a48d980c8b5229a199

Analysis

max time kernel
197s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2024 20:30

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

a29i84.html
Size

510B
MD5

110e476131a083b52350468299310366
SHA1

33b3f0e4983f6b84627acd5c91f73f6ff5e3d9fa
SHA256

7e4f9d5d089ba72289b344a54b607150241b2c03090308a48d980c8b5229a199
SHA512

53bbc261ebd32296510f440ed94bc1ec78b07ba65824c775276c67c840af78d7342996da2a2dbd8f2378e18edd30aef8fad80568a96c7687df999d07e671a590

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation pyinstaller spyware stealer themida trojan upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RippleSpoofer.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3508	netsh.exe
3864	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RippleSpoofer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	RippleSpoofer.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3668	cmd.exe
2304	powershell.exe

Deletes itself 1 IoCs

pid	Process
5000	mac.exe

Executes dropped EXE 7 IoCs

pid	Process
4136	RippleSpoofer.exe
4612	mac.exe
5000	mac.exe
1756	randomizer.EXE
3912	randomizer.EXE
3684	volumeid.EXE
4164	volumeid64.EXE

Loads dropped DLL 34 IoCs

pid	Process
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
5000	mac.exe
3912	randomizer.EXE
3912	randomizer.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0007000000023d12-138.dat	themida
behavioral1/memory/4136-296-0x0000000000220000-0x0000000001EA0000-memory.dmp	themida
behavioral1/memory/4136-297-0x0000000000220000-0x0000000001EA0000-memory.dmp	themida
behavioral1/memory/4136-952-0x0000000000220000-0x0000000001EA0000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RippleSpoofer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
96	discord.com
97	discord.com
99	discord.com
109	discord.com
114	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
89	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4396	cmd.exe
3388	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3864	tasklist.exe
2460	tasklist.exe
1640	tasklist.exe
2728	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3780	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4136	RippleSpoofer.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023d79-415.dat	upx
behavioral1/memory/5000-419-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp	upx
behavioral1/files/0x0007000000023d24-425.dat	upx
behavioral1/files/0x0007000000023d73-428.dat	upx
behavioral1/memory/5000-458-0x00007FFFAE7D0000-0x00007FFFAE7E9000-memory.dmp	upx
behavioral1/memory/5000-461-0x00007FFFAE2D0000-0x00007FFFAE2FD000-memory.dmp	upx
behavioral1/memory/5000-460-0x00007FFFAE300000-0x00007FFFAE319000-memory.dmp	upx
behavioral1/memory/5000-462-0x00007FFFADC90000-0x00007FFFADCB3000-memory.dmp	upx
behavioral1/memory/5000-463-0x00007FFF9EC00000-0x00007FFF9ED73000-memory.dmp	upx
behavioral1/memory/5000-464-0x00007FFFACA90000-0x00007FFFACABE000-memory.dmp	upx
behavioral1/memory/5000-465-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp	upx
behavioral1/memory/5000-468-0x00007FFFAE800000-0x00007FFFAE824000-memory.dmp	upx
behavioral1/memory/5000-467-0x00007FFFABAF0000-0x00007FFFABBA8000-memory.dmp	upx
behavioral1/memory/5000-466-0x00007FFF9C830000-0x00007FFF9CBA5000-memory.dmp	upx
behavioral1/memory/5000-472-0x00007FFFACA30000-0x00007FFFACA44000-memory.dmp	upx
behavioral1/memory/5000-471-0x00007FFFACA50000-0x00007FFFACA62000-memory.dmp	upx
behavioral1/memory/5000-478-0x00007FFFABE10000-0x00007FFFABE27000-memory.dmp	upx
behavioral1/memory/5000-481-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp	upx
behavioral1/memory/5000-482-0x00007FFFABDF0000-0x00007FFFABE07000-memory.dmp	upx
behavioral1/memory/5000-480-0x00007FFFACA90000-0x00007FFFACABE000-memory.dmp	upx
behavioral1/memory/5000-489-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp	upx
behavioral1/memory/5000-490-0x00007FFFA7570000-0x00007FFFA758E000-memory.dmp	upx
behavioral1/memory/5000-488-0x00007FFFAE7B0000-0x00007FFFAE7BA000-memory.dmp	upx
behavioral1/memory/5000-487-0x00007FFFABA50000-0x00007FFFABA9D000-memory.dmp	upx
behavioral1/memory/5000-491-0x00007FFF8CE20000-0x00007FFF8D5C1000-memory.dmp	upx
behavioral1/memory/5000-486-0x00007FFFABAF0000-0x00007FFFABBA8000-memory.dmp	upx
behavioral1/memory/5000-485-0x00007FFFA7590000-0x00007FFFA75A1000-memory.dmp	upx
behavioral1/memory/5000-484-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp	upx
behavioral1/memory/5000-483-0x00007FFF9C830000-0x00007FFF9CBA5000-memory.dmp	upx
behavioral1/memory/5000-479-0x00007FFF9EC00000-0x00007FFF9ED73000-memory.dmp	upx
behavioral1/memory/5000-477-0x00007FFFADC90000-0x00007FFFADCB3000-memory.dmp	upx
behavioral1/memory/5000-476-0x00007FFF9E2C0000-0x00007FFF9E3DC000-memory.dmp	upx
behavioral1/memory/5000-475-0x00007FFFAE2D0000-0x00007FFFAE2FD000-memory.dmp	upx
behavioral1/memory/5000-492-0x00007FFFA7530000-0x00007FFFA7566000-memory.dmp	upx
behavioral1/memory/5000-474-0x00007FFFACA10000-0x00007FFFACA24000-memory.dmp	upx
behavioral1/memory/5000-473-0x00007FFFAE300000-0x00007FFFAE319000-memory.dmp	upx
behavioral1/memory/5000-470-0x00007FFFAE7D0000-0x00007FFFAE7E9000-memory.dmp	upx
behavioral1/memory/5000-469-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp	upx
behavioral1/memory/5000-459-0x00007FFFAE7C0000-0x00007FFFAE7CD000-memory.dmp	upx
behavioral1/memory/5000-429-0x00007FFFAE7F0000-0x00007FFFAE7FF000-memory.dmp	upx
behavioral1/memory/5000-426-0x00007FFFAE800000-0x00007FFFAE824000-memory.dmp	upx
behavioral1/memory/5000-536-0x00007FFFABA40000-0x00007FFFABA4D000-memory.dmp	upx
behavioral1/memory/5000-535-0x00007FFFABE10000-0x00007FFFABE27000-memory.dmp	upx
behavioral1/memory/5000-554-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp	upx
behavioral1/memory/5000-555-0x00007FFFABDF0000-0x00007FFFABE07000-memory.dmp	upx
behavioral1/memory/5000-556-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp	upx
behavioral1/memory/5000-557-0x00007FFFABA50000-0x00007FFFABA9D000-memory.dmp	upx
behavioral1/memory/5000-566-0x00007FFFA7570000-0x00007FFFA758E000-memory.dmp	upx
behavioral1/memory/5000-568-0x00007FFF8CE20000-0x00007FFF8D5C1000-memory.dmp	upx
behavioral1/memory/5000-597-0x00007FFFA7530000-0x00007FFFA7566000-memory.dmp	upx
behavioral1/memory/5000-589-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp	upx
behavioral1/memory/5000-587-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp	upx
behavioral1/memory/5000-586-0x00007FFFABE10000-0x00007FFFABE27000-memory.dmp	upx
behavioral1/memory/5000-579-0x00007FFF9C830000-0x00007FFF9CBA5000-memory.dmp	upx
behavioral1/memory/5000-582-0x00007FFFACA50000-0x00007FFFACA62000-memory.dmp	upx
behavioral1/memory/5000-581-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp	upx
behavioral1/memory/5000-580-0x00007FFFABAF0000-0x00007FFFABBA8000-memory.dmp	upx
behavioral1/memory/5000-569-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp	upx
behavioral1/memory/5000-578-0x00007FFFACA90000-0x00007FFFACABE000-memory.dmp	upx
behavioral1/memory/5000-577-0x00007FFF9EC00000-0x00007FFF9ED73000-memory.dmp	upx
behavioral1/memory/5000-570-0x00007FFFAE800000-0x00007FFFAE824000-memory.dmp	upx
behavioral1/memory/5000-620-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp	upx
behavioral1/memory/5000-618-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp	upx
behavioral1/memory/5000-612-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
848	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000023d1e-325.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	volumeid.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2604	netsh.exe
3292	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2164	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
4428	WMIC.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	RippleSpoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	RippleSpoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1496	ipconfig.exe
2164	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1488	systeminfo.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2608	taskkill.exe
3192	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "226"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{F1E0CB00-81F0-423C-98E5-A3CF56D5B776}	RippleSpoofer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 932543.crdownload:SmartScreen	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
4524	msedge.exe
4524	msedge.exe
2164	identity_helper.exe
2164	identity_helper.exe
1480	msedge.exe
1480	msedge.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
2304	powershell.exe
2304	powershell.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe
4136	RippleSpoofer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	RippleSpoofer.exe
Token: 33	3124	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3124	AUDIODG.EXE
Token: SeDebugPrivilege	2608	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3052	WMIC.exe
Token: SeSecurityPrivilege	3052	WMIC.exe
Token: SeTakeOwnershipPrivilege	3052	WMIC.exe
Token: SeLoadDriverPrivilege	3052	WMIC.exe
Token: SeSystemProfilePrivilege	3052	WMIC.exe
Token: SeSystemtimePrivilege	3052	WMIC.exe
Token: SeProfSingleProcessPrivilege	3052	WMIC.exe
Token: SeIncBasePriorityPrivilege	3052	WMIC.exe
Token: SeCreatePagefilePrivilege	3052	WMIC.exe
Token: SeBackupPrivilege	3052	WMIC.exe
Token: SeRestorePrivilege	3052	WMIC.exe
Token: SeShutdownPrivilege	3052	WMIC.exe
Token: SeDebugPrivilege	3052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3052	WMIC.exe
Token: SeRemoteShutdownPrivilege	3052	WMIC.exe
Token: SeUndockPrivilege	3052	WMIC.exe
Token: SeManageVolumePrivilege	3052	WMIC.exe
Token: 33	3052	WMIC.exe
Token: 34	3052	WMIC.exe
Token: 35	3052	WMIC.exe
Token: 36	3052	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3052	WMIC.exe
Token: SeSecurityPrivilege	3052	WMIC.exe
Token: SeTakeOwnershipPrivilege	3052	WMIC.exe
Token: SeLoadDriverPrivilege	3052	WMIC.exe
Token: SeSystemProfilePrivilege	3052	WMIC.exe
Token: SeSystemtimePrivilege	3052	WMIC.exe
Token: SeProfSingleProcessPrivilege	3052	WMIC.exe
Token: SeIncBasePriorityPrivilege	3052	WMIC.exe
Token: SeCreatePagefilePrivilege	3052	WMIC.exe
Token: SeBackupPrivilege	3052	WMIC.exe
Token: SeRestorePrivilege	3052	WMIC.exe
Token: SeShutdownPrivilege	3052	WMIC.exe
Token: SeDebugPrivilege	3052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3052	WMIC.exe
Token: SeRemoteShutdownPrivilege	3052	WMIC.exe
Token: SeUndockPrivilege	3052	WMIC.exe
Token: SeManageVolumePrivilege	3052	WMIC.exe
Token: 33	3052	WMIC.exe
Token: 34	3052	WMIC.exe
Token: 35	3052	WMIC.exe
Token: 36	3052	WMIC.exe
Token: SeDebugPrivilege	3864	tasklist.exe
Token: SeDebugPrivilege	2460	tasklist.exe
Token: SeDebugPrivilege	3192	taskkill.exe
Token: SeDebugPrivilege	1640	tasklist.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeIncreaseQuotaPrivilege	4428	WMIC.exe
Token: SeSecurityPrivilege	4428	WMIC.exe
Token: SeTakeOwnershipPrivilege	4428	WMIC.exe
Token: SeLoadDriverPrivilege	4428	WMIC.exe
Token: SeSystemProfilePrivilege	4428	WMIC.exe
Token: SeSystemtimePrivilege	4428	WMIC.exe
Token: SeProfSingleProcessPrivilege	4428	WMIC.exe
Token: SeIncBasePriorityPrivilege	4428	WMIC.exe
Token: SeCreatePagefilePrivilege	4428	WMIC.exe
Token: SeBackupPrivilege	4428	WMIC.exe
Token: SeRestorePrivilege	4428	WMIC.exe
Token: SeShutdownPrivilege	4428	WMIC.exe
Token: SeDebugPrivilege	4428	WMIC.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2864	4524	msedge.exe	83
PID 4524 wrote to memory of 2864	4524	msedge.exe	83
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 2212	4524	msedge.exe	84
PID 4524 wrote to memory of 3660	4524	msedge.exe	85
PID 4524 wrote to memory of 3660	4524	msedge.exe	85
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86
PID 4524 wrote to memory of 1124	4524	msedge.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
928	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a29i84.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa62146f8,0x7fffa6214708,0x7fffa6214718
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,11680992130689295290,10425536766421477894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Users\Admin\Downloads\RippleSpoofer.exe
  "C:\Users\Admin\Downloads\RippleSpoofer.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- - C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe
    "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"
    3⤵
    - Executes dropped EXE
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe
      "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      PID:5000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:1848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:1852
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:2920
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:3780
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        6⤵
        Views/modifies file attributes
        
        PID:928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        5⤵
        
        PID:1560
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2864"
        5⤵
        
        PID:4576
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2864
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:3996
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:744
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:2508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
        5⤵
        
        PID:4240
      - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        6⤵
        
        PID:3612
        
        C:\Windows\system32\chcp.com
        
        chcp
        7⤵
        
        PID:1928
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:3920
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
        5⤵
        Clipboard Data
        
        PID:3668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        6⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
        5⤵
        Network Service Discovery
        
        PID:4396
      - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:1488
      - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        6⤵
        
        PID:3328
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        6⤵
        Collects information from the system
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
      - C:\Windows\system32\net.exe
        
        net user
        6⤵
        
        PID:2140
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        7⤵
        
        PID:1720
      - C:\Windows\system32\query.exe
        
        query user
        6⤵
        
        PID:4272
        
        C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        7⤵
        
        PID:3656
      - C:\Windows\system32\net.exe
        
        net localgroup
        6⤵
        
        PID:1236
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        7⤵
        
        PID:3308
      - C:\Windows\system32\net.exe
        
        net localgroup administrators
        6⤵
        
        PID:2028
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        7⤵
        
        PID:1568
      - C:\Windows\system32\net.exe
        
        net user guest
        6⤵
        
        PID:3056
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        7⤵
        
        PID:4264
      - C:\Windows\system32\net.exe
        
        net user administrator
        6⤵
        
        PID:1596
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        7⤵
        
        PID:432
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        6⤵
        
        PID:2720
      - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        6⤵
        Enumerates processes with tasklist
        
        PID:2728
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        6⤵
        Gathers network information
        
        PID:1496
      - C:\Windows\system32\ROUTE.EXE
        
        route print
        6⤵
        
        PID:1040
      - C:\Windows\system32\ARP.EXE
        
        arp -a
        6⤵
        Network Service Discovery
        
        PID:3388
      - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        6⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:2164
      - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        6⤵
        Launches sc.exe
        
        PID:848
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3508
      - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        5⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3292
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2604
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:264
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:3780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:4084
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:4716
- - C:\Users\Admin\AppData\Local\Temp\TempAppFiles\randomizer.EXE
    "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\randomizer.EXE"
    3⤵
    - Executes dropped EXE
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\TempAppFiles\randomizer.EXE
      "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\randomizer.EXE"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempAppFiles\spoof.bat""
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\TempAppFiles\volumeid.EXE
    "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\volumeid.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\TempAppFiles\volumeid64.EXE
    "C:\Users\Admin\AppData\Local\Temp\TempAppFiles\volumeid64.EXE"
    3⤵
    - Executes dropped EXE
    PID:4164
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 0
    3⤵
    PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b8 0x2d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3900855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
1e7fe9bde0e1e8a9a14b35d7ea8e6fad

SHA1
a4c9186aa2342b916a4cfe93e6d45dca9b57c0e2

SHA256
875983ff44d902ee6e4cfc9a3ddd6e61c5eb904bc26372422cdaab71cfbf732e

SHA512
6df833de70e7b6f2d3167f7199430a89d490926aa8b09b0f950d18ddeba78c2b22e401d7b6a053718c3e6c1667b57db8ac8f29809d9b742345820fde6c90c342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1000B

MD5
89db1e7c4896549b6a64cab0c739b22f

SHA1
550aa8ecf8d7337dc72dfded7715e6ad2932e5e2

SHA256
b34a5548ca00487f5bb177b946055946f8e7c00abcf605c40a64f41dc3f7cbe4

SHA512
2b123386dfaccae4adfd97572b1ff2107af9e7a82ba1d8baf2201dc568e5ee928b7021275e23a864da5b2b12980f63f8edadddc0626ede2ce33948c6b29515ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4df571a42277fc1f2aa664de82c69c9

SHA1
1484f4eb1c664c170dc8b4f2f102c46330bdddc3

SHA256
1cc6fbb43590832a0a9729edcac07ad0cbed441fc33359a47671ddf95ff2787f

SHA512
9e57a6c461aa23f487b8343dbb5cd3e797338e4e219fa72f6d78991d1cab8372c18861a1e481e4d6f57199a027890ec6444b400a9fffc5c4c5f133c12374fc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d8e49e041a6c7a55509db719718a964

SHA1
42b5df9b372474e9f71b6645a7fb53a4564d12f3

SHA256
bcaad70601f50c6f2c7a3cd969856c88293c9a278c68d3796a754ccc6f181c40

SHA512
62fab1e0c9d5184cbb75b9842c86dd2c319711abc03318b824a4ad1d63c5c2473533506c5cda91067d6ba55ec8f88c1314b78e373756481ff7fa883623b30d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d464e82f0c932c3fc29e78621026968

SHA1
92e7c2e4f4d1a089328a6ef0bfcc23bd23e2c7e4

SHA256
57a30c2f246884bc97da688e75a31294dedaed89b9543baebe1de01f2ad1a364

SHA512
261aa4307697f082ca276e8dc3192148be11692251898aff598fc1e69c5c66572f5ea2c3e9c4dba92f8555c00509950114a2bfab1220a6c670a9b2e384ed2bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afe510916ba0f8900719036e40ae5f3b

SHA1
dec42be55b6e59bc84196b3f9c639e06877afd6e

SHA256
27cfb36fe2aff498576a1aaf211dd4cdf7a1b2cebdddefd450cfa008f87b6662

SHA512
b90da68957f92006f0bef45a9c1c9db4b5612ac4fbf8d64869118bc2e9c346dcff14405943d63bf1e43c99047e32cb3c971db16d8b42976542397b839a89230f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80ef0211c75a6bfe7ab1b41df0e2de2b

SHA1
a68dffe863b38bef625e592b8dcee9794a09513b

SHA256
585cc7f6e04ea1a8f8204bc93b438ddd7915a88a6adf0408b739085c5b0da3f0

SHA512
94fd9cabefe7456bc9619e9c294937b731dcc187b3886a3daac4b864b72af8dbaccc6dbdca587a866bbe5346e75955218bde6959b87d73d90e00a77e4b077872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
926dc3acf289d8430aef95d3dd198049

SHA1
3fc934100a28cc8b7dae734ac7ee4906fe73a000

SHA256
73a193684cd10be85e2518418cc2b1e6afd34faa551d09eba67d11e7d2d722b7

SHA512
668416703b4745e856c57dafa4257aba12199f2399132d0d1c549a133941956230e10c1c173048d0eb140388c823d3603b1fe02275e8d0adf7ba45866b42e228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
53abf81ca79baaeb6bbadf9aaa7f67e5

SHA1
3185e8726436d97da63800861b01eae373b32332

SHA256
b13fdb7c573b9a3143691df5853031c9c7ff96edc1280d74020916504de2a943

SHA512
2d4a438a6e5e37a9accf23aeb4565c01eeaf3e01d179441bd8949e4ad86afe443f6c5850e8aabf1779eb4bea7f555ac64d3a0eed76142f75a721852e6bce23f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\DownloadData.db

Filesize
124KB

MD5
7edc0c593e2420f8356969c6d2326125

SHA1
de89121ed3768c15d3afac3b8305cb4dbbfe1b42

SHA256
e2acfa9f1721e19fc575a74852f0b3da568fc560e8b01769339d6dd008dd16e9

SHA512
f8e096fd13aaf7993e3ab9d24a2ff8972278cb99dd47df197f9882b337cc0f2201bf696914e2b754d27c83fd61c3bfe74236c8256469abb26d37535e7d1df2de

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\EnableSuspend.xlsx

Filesize
13KB

MD5
877c465344986e06fcb01a03fa3a13ff

SHA1
66bba227ea52b68d957af39a431facfd52a05e06

SHA256
9e6f8b2217095362261f4bb835df082444cf49b842a03b23b50971d8abe806b0

SHA512
f3e9f4a3e01a58ade649f6dbe52fcb1e6f17284f44781e1faa80ab62b1b28b5910ba0a3a378beb694cabc351adc6765162fa39297efc0702f9bd5cb105e69037

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\OptimizePop.xlsx

Filesize
15KB

MD5
27a7ccd2af761b7613ff65191b7f4e9d

SHA1
0db804ea2bbfddb600bb875a62da7f7f71ad73e1

SHA256
56f6d0d531aea7cbbd001e496dc3be225366f0beadb89ea9975faa7ddda77f72

SHA512
8887adaf0486d6ebb9336833ee8d08da9d9c0b016ab76c41bb98849c63e7422fc1f3602923c8ff298923f65a542aeef2d1f05688e7f982ddf4b3280afaa02188

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SaveExpand.docx

Filesize
19KB

MD5
8e363e8952694a976abf4a6c20685685

SHA1
bf635e96ef90fab35bc846fc08549bb7722e6775

SHA256
21418d7646acbc04481434dcf3de6d678c811ce32ed28521f641e097bef9c9d6

SHA512
58411157c821a0e8cbf9f4f5af34ba9840a367a314ef2037d2264542557ffc3f8484df12c6083dd88a497c286b443bcf9762f764f40d5215a6e440468cab5a20

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SplitTest.png

Filesize
1.6MB

MD5
d4f3498e400917beb17e5b4e65074f96

SHA1
8d22d5e36513da8f5440af2d1cb2a8639a750f59

SHA256
5d09c562042395132ff6ab0c1d8b89726e5096ab3ada81bccdca9513d47fd51b

SHA512
6503b2d6d20f113361975e53fabb80ea2b78f68a5021e96cea5500b27cd268bb8b7efb9db6ba583b098f4c52435cb3b6b1e0a7951e78ac3ba5098466640ee921

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\StopBackup.xlsx

Filesize
13KB

MD5
e05532a5ce0a3aaad5167ae610280fae

SHA1
461422d791457009b746457511e83e60043c8a38

SHA256
0c65d2bb4a84c38ca1d8a7e2da14595a7ae5415ac700403fa94d9457ebae821e

SHA512
7a249ce9cf58d19cc21ff4d1d6d9122ee1719fb26faf5814e3b563de5ba1080cb148128b76b73c615b288227ee4f91f09f83e49d608d6c5f9527f178b1ef1676

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SubmitRequest.xlsx

Filesize
9KB

MD5
2fc7e1e1b6f750e984023d931cf65932

SHA1
9d29d304f379c784fa247ac93b0579ddb6dbedb3

SHA256
5ac310786cf8aa03d7b4aa3f3d3d589249563bcedb8f52e53f91d555ca09dbbc

SHA512
e955034321a20e30273eceebdf6bd9548706d836ae41502c179cd051f80ca4ec84171cfdb52899f97ebda513f6fc9ac0f278b49446c04248d3b5c5fbf435809f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BlockRedo.doc

Filesize
1.9MB

MD5
96f80462041d31f92e3d434f517eade3

SHA1
a41accebf8c68995e19f5f2c2ddc67fcbc6518bb

SHA256
91b073b3848c14cf1430666205b0b2872a9ee6ceab1762f8c5bb84711af41d78

SHA512
6e749c3fb536483e127ee70b3b8df0ca5f42b449071a960d1eb9f3bd1545a13e99140eb7924b635266ab902267097b669b25353c9495d01e853e19f807dd4c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ExitUnprotect.xlsx

Filesize
10KB

MD5
6f64a44fb36b839527dbde0247afce18

SHA1
d36d0bf06021e8287a2fa85dc67cca837ee4d30a

SHA256
914782961fcec335feb799b119344f6ceca6444767d8dbe45df324d633deca09

SHA512
0cd331e3a0a2687d644fa8dd0b5f7e048f501de90b36db4ac791bebbb8b9b2ec0ca87e8b90c7bd506fd963bcb6c380efd2844fb4bb5585fbbf909bd76679542e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\FindInitialize.xlsx

Filesize
9KB

MD5
3471147f51930160a6ea745aeb2d94e8

SHA1
2543dbad27fdbac9fc206ab91be01a08bd933460

SHA256
07aa883d5e9f1c9e882893a63f3ab8a749f9b70ea9a531871dd5464ff0a9954e

SHA512
a886c20c6edca6b443dea0baf439595789b9f10a7ee96ecfc3086955cd636c771818514bfefb359ccb5128efbd9f47237c2a9c1b189d298e6c74c1f46dbac972

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\FindSearch.xlsx

Filesize
9KB

MD5
0caf0ed65d3c510146905a0a68c4e4ac

SHA1
3c96f6c3803f5ef2f5729b09e890e5bc123728e4

SHA256
e514dde9b21b13e9a23cf9fa20e926b85e2401d742965be3737e6296edb4e878

SHA512
2e6fbc902c4e53ba3568dce96728a97e4dc0bd739d5c6244d7905c8e92e65784dc132559232c93e01a4a136fac1906e670ab648e707a46b9a268dbc353698423

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RestartBackup.xlt

Filesize
1018KB

MD5
992c03c50a1d8b1dbfeee3f7e05411cf

SHA1
f088e67d42fd0c0190560e799d8bf15e15b027de

SHA256
f40ce087f7303da640b7c81bb1e6905896840c46b2053f23c808146a7ecc6f25

SHA512
8afd86f0b9f3e788a1eb3cb2e017bc39bb9955926f2ae866dc044dd2a5c850a714c8236e1800f5a099f3dfbd2f48af7170e88ccd299460bad84da335025ef3a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SubmitJoin.docx

Filesize
14KB

MD5
b11f36d62523fa6453ed7635d4dcf3b8

SHA1
53fd49faf9cac5563f1dff6a4f9b69febbbd3b58

SHA256
464e8f97cf379fbda6bf6428236a09aad4dbe5e02010a39659f290e6b517da6e

SHA512
64c3ec4b11dfec863cb92d5c037602f3292692c698c9c14a5e61dc89107ed1a9e15a254283ae50e6cd3043ca4360040511cf1609ba06bd0b4212b56c4a26e722

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UndoResolve.doc

Filesize
1.6MB

MD5
7e977e4ea6b53db09fbc6859966efc98

SHA1
73d8be9858a11642644b08d12e5887023e0c4e66

SHA256
b03dbff763b288b3a4c12f2aa5662c7465f4436a496c02d14694e288b2ae1161

SHA512
483bc3037c8e4bbb2f9ad98af6890fb70bf0ddb1087dac536d4c9892108052847735cfb21167b72310cfbd712d75f175a2e203feb3ea44c008e6c05db9023b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupJoin.exe

Filesize
407KB

MD5
cac7723df3b0b0d8cab990fba13abd22

SHA1
c4aceada3161b9bf6fe24dc66fb79537467ec6f4

SHA256
c8e8d8217641c82a6ed2ba58dd75ee24e6d727b1b4342928c9f85d2675ebd6ed

SHA512
946637d5c9f9360c9b890fae62f89b2224a2c511cbd6ccefdb6f343b5368527d8d2c2054a97511ba972fafd5674c374c89183791c51278eaa76097cc9550dcd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupProtect.m4a

Filesize
387KB

MD5
207b8d432455b1be748a26072ca51122

SHA1
9967a28d95272db8480d10732301f89b66a90024

SHA256
61481257df7c17bb52f9b5eba4b9f2f2ab41d674a0dbb41b52253a743ac14785

SHA512
e403c539f6eadf412cd079221411d9efd11383c18dfd3a10db62910019ad48ea82675f050230919c08353798fa0e85752a7be79abf97d914d2fcb5352ff00c77

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CompareRegister.csv

Filesize
916KB

MD5
b0ad4bbc9eb5366c6f1da2e526ff2990

SHA1
ace3ab3c311b4f3654262b947bf40795e0655248

SHA256
4c55471ef160944c1e0cea9190b71b35790950b2aeae7278f46a58222ae4837b

SHA512
464bdeef8ead9aa799194a0aa96b0e8388dfb106fcd55a2d84dd1ec20171af6d24fd48686d36247f4d0b663ae1aecaac4312ddbb124742e18e853008a9ee9392

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\LockMerge.xlsx

Filesize
753KB

MD5
2017d012dd8b91216dda0a8eaa87b0fc

SHA1
29e491e0af4911d68f008ad3de0b443c631dde8f

SHA256
467350949d9ad324290b539eb9a4a9db74d515095e185eb7953456bb1460b691

SHA512
8a5e16db04afe8f6d992bf1d101f73e28e514a002367e50dedcb204e80b070e281268e73b695df0964b6bd0be08463b12fccb8a0d2759e1198dcc565fa31935f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RequestSend.zip

Filesize
346KB

MD5
6e715592e2b68b53b99d0ad0b0576a5f

SHA1
6236aa8de921084c32024721b4b749af44a383e1

SHA256
c97e094b20ca9375189ccfbbe2bf57e9b6b2b0b940388e27e60e2d7021df4722

SHA512
f8103b9d91065362d98363b75d2b131b90f72871cf6c60dca98f07d0653b7917be0a4e819ad35e1fed6d892013b8cb4e4b049e9f19a09221ac09ab123b77fd6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupEnter.dot

Filesize
480KB

MD5
ca2456125570e0660ad3fb053cf2dcb9

SHA1
93202593dbad67594b653eb0492fdb7735310331

SHA256
48049e4f039cce5f1a019bb47e9a1240d319532e72646602f2a74b53bddc9045

SHA512
ba1788bc80992272a8047477c0d922d004140bf37cd749d80967d5068ef0a56322193d86996660a5c151808f844413acd73849475c5b3b9bb2b6056811dcf51b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CompareBlock.jpeg

Filesize
409KB

MD5
99ff75692cd6c9e15834c7be27d08b15

SHA1
b09fa4419509c884488356612ea014e3aae03110

SHA256
79fc69595abda9cf1bf806da9fc1c9fe16bf2278be884213322ac89272471a11

SHA512
b1b2241e88a0f0a96a10edfababeda33f1cbd9ba16934c7300d8d799e842c9581a5bbd27f964bb7e9b8df081a85a6c7d4028264d9babe8c9a7f2197c870e663e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\DismountEdit.jpg

Filesize
479KB

MD5
8d6ec356f39c571293576fd31456f0d5

SHA1
b9710b325cbd06210bba7628c3fe5b9620dc4a9e

SHA256
1ff70803a50313c4f47a12b4226f3aa14eb81d67f496da828088146e3046367d

SHA512
55a3430b99c76e599ee98e45221610a454579fd53c0990ec7a882e6e6ab70432310277a5c848f7e434e2c2ac46aa0f8192905211048f7a5d25107585bbc994cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\MergeApprove.jpeg

Filesize
374KB

MD5
50c6f4622b1fa7012cb9158bfbf83c19

SHA1
13fa44d6c6caa8a7d2febf196a122e14fc5a741b

SHA256
fdf162cb66b6705d50df0af94d11b53d00868bcebd5d7b2ed947f2cf7b8b49d1

SHA512
20de4c2d2bd279da2370f4bfff67e83886348ac9073e4d2cc144c78edd76a1f2534da078b13e2b9ce4e4ad079d39c9b27a0037735b89ad85b3bc9dba424c4dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\TempAppFiles\mac.exe

Filesize
11.6MB

MD5
d08d717e2e79f16ae07a0f1e188df907

SHA1
b25f509e2e40a7b2f51d5772daeb0308c20831c2

SHA256
60520faf79ce1ed233d167dfa2c0f5d4d78dbc792309e218ff3a3ff362a84cdc

SHA512
ff311037a90f031e33364dae40a8555150e71ef39f367f7055740dfe9244604b66b96fec149971a435e9ab6724aa89eef4e68f9f78cb0392550732f9244e2937

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\_ctypes.pyd

Filesize
57KB

MD5
b4c41a4a46e1d08206c109ce547480c7

SHA1
9588387007a49ec2304160f27376aedca5bc854d

SHA256
9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9

SHA512
30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-console-l1-1-0.dll

Filesize
21KB

MD5
e8b9d74bfd1f6d1cc1d99b24f44da796

SHA1
a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452

SHA256
b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59

SHA512
b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-datetime-l1-1-0.dll

Filesize
21KB

MD5
cfe0c1dfde224ea5fed9bd5ff778a6e0

SHA1
5150e7edd1293e29d2e4d6bb68067374b8a07ce6

SHA256
0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e

SHA512
b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-debug-l1-1-0.dll

Filesize
21KB

MD5
33bbece432f8da57f17bf2e396ebaa58

SHA1
890df2dddfdf3eeccc698312d32407f3e2ec7eb1

SHA256
7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e

SHA512
619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
21KB

MD5
eb0978a9213e7f6fdd63b2967f02d999

SHA1
9833f4134f7ac4766991c918aece900acfbf969f

SHA256
ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e

SHA512
6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-file-l1-1-0.dll

Filesize
25KB

MD5
efad0ee0136532e8e8402770a64c71f9

SHA1
cda3774fe9781400792d8605869f4e6b08153e55

SHA256
3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed

SHA512
69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-handle-l1-1-0.dll

Filesize
21KB

MD5
e89cdcd4d95cda04e4abba8193a5b492

SHA1
5c0aee81f32d7f9ec9f0650239ee58880c9b0337

SHA256
1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238

SHA512
55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-heap-l1-1-0.dll

Filesize
21KB

MD5
accc640d1b06fb8552fe02f823126ff5

SHA1
82ccc763d62660bfa8b8a09e566120d469f6ab67

SHA256
332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f

SHA512
6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
21KB

MD5
c6024cc04201312f7688a021d25b056d

SHA1
48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd

SHA256
8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500

SHA512
d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
21KB

MD5
1f2a00e72bc8fa2bd887bdb651ed6de5

SHA1
04d92e41ce002251cc09c297cf2b38c4263709ea

SHA256
9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142

SHA512
8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-memory-l1-1-0.dll

Filesize
21KB

MD5
3c38aac78b7ce7f94f4916372800e242

SHA1
c793186bcf8fdb55a1b74568102b4e073f6971d6

SHA256
3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d

SHA512
c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
21KB

MD5
321a3ca50e80795018d55a19bf799197

SHA1
df2d3c95fb4cbb298d255d342f204121d9d7ef7f

SHA256
5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f

SHA512
3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
21KB

MD5
0462e22f779295446cd0b63e61142ca5

SHA1
616a325cd5b0971821571b880907ce1b181126ae

SHA256
0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e

SHA512
07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
21KB

MD5
c3632083b312c184cbdd96551fed5519

SHA1
a93e8e0af42a144009727d2decb337f963a9312e

SHA256
be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125

SHA512
8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-profile-l1-1-0.dll

Filesize
21KB

MD5
f3ff2d544f5cd9e66bfb8d170b661673

SHA1
9e18107cfcd89f1bbb7fdaf65234c1dc8e614add

SHA256
e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f

SHA512
184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
21KB

MD5
a0c2dbe0f5e18d1add0d1ba22580893b

SHA1
29624df37151905467a223486500ed75617a1dfd

SHA256
3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f

SHA512
3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-string-l1-1-0.dll

Filesize
21KB

MD5
2666581584ba60d48716420a6080abda

SHA1
c103f0ea32ebbc50f4c494bce7595f2b721cb5ad

SHA256
27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328

SHA512
befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-synch-l1-1-0.dll

Filesize
21KB

MD5
225d9f80f669ce452ca35e47af94893f

SHA1
37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50

SHA256
61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232

SHA512
2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-synch-l1-2-0.dll

Filesize
21KB

MD5
1281e9d1750431d2fe3b480a8175d45c

SHA1
bc982d1c750b88dcb4410739e057a86ff02d07ef

SHA256
433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa

SHA512
a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
21KB

MD5
fd46c3f6361e79b8616f56b22d935a53

SHA1
107f488ad966633579d8ec5eb1919541f07532ce

SHA256
0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df

SHA512
3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-core-util-l1-1-0.dll

Filesize
21KB

MD5
0f129611a4f1e7752f3671c9aa6ea736

SHA1
40c07a94045b17dae8a02c1d2b49301fad231152

SHA256
2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f

SHA512
6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-crt-conio-l1-1-0.dll

Filesize
21KB

MD5
d4fba5a92d68916ec17104e09d1d9d12

SHA1
247dbc625b72ffb0bf546b17fb4de10cad38d495

SHA256
93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5

SHA512
d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
edf71c5c232f5f6ef3849450f2100b54

SHA1
ed46da7d59811b566dd438fa1d09c20f5dc493ce

SHA256
b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc

SHA512
481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\api-ms-win-crt-environment-l1-1-0.dll

Filesize
21KB

MD5
f9235935dd3ba2aa66d3aa3412accfbf

SHA1
281e548b526411bcb3813eb98462f48ffaf4b3eb

SHA256
2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200

SHA512
ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\base_library.zip

Filesize
1.4MB

MD5
83d235e1f5b0ee5b0282b5ab7244f6c4

SHA1
629a1ce71314d7abbce96674a1ddf9f38c4a5e9c

SHA256
db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0

SHA512
77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\libffi-8.dll

Filesize
24KB

MD5
decbba3add4c2246928ab385fb16a21e

SHA1
5f019eff11de3122ffa67a06d52d446a3448b75e

SHA256
4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d

SHA512
760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\python3.DLL

Filesize
64KB

MD5
34e49bb1dfddf6037f0001d9aefe7d61

SHA1
a25a39dca11cdc195c9ecd49e95657a3e4fe3215

SHA256
4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281

SHA512
edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI46122\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0rygndq.2ll.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 932543.crdownload

Filesize
15.6MB

MD5
76ed914a265f60ff93751afe02cf35a4

SHA1
4f8ea583e5999faaec38be4c66ff4849fcf715c6

SHA256
51bd245f8cb24c624674cd2bebcad4152d83273dab4d1ee7d982e74a0548890b

SHA512
83135f8b040b68cafb896c4624bd66be1ae98857907b9817701d46952d4be9aaf7ad1ab3754995363bb5192fa2c669c26f526cafc6c487b061c2edcceebde6ac

Download Submit
memory/4136-297-0x0000000000220000-0x0000000001EA0000-memory.dmp

Filesize
28.5MB

Download
memory/4136-313-0x0000000000220000-0x0000000001EA0000-memory.dmp

Filesize
28.5MB

Download
memory/4136-952-0x0000000000220000-0x0000000001EA0000-memory.dmp

Filesize
28.5MB

Download
memory/4136-177-0x0000000000220000-0x0000000001EA0000-memory.dmp

Filesize
28.5MB

Download
memory/4136-296-0x0000000000220000-0x0000000001EA0000-memory.dmp

Filesize
28.5MB

Download
memory/4136-299-0x000001EB32ED0000-0x000001EB32ED1000-memory.dmp

Filesize
4KB

Download
memory/4136-300-0x000001EB4DE50000-0x000001EB4DF02000-memory.dmp

Filesize
712KB

Download
memory/4136-301-0x000001EB4E0C0000-0x000001EB4E0E2000-memory.dmp

Filesize
136KB

Download
memory/4136-302-0x000001EB4E140000-0x000001EB4E354000-memory.dmp

Filesize
2.1MB

Download
memory/4136-306-0x000001EB4EE10000-0x000001EB4EE44000-memory.dmp

Filesize
208KB

Download
memory/4136-307-0x000001EB4EE60000-0x000001EB4EE7A000-memory.dmp

Filesize
104KB

Download
memory/4136-308-0x000001EB4EE40000-0x000001EB4EE48000-memory.dmp

Filesize
32KB

Download
memory/4136-311-0x000001EB4EE80000-0x000001EB4EEB2000-memory.dmp

Filesize
200KB

Download
memory/4136-309-0x000001EB4EE50000-0x000001EB4EE64000-memory.dmp

Filesize
80KB

Download
memory/5000-600-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp

Filesize
5.9MB

Download
memory/5000-480-0x00007FFFACA90000-0x00007FFFACABE000-memory.dmp

Filesize
184KB

Download
memory/5000-467-0x00007FFFABAF0000-0x00007FFFABBA8000-memory.dmp

Filesize
736KB

Download
memory/5000-468-0x00007FFFAE800000-0x00007FFFAE824000-memory.dmp

Filesize
144KB

Download
memory/5000-465-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp

Filesize
5.9MB

Download
memory/5000-464-0x00007FFFACA90000-0x00007FFFACABE000-memory.dmp

Filesize
184KB

Download
memory/5000-463-0x00007FFF9EC00000-0x00007FFF9ED73000-memory.dmp

Filesize
1.4MB

Download
memory/5000-462-0x00007FFFADC90000-0x00007FFFADCB3000-memory.dmp

Filesize
140KB

Download
memory/5000-460-0x00007FFFAE300000-0x00007FFFAE319000-memory.dmp

Filesize
100KB

Download
memory/5000-429-0x00007FFFAE7F0000-0x00007FFFAE7FF000-memory.dmp

Filesize
60KB

Download
memory/5000-426-0x00007FFFAE800000-0x00007FFFAE824000-memory.dmp

Filesize
144KB

Download
memory/5000-485-0x00007FFFA7590000-0x00007FFFA75A1000-memory.dmp

Filesize
68KB

Download
memory/5000-461-0x00007FFFAE2D0000-0x00007FFFAE2FD000-memory.dmp

Filesize
180KB

Download
memory/5000-536-0x00007FFFABA40000-0x00007FFFABA4D000-memory.dmp

Filesize
52KB

Download
memory/5000-535-0x00007FFFABE10000-0x00007FFFABE27000-memory.dmp

Filesize
92KB

Download
memory/5000-486-0x00007FFFABAF0000-0x00007FFFABBA8000-memory.dmp

Filesize
736KB

Download
memory/5000-554-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp

Filesize
136KB

Download
memory/5000-555-0x00007FFFABDF0000-0x00007FFFABE07000-memory.dmp

Filesize
92KB

Download
memory/5000-556-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp

Filesize
100KB

Download
memory/5000-557-0x00007FFFABA50000-0x00007FFFABA9D000-memory.dmp

Filesize
308KB

Download
memory/5000-566-0x00007FFFA7570000-0x00007FFFA758E000-memory.dmp

Filesize
120KB

Download
memory/5000-568-0x00007FFF8CE20000-0x00007FFF8D5C1000-memory.dmp

Filesize
7.6MB

Download
memory/5000-597-0x00007FFFA7530000-0x00007FFFA7566000-memory.dmp

Filesize
216KB

Download
memory/5000-589-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp

Filesize
100KB

Download
memory/5000-587-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp

Filesize
136KB

Download
memory/5000-586-0x00007FFFABE10000-0x00007FFFABE27000-memory.dmp

Filesize
92KB

Download
memory/5000-579-0x00007FFF9C830000-0x00007FFF9CBA5000-memory.dmp

Filesize
3.5MB

Download
memory/5000-582-0x00007FFFACA50000-0x00007FFFACA62000-memory.dmp

Filesize
72KB

Download
memory/5000-581-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp

Filesize
84KB

Download
memory/5000-580-0x00007FFFABAF0000-0x00007FFFABBA8000-memory.dmp

Filesize
736KB

Download
memory/5000-569-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp

Filesize
5.9MB

Download
memory/5000-578-0x00007FFFACA90000-0x00007FFFACABE000-memory.dmp

Filesize
184KB

Download
memory/5000-577-0x00007FFF9EC00000-0x00007FFF9ED73000-memory.dmp

Filesize
1.4MB

Download
memory/5000-570-0x00007FFFAE800000-0x00007FFFAE824000-memory.dmp

Filesize
144KB

Download
memory/5000-620-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp

Filesize
100KB

Download
memory/5000-618-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp

Filesize
136KB

Download
memory/5000-612-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp

Filesize
84KB

Download
memory/5000-459-0x00007FFFAE7C0000-0x00007FFFAE7CD000-memory.dmp

Filesize
52KB

Download
memory/5000-458-0x00007FFFAE7D0000-0x00007FFFAE7E9000-memory.dmp

Filesize
100KB

Download
memory/5000-491-0x00007FFF8CE20000-0x00007FFF8D5C1000-memory.dmp

Filesize
7.6MB

Download
memory/5000-487-0x00007FFFABA50000-0x00007FFFABA9D000-memory.dmp

Filesize
308KB

Download
memory/5000-488-0x00007FFFAE7B0000-0x00007FFFAE7BA000-memory.dmp

Filesize
40KB

Download
memory/5000-490-0x00007FFFA7570000-0x00007FFFA758E000-memory.dmp

Filesize
120KB

Download
memory/5000-419-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp

Filesize
5.9MB

Download
memory/5000-489-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp

Filesize
84KB

Download
memory/5000-466-0x00007FFF9C830000-0x00007FFF9CBA5000-memory.dmp

Filesize
3.5MB

Download
memory/5000-472-0x00007FFFACA30000-0x00007FFFACA44000-memory.dmp

Filesize
80KB

Download
memory/5000-471-0x00007FFFACA50000-0x00007FFFACA62000-memory.dmp

Filesize
72KB

Download
memory/5000-484-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp

Filesize
100KB

Download
memory/5000-483-0x00007FFF9C830000-0x00007FFF9CBA5000-memory.dmp

Filesize
3.5MB

Download
memory/5000-479-0x00007FFF9EC00000-0x00007FFF9ED73000-memory.dmp

Filesize
1.4MB

Download
memory/5000-477-0x00007FFFADC90000-0x00007FFFADCB3000-memory.dmp

Filesize
140KB

Download
memory/5000-476-0x00007FFF9E2C0000-0x00007FFF9E3DC000-memory.dmp

Filesize
1.1MB

Download
memory/5000-475-0x00007FFFAE2D0000-0x00007FFFAE2FD000-memory.dmp

Filesize
180KB

Download
memory/5000-492-0x00007FFFA7530000-0x00007FFFA7566000-memory.dmp

Filesize
216KB

Download
memory/5000-474-0x00007FFFACA10000-0x00007FFFACA24000-memory.dmp

Filesize
80KB

Download
memory/5000-478-0x00007FFFABE10000-0x00007FFFABE27000-memory.dmp

Filesize
92KB

Download
memory/5000-473-0x00007FFFAE300000-0x00007FFFAE319000-memory.dmp

Filesize
100KB

Download
memory/5000-470-0x00007FFFAE7D0000-0x00007FFFAE7E9000-memory.dmp

Filesize
100KB

Download
memory/5000-482-0x00007FFFABDF0000-0x00007FFFABE07000-memory.dmp

Filesize
92KB

Download
memory/5000-481-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp

Filesize
136KB

Download
memory/5000-912-0x00007FFFAE7F0000-0x00007FFFAE7FF000-memory.dmp

Filesize
60KB

Download
memory/5000-920-0x00007FFFACA90000-0x00007FFFACABE000-memory.dmp

Filesize
184KB

Download
memory/5000-934-0x00007FFFA7570000-0x00007FFFA758E000-memory.dmp

Filesize
120KB

Download
memory/5000-933-0x00007FFFABAF0000-0x00007FFFABBA8000-memory.dmp

Filesize
736KB

Download
memory/5000-932-0x00007FFF9C830000-0x00007FFF9CBA5000-memory.dmp

Filesize
3.5MB

Download
memory/5000-937-0x00007FFFABA40000-0x00007FFFABA4D000-memory.dmp

Filesize
52KB

Download
memory/5000-936-0x00007FFFA7530000-0x00007FFFA7566000-memory.dmp

Filesize
216KB

Download
memory/5000-935-0x00007FFF8CE20000-0x00007FFF8D5C1000-memory.dmp

Filesize
7.6MB

Download
memory/5000-931-0x00007FFFA7590000-0x00007FFFA75A1000-memory.dmp

Filesize
68KB

Download
memory/5000-930-0x00007FFFABAA0000-0x00007FFFABAB9000-memory.dmp

Filesize
100KB

Download
memory/5000-929-0x00007FFFABDF0000-0x00007FFFABE07000-memory.dmp

Filesize
92KB

Download
memory/5000-928-0x00007FFFABAC0000-0x00007FFFABAE2000-memory.dmp

Filesize
136KB

Download
memory/5000-927-0x00007FFF9E2C0000-0x00007FFF9E3DC000-memory.dmp

Filesize
1.1MB

Download
memory/5000-926-0x00007FFFABE10000-0x00007FFFABE27000-memory.dmp

Filesize
92KB

Download
memory/5000-925-0x00007FFFACA10000-0x00007FFFACA24000-memory.dmp

Filesize
80KB

Download
memory/5000-924-0x00007FFFACA30000-0x00007FFFACA44000-memory.dmp

Filesize
80KB

Download
memory/5000-923-0x00007FFFACA50000-0x00007FFFACA62000-memory.dmp

Filesize
72KB

Download
memory/5000-922-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp

Filesize
84KB

Download
memory/5000-921-0x00007FFF9E3E0000-0x00007FFF9E9C8000-memory.dmp

Filesize
5.9MB

Download
memory/5000-919-0x00007FFFABA50000-0x00007FFFABA9D000-memory.dmp

Filesize
308KB

Download
memory/5000-918-0x00007FFF9EC00000-0x00007FFF9ED73000-memory.dmp

Filesize
1.4MB

Download
memory/5000-917-0x00007FFFADC90000-0x00007FFFADCB3000-memory.dmp

Filesize
140KB

Download
memory/5000-916-0x00007FFFAE2D0000-0x00007FFFAE2FD000-memory.dmp

Filesize
180KB

Download
memory/5000-915-0x00007FFFAE300000-0x00007FFFAE319000-memory.dmp

Filesize
100KB

Download
memory/5000-914-0x00007FFFAE7C0000-0x00007FFFAE7CD000-memory.dmp

Filesize
52KB

Download
memory/5000-913-0x00007FFFAE7D0000-0x00007FFFAE7E9000-memory.dmp

Filesize
100KB

Download
memory/5000-911-0x00007FFFAE800000-0x00007FFFAE824000-memory.dmp

Filesize
144KB

Download
memory/5000-910-0x00007FFFAE7B0000-0x00007FFFAE7BA000-memory.dmp

Filesize
40KB

Download
memory/5000-469-0x00007FFFACA70000-0x00007FFFACA85000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads