exelastealer | 4c6183029dcf2e4d604c473c2dfb4f72037b6a8f13d9183b0842fd201e422d7a

Analysis

max time kernel
437s
max time network
489s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-01-2025 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RJyY2h.html
Size

7KB
MD5

aa5d13590623abb5d3963a8af5dfb85d
SHA1

8dcb62e75f970ac4f9f78e2558f335951b599774
SHA256

4c6183029dcf2e4d604c473c2dfb4f72037b6a8f13d9183b0842fd201e422d7a
SHA512

94899bfebc29d4d76c1a8d0e9b787ae50386a5e8718194791d27d86eb7e67e1b0e1a9b0a4e68031905c767419bd767b9d2666ac5ffd0a8dd87c0bf842ac7282b
SSDEEP

96:CMq9SlLh2B3Zq36uWl/PtxyjttJQ8Maoah3vL5LaNclmnU1Eh2sS:T1lLhwJrPahtJxMaoah3vG12sS

Score

10^/10

exelastealer collection defense_evasion discovery persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4000	netsh.exe
4428	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2228	cmd.exe
3408	powershell.exe

Deletes itself 1 IoCs

pid	Process
1892	Exela.exe

Executes dropped EXE 2 IoCs

pid	Process
3484	Exela.exe
1892	Exela.exe

Loads dropped DLL 33 IoCs

pid	Process
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe
1892	Exela.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
39	discord.com
3	discord.com
33	discord.com
34	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3880	cmd.exe
3136	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
4084	tasklist.exe
4832	tasklist.exe
2300	tasklist.exe
244	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1420	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002ab15-291.dat	upx
behavioral1/memory/1892-295-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp	upx
behavioral1/files/0x000400000002500e-297.dat	upx
behavioral1/memory/1892-303-0x00007FF8DAC60000-0x00007FF8DAC83000-memory.dmp	upx
behavioral1/files/0x001900000002ab0d-304.dat	upx
behavioral1/memory/1892-331-0x00007FF8DAC30000-0x00007FF8DAC49000-memory.dmp	upx
behavioral1/memory/1892-332-0x00007FF8DA170000-0x00007FF8DA17D000-memory.dmp	upx
behavioral1/memory/1892-333-0x00007FF8DA150000-0x00007FF8DA169000-memory.dmp	upx
behavioral1/memory/1892-334-0x00007FF8D2D40000-0x00007FF8D2D6D000-memory.dmp	upx
behavioral1/memory/1892-305-0x00007FF8DAC50000-0x00007FF8DAC5F000-memory.dmp	upx
behavioral1/memory/1892-335-0x00007FF8D2A70000-0x00007FF8D2A93000-memory.dmp	upx
behavioral1/memory/1892-336-0x00007FF8BF7F0000-0x00007FF8BF967000-memory.dmp	upx
behavioral1/memory/1892-337-0x00007FF8D2A30000-0x00007FF8D2A63000-memory.dmp	upx
behavioral1/memory/1892-339-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp	upx
behavioral1/memory/1892-338-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp	upx
behavioral1/memory/1892-340-0x00007FF8BF2D0000-0x00007FF8BF7F0000-memory.dmp	upx
behavioral1/memory/1892-343-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp	upx
behavioral1/memory/1892-342-0x00007FF8DAC60000-0x00007FF8DAC83000-memory.dmp	upx
behavioral1/memory/1892-345-0x00007FF8CFE10000-0x00007FF8CFE22000-memory.dmp	upx
behavioral1/memory/1892-344-0x00007FF8DAC30000-0x00007FF8DAC49000-memory.dmp	upx
behavioral1/memory/1892-347-0x00007FF8C8340000-0x00007FF8C8354000-memory.dmp	upx
behavioral1/memory/1892-346-0x00007FF8CFDF0000-0x00007FF8CFE04000-memory.dmp	upx
behavioral1/memory/1892-348-0x00007FF8D2D40000-0x00007FF8D2D6D000-memory.dmp	upx
behavioral1/memory/1892-349-0x00007FF8C8310000-0x00007FF8C8332000-memory.dmp	upx
behavioral1/memory/1892-350-0x00007FF8D2A70000-0x00007FF8D2A93000-memory.dmp	upx
behavioral1/memory/1892-353-0x00007FF8C82F0000-0x00007FF8C830B000-memory.dmp	upx
behavioral1/memory/1892-352-0x00007FF8BF7F0000-0x00007FF8BF967000-memory.dmp	upx
behavioral1/memory/1892-351-0x00007FF8BF1B0000-0x00007FF8BF2CC000-memory.dmp	upx
behavioral1/memory/1892-354-0x00007FF8D2A30000-0x00007FF8D2A63000-memory.dmp	upx
behavioral1/memory/1892-359-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp	upx
behavioral1/memory/1892-358-0x00007FF8C70B0000-0x00007FF8C70E2000-memory.dmp	upx
behavioral1/memory/1892-357-0x00007FF8C7110000-0x00007FF8C7121000-memory.dmp	upx
behavioral1/memory/1892-361-0x00007FF8C7130000-0x00007FF8C717D000-memory.dmp	upx
behavioral1/memory/1892-362-0x00007FF8C7090000-0x00007FF8C70AE000-memory.dmp	upx
behavioral1/memory/1892-360-0x00007FF8BF2D0000-0x00007FF8BF7F0000-memory.dmp	upx
behavioral1/memory/1892-363-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp	upx
behavioral1/memory/1892-356-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp	upx
behavioral1/memory/1892-364-0x00007FF8BE9B0000-0x00007FF8BF1AB000-memory.dmp	upx
behavioral1/memory/1892-365-0x00007FF8C0590000-0x00007FF8C05C7000-memory.dmp	upx
behavioral1/memory/1892-441-0x00007FF8BF1B0000-0x00007FF8BF2CC000-memory.dmp	upx
behavioral1/memory/1892-442-0x00007FF8DC250000-0x00007FF8DC25D000-memory.dmp	upx
behavioral1/memory/1892-440-0x00007FF8C8310000-0x00007FF8C8332000-memory.dmp	upx
behavioral1/memory/1892-458-0x00007FF8C82F0000-0x00007FF8C830B000-memory.dmp	upx
behavioral1/memory/1892-460-0x00007FF8C70B0000-0x00007FF8C70E2000-memory.dmp	upx
behavioral1/memory/1892-459-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp	upx
behavioral1/memory/1892-461-0x00007FF8C7130000-0x00007FF8C717D000-memory.dmp	upx
behavioral1/memory/1892-495-0x00007FF8BE9B0000-0x00007FF8BF1AB000-memory.dmp	upx
behavioral1/memory/1892-496-0x00007FF8C0590000-0x00007FF8C05C7000-memory.dmp	upx
behavioral1/memory/1892-490-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp	upx
behavioral1/memory/1892-484-0x00007FF8CFE10000-0x00007FF8CFE22000-memory.dmp	upx
behavioral1/memory/1892-483-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp	upx
behavioral1/memory/1892-481-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp	upx
behavioral1/memory/1892-480-0x00007FF8D2A30000-0x00007FF8D2A63000-memory.dmp	upx
behavioral1/memory/1892-479-0x00007FF8BF7F0000-0x00007FF8BF967000-memory.dmp	upx
behavioral1/memory/1892-472-0x00007FF8DAC60000-0x00007FF8DAC83000-memory.dmp	upx
behavioral1/memory/1892-471-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp	upx
behavioral1/memory/1892-482-0x00007FF8BF2D0000-0x00007FF8BF7F0000-memory.dmp	upx
behavioral1/memory/1892-652-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp	upx
behavioral1/memory/1892-672-0x00007FF8C7130000-0x00007FF8C717D000-memory.dmp	upx
behavioral1/memory/1892-671-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp	upx
behavioral1/memory/1892-664-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp	upx
behavioral1/memory/1892-706-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp	upx
behavioral1/memory/1892-744-0x00007FF8C7090000-0x00007FF8C70AE000-memory.dmp	upx
behavioral1/memory/1892-743-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1736	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0004000000024f5a-177.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2000	cmd.exe
3624	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3804	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
5084	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4780	ipconfig.exe
3804	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
856	systeminfo.exe

Kills process with taskkill 10 IoCs

defense_evasion

pid	Process
4084	taskkill.exe
3588	taskkill.exe
5092	taskkill.exe
1804	taskkill.exe
244	taskkill.exe
4568	taskkill.exe
4428	taskkill.exe
4696	taskkill.exe
2384	taskkill.exe
1560	taskkill.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 523038.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3736	msedge.exe
3736	msedge.exe
2900	identity_helper.exe
2900	identity_helper.exe
2776	msedge.exe
2776	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
2716	msedge.exe
2716	msedge.exe
3408	powershell.exe
3408	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5044	WMIC.exe
Token: SeSecurityPrivilege	5044	WMIC.exe
Token: SeTakeOwnershipPrivilege	5044	WMIC.exe
Token: SeLoadDriverPrivilege	5044	WMIC.exe
Token: SeSystemProfilePrivilege	5044	WMIC.exe
Token: SeSystemtimePrivilege	5044	WMIC.exe
Token: SeProfSingleProcessPrivilege	5044	WMIC.exe
Token: SeIncBasePriorityPrivilege	5044	WMIC.exe
Token: SeCreatePagefilePrivilege	5044	WMIC.exe
Token: SeBackupPrivilege	5044	WMIC.exe
Token: SeRestorePrivilege	5044	WMIC.exe
Token: SeShutdownPrivilege	5044	WMIC.exe
Token: SeDebugPrivilege	5044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5044	WMIC.exe
Token: SeRemoteShutdownPrivilege	5044	WMIC.exe
Token: SeUndockPrivilege	5044	WMIC.exe
Token: SeManageVolumePrivilege	5044	WMIC.exe
Token: 33	5044	WMIC.exe
Token: 34	5044	WMIC.exe
Token: 35	5044	WMIC.exe
Token: 36	5044	WMIC.exe
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5044	WMIC.exe
Token: SeSecurityPrivilege	5044	WMIC.exe
Token: SeTakeOwnershipPrivilege	5044	WMIC.exe
Token: SeLoadDriverPrivilege	5044	WMIC.exe
Token: SeSystemProfilePrivilege	5044	WMIC.exe
Token: SeSystemtimePrivilege	5044	WMIC.exe
Token: SeProfSingleProcessPrivilege	5044	WMIC.exe
Token: SeIncBasePriorityPrivilege	5044	WMIC.exe
Token: SeCreatePagefilePrivilege	5044	WMIC.exe
Token: SeBackupPrivilege	5044	WMIC.exe
Token: SeRestorePrivilege	5044	WMIC.exe
Token: SeShutdownPrivilege	5044	WMIC.exe
Token: SeDebugPrivilege	5044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5044	WMIC.exe
Token: SeRemoteShutdownPrivilege	5044	WMIC.exe
Token: SeUndockPrivilege	5044	WMIC.exe
Token: SeManageVolumePrivilege	5044	WMIC.exe
Token: 33	5044	WMIC.exe
Token: 34	5044	WMIC.exe
Token: 35	5044	WMIC.exe
Token: 36	5044	WMIC.exe
Token: SeDebugPrivilege	4832	tasklist.exe
Token: SeDebugPrivilege	2384	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	244	taskkill.exe
Token: SeDebugPrivilege	4568	taskkill.exe
Token: SeDebugPrivilege	4428	taskkill.exe
Token: SeDebugPrivilege	4696	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	3588	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	5092	taskkill.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeIncreaseQuotaPrivilege	5084	WMIC.exe
Token: SeSecurityPrivilege	5084	WMIC.exe
Token: SeTakeOwnershipPrivilege	5084	WMIC.exe
Token: SeLoadDriverPrivilege	5084	WMIC.exe
Token: SeSystemProfilePrivilege	5084	WMIC.exe
Token: SeSystemtimePrivilege	5084	WMIC.exe
Token: SeProfSingleProcessPrivilege	5084	WMIC.exe
Token: SeIncBasePriorityPrivilege	5084	WMIC.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 240	3736	msedge.exe	77
PID 3736 wrote to memory of 240	3736	msedge.exe	77
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3140	3736	msedge.exe	78
PID 3736 wrote to memory of 3624	3736	msedge.exe	79
PID 3736 wrote to memory of 3624	3736	msedge.exe	79
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80
PID 3736 wrote to memory of 1792	3736	msedge.exe	80

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4848	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\RJyY2h.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8d2bc3cb8,0x7ff8d2bc3cc8,0x7ff8d2bc3cd8
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1736 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=908 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,13857743749205844942,1007716897123641043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Users\Admin\Downloads\Exela.exe
  "C:\Users\Admin\Downloads\Exela.exe"
  2⤵
  - Executes dropped EXE
  PID:3484
- - C:\Users\Admin\Downloads\Exela.exe
    "C:\Users\Admin\Downloads\Exela.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3308
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:3864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      PID:1420
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:4848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
      4⤵
      PID:1980
    - - C:\Windows\system32\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
        5⤵
        Adds Run key to start application
        
        PID:4516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
      4⤵
      PID:5024
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
        5⤵
        
        PID:2520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      PID:4108
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3736"
      4⤵
      PID:4988
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3736
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 240"
      4⤵
      PID:4604
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 240
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3140"
      4⤵
      PID:1236
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3140
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3624"
      4⤵
      PID:2508
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3624
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1792"
      4⤵
      PID:2516
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1792
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3116"
      4⤵
      PID:908
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3116
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2336"
      4⤵
      PID:3996
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2336
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3328"
      4⤵
      PID:3324
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3328
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3720"
      4⤵
      PID:1412
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3720
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2040"
      4⤵
      PID:1524
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2040
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:4588
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:1428
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:5048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      PID:3420
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        
        PID:5036
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:2096
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      PID:2228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      PID:3880
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:856
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:2196
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        
        PID:352
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:2584
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        
        PID:2492
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:5016
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:2040
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:1364
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:3548
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:436
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:3128
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:2564
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:4236
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:1448
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:2336
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:244
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:4780
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:2436
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:3136
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:3804
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:1736
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4000
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2000
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:2340
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:2192
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e36c600fa2181254d64c98d26dc10181

SHA1
57177176c087247599d16f206302fe0656e18de4

SHA256
328527586f6b182369eb6f002d0d1a1fb38b64e98bbf1823757f7e7764cb847b

SHA512
ac48b1c4c0c7a602a2ad83c8c533174fdfb7e45f41c19f46b8a8888611eb4cc476ac186a455b7c9dfb0385d75f212316ac6453b8d861e012312ac5554430bc24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
547dce68a75738b2a5bcfa14ef876929

SHA1
a74c1850906dce18541ebf052b49cfb682ea93b1

SHA256
e8137887c58e7a94f30b18c4aa3e787aa82c9dd423efe46dbea4a40805086d08

SHA512
c3059e6cb059c070f469daadd04f2c9f28cd90c9c452220550898bb9976b85bff89dac1cf41b8577683a96d8ceb91a8d834887391706519a5c94979fcaba8570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f06d14cb37fe2bcb7e038ec0067f3f66

SHA1
1e67acfb6f4be1c905ca3b17258a3df8b1f04e66

SHA256
ad356632d4dfba276bb3a834ab1c52c7351bd14038ef12c834564a5f3862049c

SHA512
16c2a8b361e356d0d9ea568afe7146960029a30e08bea5a2ec0151e5d92e0b453d4aca9d584fc5cc318f6f4e2039801ef0b7003604ab4fa7e981c97c736ed3fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1be8de430dec72cf0610f54350bbfb3

SHA1
7d9cb167851b2f9e4e2b4fc1deff58da87219670

SHA256
d179db85377f66bb3961dfa2b9362d6af48d97edc5020c25f83ba665a7c4a0fa

SHA512
7575daea57cefffd6a79dfb8bd9b2895392ff4490283cc10f3bfa43b436b4f6eec513c6883c5a84d7ad7fb5a0ff5962393ae221ae61ad459d640736a0b27ae2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36ce5c1e3294e6b3d42f399ee466c55e

SHA1
1bde8ed459e88cce6a42d661dfd72029f369fe9d

SHA256
3bbf478bb0718edbbcd947b4747abd6e4784f400dbe1e3df44ae5ce197153b7c

SHA512
42e856bdc39754fce34e55570c3765bb52fee969beed550fb345a900b1709a6c6f44ed3e628090867f523f08445ad3fb5ec3b5587d9b6a0cdd93e8265e97130e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5bc3f810928ac2219f0fd6045023beeb

SHA1
a50a3e0eed32f9ba989aed1391ab26130e886037

SHA256
0bac8986780910a8e3c336e8b6c2d388de34148a1b5667690f03fdd6953573c5

SHA512
a46306f3359a19b5fc4082f700585140e1e46834941d15c68a297a512d2d8fc1fa46404ce521232abacc0a5e2343035d58d62e3b8ea802e2857831393a749e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d1a59a0a1ab59937255a95d31ad49a22

SHA1
cb1ad7ca25f0c10fbd06e0a3c68f10dbf1a155e9

SHA256
72b20b82bbdf45890561b3facf2a5194f06168da05616332e3668b885729e13d

SHA512
3b66f75552a5c11e60cd4ea9019908a9e5018c1b8a5adb41fd92f53ae77dda5c47eca7c17e6edc22393d2bf2e926a50de90872b061945502bf0c6289e3d9f475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c355a2e3f2e942cc3ef9fbda00f4b22b

SHA1
b78859f364c1d30b2d84f5015718f6660c9d50ca

SHA256
f8d2191c4b7c9b3c93ba4b6a8f2e1e68b89465867211f4ccd52359149e539d36

SHA512
c236a8ff32cfe819029d373bbabfd5db4bbdb17c29d64ab72a4ba8dad8ef7a10949c16049eea6e486639bfc2b7231ea5a9827d54f95b9e181ecae572249e0619

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupHide.temp

Filesize
611KB

MD5
8735d8f1cc6616c640a7d070171983cf

SHA1
6a144aa075e65e92454e0f4cf28d27ee5e8dfac6

SHA256
1958bbc0d1f3558ad29a7191dc4ae3e2184be5e57df6709f5df7d38b949c046f

SHA512
23beb9826d5e77421cc7837d99fb8e8bd028cfa5fe9d6eaf786d88fc05175b2d4d42d54ac7e6b025d9be5412155679737def8b50fd2e1f9166cd6771ce97f1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupResume.aif

Filesize
356KB

MD5
6671bc781247b9794ecbd4d8f28b35bf

SHA1
5a6c80076e31164d9ab0ea26b3f7eefc1a151867

SHA256
943cf526f22634b2e57be6f58816ce8193dba37eb3b83ecb3dd8a3f3268c3b83

SHA512
955c6e6413648e86fc40e32ac20ee528fbecb4109351675fb5d218ec1ad3c6eb15b994f8b26d4c259e02dd7314401a6e35aa9343c614a078df63fd08239ac310

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\DebugConfirm.mp3

Filesize
538KB

MD5
976e799b64b07bebdb2d433793170596

SHA1
43e1fd1449e143f6249934699fa7d92d6be74d5a

SHA256
cb5f4be9da20c2bf464158ae36004c12e6753cd0a116fa96ff4ff2c392b70fb2

SHA512
5dd0f15dad4ddab1ca8911e1eb77d23f7cfd166d7a8c5482d29c15ac4d0389ce6ab6cf8f2ebec097b4e25680bcc7710f5772ddf5752684594702d2cec3940dde

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\GrantJoin.jpeg

Filesize
392KB

MD5
fb1dcf1999c5e6c378d23385e3934e21

SHA1
fa0c8aabc6167d27897097a8c24f1271fb000298

SHA256
50a27816031e732e1d098439790311aabec5754bcd93dac984c33aad8fbe1983

SHA512
a2c98a17e1b77b263eff8c409eb5a937c5f24aa7618b8fd5e30237262f102a4ef8c31967fbc9373c9b0828788aa149d2f4b409377bf44bc84d245e1f4c5d9dc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\OpenRevoke.docx

Filesize
629KB

MD5
22fe19e727de1068402a60e05714887c

SHA1
c3819e4de0ebebbf718e7f37eddfed8a21f334e0

SHA256
2665f29604003946d4f1a67d8a3ebd43d54d19f5cbc1735d054681683f8eb296

SHA512
6c1b9d77e4d41c3a10a7fd78e3373ff023b38e104a238773d316417e8cf7bd391a74f4f955d3e1d3fe64df37685364669db1db64ac3109e8b3b668f3c6e365a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RequestBlock.png

Filesize
447KB

MD5
4f0a445ca21a233a1e4096a18c3a35af

SHA1
16b1b44ebd9ee7dcedfa7e2b996095fae48d025c

SHA256
7ea1ace594a7aad7e28fa9e651c6ad850dd89671d2e0079850358e2ea53c1026

SHA512
b3814c1e016aa68766627377da60072e0e369cf2f0901f7f68f968f0f3bde1c12312fe55d6530492d9a904d5885d0a0bc9daf81615a98c49925fe005f1971277

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\WriteRead.docx

Filesize
13KB

MD5
4dc2772fd65998f9f57c389c86bb6308

SHA1
28f7f074772246abf638d322e5052afe47117695

SHA256
e46a596d22d797a04d12871e0a28e09310eed67a7316151ab6f5e9b13b8dec53

SHA512
684721f1ac31eba91b47b1dfcb0b06fd151aa0e6f8e62d7e5685431d53fa720547c281809adaff723cf16fcd7598719ca694258ee40ff38f104c388e845f6eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\FormatStep.docx

Filesize
14KB

MD5
bbfd43855b6e7fd0753400074158b994

SHA1
0b780ae6abe2c817a2c1461d45627b94dacc7ade

SHA256
3ec37fa7267a9f0794c088ed8f29fd70f881883c3c944883887f2b0491c7dbdc

SHA512
10f990b5fa3cfa750d33a6fbe4623d098dcb5fb55c05405506c0c400a9f872a198035cc76c36efc570bbae6d8d59fb8f2480f3f118c77cfea768bbce28b33640

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\GetClose.doc

Filesize
705KB

MD5
8e61bca3521fb90e3e2b30f1f1d93251

SHA1
bf20b57d127d6118964e317cdfafcbdf8672f9b2

SHA256
3b463bb166c4adfdc7b122318b624810816639364fd53e29e8530ed718ab83f2

SHA512
29a6e436d3e707c8228b368c1ce535b28639e95e375999cb625512154f49cae237cc0e72eb36dc44d7712dd003200a6d7188817dd5c3497c2ba2b8850c164c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\GrantUnblock.pdf

Filesize
765KB

MD5
ed3306adcf3882c11e2f704cd7d0a90a

SHA1
9a1a81b5f279bb929a487969a6f4c450d2f2965d

SHA256
6b81e4b1eb2fe388742afa9e32837deb15411811ade7a91f5c80cba7b0346580

SHA512
621ab9ae45750ab19ad204b50927da6a2c04dff2890423cde88a116a914eb914c0c0f1fae9512fc4bd227c4ca4ab6ac031239067e2e0400f96386b0c4c44419a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OutCompare.xlsx

Filesize
12KB

MD5
c6e635a570c93585d5234692084e1101

SHA1
e65c293071015f3abd15f53e420a17c1b44151bc

SHA256
a8c48da1fd072ee40a472b7d5f9fe9f5c44a1a71490d49649ba6290a8f5dee5a

SHA512
4ea73a8ea9d0e8c5ba128663afc46ab9b98f8f982165159d08117cf62b8932db7147412533bb6d53bcaeb3fc1792c58ba85dbd6c2f4386d10d58a7189c734ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SkipUnpublish.pdf

Filesize
405KB

MD5
62a7bab46cbce53d72710e7ade4b441f

SHA1
7368cfe4bc3c5dcabe1667235113af8130cd88ef

SHA256
f7a9edc7eeaab8579a76ff68cd1dd6ef17c3cbd21394345131b5ba0883323830

SHA512
ced6f8bd4eae2fc0bd50170cd7f57a1f9c429e78e43cdec8b0f10494cba94054cd6f8a68ba15d6928c9e44ecb943ec84f19586e4d353cc5ab78dd83b3b0510f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SplitDisconnect.xlsx

Filesize
11KB

MD5
6b7e91a62061034e779ee0aeadf1cc7d

SHA1
279620a3b39df4e5c0b8b3563945f5c02da4c0c6

SHA256
fc074c296c46634f9fc6edac4cb23829d8654b10f68758a6e67a56cc773a6383

SHA512
17a6857ae7e1a23544659deb3544dbb91aed89e37985d434b18917450a6c95ee87996cf3739e42bd89731f109d9e8aab0d0ea3c6850e7e235e354db11db018e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\OpenBackup.wmv

Filesize
221KB

MD5
a2f7864c44ec4d81161031e5527ac67e

SHA1
dd53bec5ff490d7723d537fda0fb6b22ec8e0dc1

SHA256
c3f52865feb256f44c82840da05139adb8fb09864388b55cc1c42e0efb64ab32

SHA512
0ea72d4bd5249fa3193f9b1fe0e62d33ee9d12ba6ec3c844125ccf17293cb96192bebf5a0c35005cf2b8b3cbf8071a8d1a208924a8a9c1ada57a08eaf478889a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SaveConvertFrom.mp4

Filesize
433KB

MD5
db708d1a8a1c72b3b4a8b2d90fd59bfb

SHA1
8f7b207dd3c18726a158a24b373c9c72c854ec64

SHA256
1539140426a75e3d9912efa74c09f418d4ea8196a17dc2d920bfea4f5104fb65

SHA512
c7aa82637e808e3033739aadcfaa092bae776a314bcc2a93eedd9da404b6114b864c4a310ac2bf21bd4fb6ff72f4d6ffbaabb4779bc5c7d087ad68c34e6a7218

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SaveTrace.xls

Filesize
323KB

MD5
b6d435968420ec883c709dce4d477a12

SHA1
efec18e4ed5462880db6f4fa421d44264d2a09ea

SHA256
aace8a756890bcb7d2fa370cae612619ab74506d801074338125336b9f065994

SHA512
471152e575841b588a7425ab609c1218c01be319840d146b8b22ec98d46d248bd716006b587966cf78dddc4e77cc461928bd1250405e415c13a1d4b693e9d8ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UseClear.mp3

Filesize
306KB

MD5
bb613bd69735d3e06c4913dc10a623ac

SHA1
31fd8e2a2bf8865f5d4ac97b6b973cf16ba1a9ea

SHA256
20df8072e6a065a7a82e8152c5da09deb6b452d8ebe87e179f32baa6b0966d10

SHA512
10262fa9d112d69b2dc3a1c0db12c3ed53bcda9aecba0f401de15b3bb2bf8a77310066d1deee3c5e7a96b09e10b7645695a6c11f8acf6e98e2e56a49a36db14e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\EnterAdd.png

Filesize
919KB

MD5
5852850592fb39f5cbe352ea70ce11e0

SHA1
ad7baba693256422f5f52dea5eecef00192ebac8

SHA256
f2183c0b2948161a61b56100f9a822b393517f0e3c3e2e9bf94b94ccc9547cef

SHA512
1ca27291df2ee8d66ee207f9b7e295d581863d53665feaee567d3b0be686fb605df8f4310d52518abd3a6a73c9e2c9c15299a538cab3ff2bec15027758eafb4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\MountReset.txt

Filesize
537KB

MD5
7562944d441fad8bc8bf1c80bad6c131

SHA1
92aaf44c5ae6e593ea89a9e91ad8b5f44caab68f

SHA256
e15fd421ce43440d963699089d8b1b8f073d038ecf78a5715a396c7854d0a446

SHA512
63d84d3b2a9bedba9d3b2475fbe22033546334da4e683ae4e38990ca56229e97ea795d34dfe02fa7c54e51ef2de3a59cc770a6fda7c336a7e4361354f7a808aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\LockGroup.jpeg

Filesize
521KB

MD5
567cec78d1595857c9c187f72a0ea5c8

SHA1
aa9db90036361a6925e2b50e3ee2212003f562e6

SHA256
e992f6b420a107eacc02caee8b506ab12f36947d1f33cc9ce2949e96261de482

SHA512
fc7911a2e2f2a5a674fb073f435a25ad36088e2cfa3ec5bb8efd2233faebe91f87ea4f2ee52edb40b566c735ba283900b4679416dcb361db17636313f0ac6895

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\OutUnlock.jpeg

Filesize
403KB

MD5
d3ede9f3e7cf77412f40bb3145743117

SHA1
b0b48b6b75b1491abded23fa02d8f980b050cb50

SHA256
dbe529cd973a45c7b1582777b4489526d4d3494dd70dacdbaf01acdbd041fb2e

SHA512
5fe7920fa50ee949d9963615ee8b42d65288770b1effa200b8e4e0fe4a97a36dd6dc3c73e013cdf0468cf9d587bf61a688324c563e19bda9213dde54e9cee87f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\PopEnable.jpg

Filesize
481KB

MD5
51f3a859db66e4db3bf25366491948a9

SHA1
da4d58284ee8f358f3f3d5c7e8e4d67b5dcd4f0a

SHA256
bcf846901168827229ebf1a091cd09c33f77096647052a174465c2aeb18b32a0

SHA512
0024d5cedcd8fbeb440db7ee567ec2337ed6212262f3b2e4b4bc451550b752c2070d51136aab1c76416af3275c2f6ef50111501a0f022ad6e2dcbf15c53b4f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UnblockCheckpoint.jpeg

Filesize
658KB

MD5
50ebf60eefbb2212d55638aae4bee336

SHA1
cfdb8c82013bd574acbc93f4b143ca5adf12f895

SHA256
5510656590dc99477cdacebe9f5ef2269137a495cdd272d8f01a40f52ff283b1

SHA512
269431c6896b67c628fe79d3c0d002baa7f2ca4802accda2a8b8430cd96f0c137cd572fbfe4d79a59d5958abf7edd98a30ee74f54fbd166446d7c0537277d89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UnregisterTrace.jpg

Filesize
363KB

MD5
b7fede4e7b9b407bf301b830bfab64e5

SHA1
bc929fa915be1705eedd51fe73f52fdbd64167f6

SHA256
fbce906749a09b758c60f5f29b71e311c7d190204df2c145f82fe059a762dc59

SHA512
f778f361499efaf62c564629a553c7175d3af36515b43790ab6a3b6624ddbaa1a4e14605bf16a233589c2b318a3596ecef1fd9955f80ead93f061ae0ef578c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\VCRUNTIME140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\_ctypes.pyd

Filesize
58KB

MD5
e0f1b522402434c5ef12402c460b269b

SHA1
72e7b318c3cd399eb07f2e6599e77a1453db8d0e

SHA256
d80424077977302a85c643a8e4c0b6bf950c0a8bd0f6016d1b292dc93b6dbcea

SHA512
4b710dd4c9827393dc971b1fe869dae46c60e7c91518b957d3ce0a134cec3b839e51a25f0a512dca1b10abbc0a0979728c299be4995fabd56037f7d9afa9bc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-console-l1-1-0.dll

Filesize
21KB

MD5
e8b9d74bfd1f6d1cc1d99b24f44da796

SHA1
a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452

SHA256
b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59

SHA512
b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-datetime-l1-1-0.dll

Filesize
21KB

MD5
cfe0c1dfde224ea5fed9bd5ff778a6e0

SHA1
5150e7edd1293e29d2e4d6bb68067374b8a07ce6

SHA256
0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e

SHA512
b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-debug-l1-1-0.dll

Filesize
21KB

MD5
33bbece432f8da57f17bf2e396ebaa58

SHA1
890df2dddfdf3eeccc698312d32407f3e2ec7eb1

SHA256
7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e

SHA512
619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
21KB

MD5
eb0978a9213e7f6fdd63b2967f02d999

SHA1
9833f4134f7ac4766991c918aece900acfbf969f

SHA256
ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e

SHA512
6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-file-l1-1-0.dll

Filesize
25KB

MD5
efad0ee0136532e8e8402770a64c71f9

SHA1
cda3774fe9781400792d8605869f4e6b08153e55

SHA256
3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed

SHA512
69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-handle-l1-1-0.dll

Filesize
21KB

MD5
e89cdcd4d95cda04e4abba8193a5b492

SHA1
5c0aee81f32d7f9ec9f0650239ee58880c9b0337

SHA256
1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238

SHA512
55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-heap-l1-1-0.dll

Filesize
21KB

MD5
accc640d1b06fb8552fe02f823126ff5

SHA1
82ccc763d62660bfa8b8a09e566120d469f6ab67

SHA256
332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f

SHA512
6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
21KB

MD5
c6024cc04201312f7688a021d25b056d

SHA1
48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd

SHA256
8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500

SHA512
d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
21KB

MD5
1f2a00e72bc8fa2bd887bdb651ed6de5

SHA1
04d92e41ce002251cc09c297cf2b38c4263709ea

SHA256
9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142

SHA512
8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-memory-l1-1-0.dll

Filesize
21KB

MD5
3c38aac78b7ce7f94f4916372800e242

SHA1
c793186bcf8fdb55a1b74568102b4e073f6971d6

SHA256
3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d

SHA512
c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
21KB

MD5
321a3ca50e80795018d55a19bf799197

SHA1
df2d3c95fb4cbb298d255d342f204121d9d7ef7f

SHA256
5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f

SHA512
3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
21KB

MD5
0462e22f779295446cd0b63e61142ca5

SHA1
616a325cd5b0971821571b880907ce1b181126ae

SHA256
0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e

SHA512
07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
21KB

MD5
c3632083b312c184cbdd96551fed5519

SHA1
a93e8e0af42a144009727d2decb337f963a9312e

SHA256
be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125

SHA512
8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-profile-l1-1-0.dll

Filesize
21KB

MD5
f3ff2d544f5cd9e66bfb8d170b661673

SHA1
9e18107cfcd89f1bbb7fdaf65234c1dc8e614add

SHA256
e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f

SHA512
184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
21KB

MD5
a0c2dbe0f5e18d1add0d1ba22580893b

SHA1
29624df37151905467a223486500ed75617a1dfd

SHA256
3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f

SHA512
3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-string-l1-1-0.dll

Filesize
21KB

MD5
2666581584ba60d48716420a6080abda

SHA1
c103f0ea32ebbc50f4c494bce7595f2b721cb5ad

SHA256
27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328

SHA512
befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-synch-l1-1-0.dll

Filesize
21KB

MD5
225d9f80f669ce452ca35e47af94893f

SHA1
37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50

SHA256
61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232

SHA512
2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-synch-l1-2-0.dll

Filesize
21KB

MD5
1281e9d1750431d2fe3b480a8175d45c

SHA1
bc982d1c750b88dcb4410739e057a86ff02d07ef

SHA256
433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa

SHA512
a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
21KB

MD5
fd46c3f6361e79b8616f56b22d935a53

SHA1
107f488ad966633579d8ec5eb1919541f07532ce

SHA256
0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df

SHA512
3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\api-ms-win-core-util-l1-1-0.dll

Filesize
21KB

MD5
0f129611a4f1e7752f3671c9aa6ea736

SHA1
40c07a94045b17dae8a02c1d2b49301fad231152

SHA256
2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f

SHA512
6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\base_library.zip

Filesize
1.4MB

MD5
bf6cd99ec3d2a7bc939a8f3d14121641

SHA1
ca8eafb77077e23fb23a45784ea17b19e93c99bc

SHA256
01be805110393abf9f1c57084dc026cdbc7135a4081f604579e3bf8f1dd23bd5

SHA512
e74f6dfbb0d7b56d4201339cca3896bef9af652e1cd031207a683b490433f1de82d0557d5d551db4c656d5f503639d16fb27cda30dff21b1399bd8bd339d3ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\libffi-8.dll

Filesize
29KB

MD5
0d1c6b92d091cef3142e32ac4e0cc12e

SHA1
440dad5af38035cb0984a973e1f266deff2bd7fc

SHA256
11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6

SHA512
5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\python3.dll

Filesize
65KB

MD5
0e105f62fdd1ff4157560fe38512220b

SHA1
99bd69a94b3dc99fe2c0f7bbbcd05aa0bc8cd45c

SHA256
803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423

SHA512
59c0f749ed9c59efdbcd04265b4985b1175fdd825e5a307745531ed2537397e739bc9290fdc3936cfd04f566e28bb76b878f124248b8344cf74f641c6b1101de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\python311.dll

Filesize
1.6MB

MD5
c3de98791123bb12b315e2b4ce408d3b

SHA1
95c36944c9a4e8bb05a32e882835cac9c030c053

SHA256
98a51eca014369411df0980acbc16207d0de76c8adcd67fc27e1aa5e2f7731bb

SHA512
91651c0d5a1f55d296791aedb1594fe6b546dd16b7801af1ffa580486c99421f156ac86ccd5e22eacb7ad93fe8d3d909d50c9cc013e2618a29db8bf22183f9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI34842\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_12uxa4y0.aix.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Exela.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 523038.crdownload

Filesize
12.0MB

MD5
1ea2f6c34caf15d09e9914a4bd67edef

SHA1
4e593b86350b97a9343a313d8ebe986ce638e232

SHA256
5bb2fe5cd9f13d72a8a8dcf77609e483a296adb63fc9cea74b7025f18af8703e

SHA512
a537445ee6beb607e27920b072aaa4a7f02d6d22896ee8c979b1da9728db913b7dddc4237611507dd62a075491965296ea8db5143c3ce9607830aebee223c70e

Download Submit
memory/1892-471-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp

Filesize
5.9MB

Download
memory/1892-345-0x00007FF8CFE10000-0x00007FF8CFE22000-memory.dmp

Filesize
72KB

Download
memory/1892-359-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp

Filesize
820KB

Download
memory/1892-358-0x00007FF8C70B0000-0x00007FF8C70E2000-memory.dmp

Filesize
200KB

Download
memory/1892-357-0x00007FF8C7110000-0x00007FF8C7121000-memory.dmp

Filesize
68KB

Download
memory/1892-361-0x00007FF8C7130000-0x00007FF8C717D000-memory.dmp

Filesize
308KB

Download
memory/1892-362-0x00007FF8C7090000-0x00007FF8C70AE000-memory.dmp

Filesize
120KB

Download
memory/1892-360-0x00007FF8BF2D0000-0x00007FF8BF7F0000-memory.dmp

Filesize
5.1MB

Download
memory/1892-363-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp

Filesize
84KB

Download
memory/1892-356-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp

Filesize
100KB

Download
memory/1892-364-0x00007FF8BE9B0000-0x00007FF8BF1AB000-memory.dmp

Filesize
8.0MB

Download
memory/1892-365-0x00007FF8C0590000-0x00007FF8C05C7000-memory.dmp

Filesize
220KB

Download
memory/1892-441-0x00007FF8BF1B0000-0x00007FF8BF2CC000-memory.dmp

Filesize
1.1MB

Download
memory/1892-442-0x00007FF8DC250000-0x00007FF8DC25D000-memory.dmp

Filesize
52KB

Download
memory/1892-440-0x00007FF8C8310000-0x00007FF8C8332000-memory.dmp

Filesize
136KB

Download
memory/1892-354-0x00007FF8D2A30000-0x00007FF8D2A63000-memory.dmp

Filesize
204KB

Download
memory/1892-733-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp

Filesize
84KB

Download
memory/1892-458-0x00007FF8C82F0000-0x00007FF8C830B000-memory.dmp

Filesize
108KB

Download
memory/1892-460-0x00007FF8C70B0000-0x00007FF8C70E2000-memory.dmp

Filesize
200KB

Download
memory/1892-459-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp

Filesize
100KB

Download
memory/1892-461-0x00007FF8C7130000-0x00007FF8C717D000-memory.dmp

Filesize
308KB

Download
memory/1892-495-0x00007FF8BE9B0000-0x00007FF8BF1AB000-memory.dmp

Filesize
8.0MB

Download
memory/1892-496-0x00007FF8C0590000-0x00007FF8C05C7000-memory.dmp

Filesize
220KB

Download
memory/1892-490-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp

Filesize
100KB

Download
memory/1892-484-0x00007FF8CFE10000-0x00007FF8CFE22000-memory.dmp

Filesize
72KB

Download
memory/1892-483-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp

Filesize
84KB

Download
memory/1892-481-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp

Filesize
820KB

Download
memory/1892-480-0x00007FF8D2A30000-0x00007FF8D2A63000-memory.dmp

Filesize
204KB

Download
memory/1892-479-0x00007FF8BF7F0000-0x00007FF8BF967000-memory.dmp

Filesize
1.5MB

Download
memory/1892-472-0x00007FF8DAC60000-0x00007FF8DAC83000-memory.dmp

Filesize
140KB

Download
memory/1892-333-0x00007FF8DA150000-0x00007FF8DA169000-memory.dmp

Filesize
100KB

Download
memory/1892-482-0x00007FF8BF2D0000-0x00007FF8BF7F0000-memory.dmp

Filesize
5.1MB

Download
memory/1892-351-0x00007FF8BF1B0000-0x00007FF8BF2CC000-memory.dmp

Filesize
1.1MB

Download
memory/1892-352-0x00007FF8BF7F0000-0x00007FF8BF967000-memory.dmp

Filesize
1.5MB

Download
memory/1892-353-0x00007FF8C82F0000-0x00007FF8C830B000-memory.dmp

Filesize
108KB

Download
memory/1892-350-0x00007FF8D2A70000-0x00007FF8D2A93000-memory.dmp

Filesize
140KB

Download
memory/1892-349-0x00007FF8C8310000-0x00007FF8C8332000-memory.dmp

Filesize
136KB

Download
memory/1892-348-0x00007FF8D2D40000-0x00007FF8D2D6D000-memory.dmp

Filesize
180KB

Download
memory/1892-346-0x00007FF8CFDF0000-0x00007FF8CFE04000-memory.dmp

Filesize
80KB

Download
memory/1892-332-0x00007FF8DA170000-0x00007FF8DA17D000-memory.dmp

Filesize
52KB

Download
memory/1892-347-0x00007FF8C8340000-0x00007FF8C8354000-memory.dmp

Filesize
80KB

Download
memory/1892-344-0x00007FF8DAC30000-0x00007FF8DAC49000-memory.dmp

Filesize
100KB

Download
memory/1892-331-0x00007FF8DAC30000-0x00007FF8DAC49000-memory.dmp

Filesize
100KB

Download
memory/1892-355-0x0000021FA1570000-0x0000021FA1A90000-memory.dmp

Filesize
5.1MB

Download
memory/1892-342-0x00007FF8DAC60000-0x00007FF8DAC83000-memory.dmp

Filesize
140KB

Download
memory/1892-343-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp

Filesize
84KB

Download
memory/1892-341-0x0000021FA1570000-0x0000021FA1A90000-memory.dmp

Filesize
5.1MB

Download
memory/1892-340-0x00007FF8BF2D0000-0x00007FF8BF7F0000-memory.dmp

Filesize
5.1MB

Download
memory/1892-303-0x00007FF8DAC60000-0x00007FF8DAC83000-memory.dmp

Filesize
140KB

Download
memory/1892-338-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp

Filesize
5.9MB

Download
memory/1892-339-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp

Filesize
820KB

Download
memory/1892-295-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp

Filesize
5.9MB

Download
memory/1892-337-0x00007FF8D2A30000-0x00007FF8D2A63000-memory.dmp

Filesize
204KB

Download
memory/1892-336-0x00007FF8BF7F0000-0x00007FF8BF967000-memory.dmp

Filesize
1.5MB

Download
memory/1892-335-0x00007FF8D2A70000-0x00007FF8D2A93000-memory.dmp

Filesize
140KB

Download
memory/1892-305-0x00007FF8DAC50000-0x00007FF8DAC5F000-memory.dmp

Filesize
60KB

Download
memory/1892-334-0x00007FF8D2D40000-0x00007FF8D2D6D000-memory.dmp

Filesize
180KB

Download
memory/1892-652-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp

Filesize
5.9MB

Download
memory/1892-672-0x00007FF8C7130000-0x00007FF8C717D000-memory.dmp

Filesize
308KB

Download
memory/1892-671-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp

Filesize
100KB

Download
memory/1892-664-0x00007FF8D2FB0000-0x00007FF8D2FC5000-memory.dmp

Filesize
84KB

Download
memory/1892-706-0x00007FF8BF970000-0x00007FF8BFF59000-memory.dmp

Filesize
5.9MB

Download
memory/1892-744-0x00007FF8C7090000-0x00007FF8C70AE000-memory.dmp

Filesize
120KB

Download
memory/1892-743-0x00007FF8D1DE0000-0x00007FF8D1EAD000-memory.dmp

Filesize
820KB

Download
memory/1892-755-0x00007FF8BF2D0000-0x00007FF8BF7F0000-memory.dmp

Filesize
5.1MB

Download
memory/1892-758-0x00007FF8DC250000-0x00007FF8DC25D000-memory.dmp

Filesize
52KB

Download
memory/1892-757-0x00007FF8C0590000-0x00007FF8C05C7000-memory.dmp

Filesize
220KB

Download
memory/1892-756-0x00007FF8BE9B0000-0x00007FF8BF1AB000-memory.dmp

Filesize
8.0MB

Download
memory/1892-754-0x00007FF8C70B0000-0x00007FF8C70E2000-memory.dmp

Filesize
200KB

Download
memory/1892-753-0x00007FF8C7110000-0x00007FF8C7121000-memory.dmp

Filesize
68KB

Download
memory/1892-752-0x00007FF8C7180000-0x00007FF8C7199000-memory.dmp

Filesize
100KB

Download
memory/1892-751-0x00007FF8BF1B0000-0x00007FF8BF2CC000-memory.dmp

Filesize
1.1MB

Download
memory/1892-750-0x00007FF8C82F0000-0x00007FF8C830B000-memory.dmp

Filesize
108KB

Download
memory/1892-749-0x00007FF8C8310000-0x00007FF8C8332000-memory.dmp

Filesize
136KB

Download
memory/1892-748-0x00007FF8C7130000-0x00007FF8C717D000-memory.dmp

Filesize
308KB

Download
memory/1892-747-0x00007FF8CFDF0000-0x00007FF8CFE04000-memory.dmp

Filesize
80KB

Download
memory/1892-746-0x00007FF8CFE10000-0x00007FF8CFE22000-memory.dmp

Filesize
72KB

Download
memory/1892-745-0x00007FF8C8340000-0x00007FF8C8354000-memory.dmp

Filesize
80KB

Download
memory/1892-742-0x00007FF8D2A30000-0x00007FF8D2A63000-memory.dmp

Filesize
204KB

Download
memory/1892-741-0x00007FF8BF7F0000-0x00007FF8BF967000-memory.dmp

Filesize
1.5MB

Download
memory/1892-740-0x00007FF8D2A70000-0x00007FF8D2A93000-memory.dmp

Filesize
140KB

Download
memory/1892-739-0x00007FF8D2D40000-0x00007FF8D2D6D000-memory.dmp

Filesize
180KB

Download
memory/1892-738-0x00007FF8DA150000-0x00007FF8DA169000-memory.dmp

Filesize
100KB

Download
memory/1892-737-0x00007FF8DA170000-0x00007FF8DA17D000-memory.dmp

Filesize
52KB

Download
memory/1892-736-0x00007FF8DAC30000-0x00007FF8DAC49000-memory.dmp

Filesize
100KB

Download
memory/1892-735-0x00007FF8DAC50000-0x00007FF8DAC5F000-memory.dmp

Filesize
60KB

Download
memory/1892-734-0x00007FF8DAC60000-0x00007FF8DAC83000-memory.dmp

Filesize
140KB

Download
memory/3408-443-0x00000272F5AD0000-0x00000272F5AF2000-memory.dmp

Filesize
136KB

Download