File name:

Exela.exe

Full analysis: https://app.any.run/tasks/80a2ace9-a768-485d-84b3-25c192db0906
Verdict: Malicious activity
Threats:

Exela Stealer is an infostealer malware written in Python. It is capable of collecting a wide range of sensitive information from compromised systems and exfiltrating it to attackers over Discord. It is frequently used to steal browser data, and obtain session files from various applications, including gaming platforms, social media platforms, and messaging apps.

Malware Trends Tracker     >>>
Analysis date: September 20, 2024, 19:42:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
exela
stealer
pyinstaller
susp-powershell
ims-api
generic
discord
growtopia
discordgrabber
upx
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

57A2DC05065B6C5BD7A16287574B44DD

SHA1:

D0D6EA49375492259A5C7B00E1D52B37D9DCD704

SHA256:

548B6D77905BFB2217782A2EA99E8E55DC2DEDDB94AF1C43E79A33161328DB26

SSDEEP:

98304:t6CRRm8ziKqhBYukWPK8YutPrCpEJg4ESq/NCz0kKBWGJMDV+ly+/9F8BZ6GHgBP:PwaX44a1I8aqVjF6v/2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Exela.exe (PID: 3376)

    • Starts NET.EXE to view/add/change user profiles

      • net.exe (PID: 5532)
      • net.exe (PID: 1644)
      • net.exe (PID: 6252)
      • cmd.exe (PID: 3352)

    • Starts NET.EXE to view/change users localgroup

      • net.exe (PID: 5540)
      • cmd.exe (PID: 3352)
      • net.exe (PID: 2608)

    • ExelaStealer has been detected

      • Exela.exe (PID: 3376)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6804)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6632)

    • DISCORDGRABBER has been detected (YARA)

      • Exela.exe (PID: 3376)

    • GROWTOPIA has been detected (YARA)

      • Exela.exe (PID: 3376)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • Exela.exe (PID: 6616)
      • Exela.exe (PID: 3376)

    • Process drops legitimate windows executable

      • Exela.exe (PID: 6616)

    • Process drops python dynamic module

      • Exela.exe (PID: 6616)

    • Executable content was dropped or overwritten

      • Exela.exe (PID: 6616)
      • csc.exe (PID: 2576)

    • Application launched itself

      • Exela.exe (PID: 6616)
      • cmd.exe (PID: 1236)
      • cmd.exe (PID: 6528)

    • Loads Python modules

      • Exela.exe (PID: 3376)

    • Starts CMD.EXE for commands execution

      • Exela.exe (PID: 3376)
      • cmd.exe (PID: 6528)
      • cmd.exe (PID: 1236)

    • Get information on the list of running processes

      • Exela.exe (PID: 3376)
      • cmd.exe (PID: 888)
      • cmd.exe (PID: 1448)
      • cmd.exe (PID: 2580)
      • cmd.exe (PID: 3352)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 4128)
      • cmd.exe (PID: 5180)
      • cmd.exe (PID: 644)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7056)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 2932)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6108)
      • cmd.exe (PID: 6632)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2268)

    • Uses WMIC.EXE to obtain local storage devices information

      • cmd.exe (PID: 3352)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 3352)

    • Uses QUSER.EXE to read information about current user sessions

      • query.exe (PID: 2804)

    • Uses WMIC.EXE to obtain commands that are run when users log in

      • cmd.exe (PID: 3352)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 2892)

    • Process uses ARP to discover network configuration

      • cmd.exe (PID: 3352)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3352)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 3352)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6632)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 6632)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6632)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 3352)

    • Uses ROUTE.EXE to obtain the routing table information

      • cmd.exe (PID: 3352)

    • Checks for external IP

      • Exela.exe (PID: 3376)
      • svchost.exe (PID: 2256)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Exela.exe (PID: 3376)

  • INFO

    • Checks supported languages

      • Exela.exe (PID: 6616)
      • Exela.exe (PID: 3376)
      • chcp.com (PID: 6820)
      • chcp.com (PID: 6900)

    • Create files in a temporary directory

      • Exela.exe (PID: 6616)
      • Exela.exe (PID: 3376)

    • Reads the computer name

      • Exela.exe (PID: 6616)
      • Exela.exe (PID: 3376)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7056)
      • WMIC.exe (PID: 4128)
      • WMIC.exe (PID: 236)

    • Creates files or folders in the user directory

      • Exela.exe (PID: 3376)

    • Changes the display of characters in the console

      • cmd.exe (PID: 2932)
      • cmd.exe (PID: 5376)

    • The Powershell gets current clipboard

      • powershell.exe (PID: 6804)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 5364)

    • Reads the time zone

      • net1.exe (PID: 1568)
      • net1.exe (PID: 6536)

    • Checks operating system version

      • Exela.exe (PID: 3376)

    • PyInstaller has been detected (YARA)

      • Exela.exe (PID: 6616)
      • Exela.exe (PID: 3376)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • Exela.exe (PID: 3376)

    • UPX packer has been detected

      • Exela.exe (PID: 3376)

    • Attempting to use instant messaging service

      • Exela.exe (PID: 3376)
      • svchost.exe (PID: 2256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:09:20 15:48:24+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 172032
InitializedDataSize: 94208
UninitializedDataSize: -
EntryPoint: 0xcdb0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 10.0.19041.746
ProductVersionNumber: 10.0.19041.746
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Exela Services
FileVersion: 10.0.19041.746 (WinBuild.160101.0800)
InternalName: Exela.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: Exela.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.746
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
182
Monitored processes
73
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start THREAT exela.exe #EXELASTEALER exela.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs tasklist.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs mshta.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs chcp.com no specs powershell.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs netsh.exe no specs systeminfo.exe no specs svchost.exe tiworker.exe no specs hostname.exe no specs wmic.exe no specs net.exe no specs net1.exe no specs query.exe no specs quser.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs wmic.exe no specs tasklist.exe no specs ipconfig.exe no specs route.exe no specs arp.exe no specs netstat.exe no specs sc.exe no specs netsh.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236wmic startup get caption,command C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
644attrib +h +s "C:\Users\admin\AppData\Local\ExelaUpdateService\Exela.exe"C:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
644C:\WINDOWS\system32\net1 user C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
644C:\WINDOWS\system32\cmd.exe /c "wmic csproduct get uuid"C:\Windows\System32\cmd.exe—Exela.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
888C:\WINDOWS\system32\cmd.exe /c "tasklist"C:\Windows\System32\cmd.exe—Exela.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
888wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1020\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1236C:\WINDOWS\system32\cmd.exe /c "cmd.exe /c chcp"C:\Windows\System32\cmd.exe—Exela.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1280ipconfig /all C:\Windows\System32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
Total events
23 797
Read events
23 795
Write events
2
Delete events
0

Modification events

(PID) Process:(7004) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31132565
(PID) Process:(7004) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
Executable files
36
Suspicious files
6
Text files
158
Unknown types
14

Dropped files

PID
Process
Filename
Type
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_cffi_backend.cp312-win_amd64.pydexecutable
MD5:27004B1F01511FD6743EE5535DE8F570
SHA256:D2D3E9D9E5855A003E3D8C7502A9814191CF2B77B99BA67777AC170440DFDCCF
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_queue.pydexecutable
MD5:51C7B2CA2871FA9D4A948F2ABD22DE05
SHA256:36EC2EF3F553257912E3E3D17706920C1A52C3619D5C7B157C386C1DBE6E3F52
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_bz2.pydexecutable
MD5:C9F84CBFFF18BF88923802116A013AA0
SHA256:5F33CD309AE6F049A4D8C2B6B2A8CD5ADE5E8886408ED2B81719E686B68B7D13
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_sqlite3.pydexecutable
MD5:337889448ECD97A305A96CF61F1B84B9
SHA256:A35A017EE1C003290F4850B4C3D7140F5F0DF98D2178BF67923A610AEE1679BE
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_lzma.pydexecutable
MD5:96E99C539E2CB0683B148DA367CE4389
SHA256:72A7D452B3A164195B4A09B85A8E33AD4E6B658C10396B1A313E61DA8F814304
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\aiohttp\_http_parser.cp312-win_amd64.pydexecutable
MD5:3B69343E88AFCB2313D7B1FB34990B9D
SHA256:—
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_overlapped.pydexecutable
MD5:A849BFCEF664851201326A739E1DBA41
SHA256:7E23125519F4C79B0651A36DD7820E278C0B124395D7F1FB0BC7DCA78D14834B
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\VCRUNTIME140.dllexecutable
MD5:BE8DBE2DC77EBE7F88F910C61AEC691A
SHA256:4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_ssl.pydexecutable
MD5:4DC99D3CBE1BB4B474D8C1BC70B5B7D0
SHA256:570E29E73FC398C52ABEEBB92654AC321DAD50E625C1230D919D88DA1FD8D8D0
6616Exela.exeC:\Users\admin\AppData\Local\Temp\_MEI66162\_socket.pydexecutable
MD5:0A4BEC3ACC2DB020D129E0E3F2D0CD95
SHA256:3C6BB84D34E46E4FDF1BA192A4B78C4CAF9217F49208147E7C46E654D444F222
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
25
DNS requests
8
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3376
Exela.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
—
—
shared
—
—
POST
200
45.112.123.227:443
https://store1.gofile.io/uploadFile
unknown
binary
439 b
—
—
—
POST
404
162.159.138.232:443
https://discord.com/api/webhooks/1286417780064915477/iSKqnXNsS38Mp3xmzImXOMuFotY4uZqvZoroyArxqZPb-kaPg4Fc2I3cBwbv2FCbCB7L
unknown
binary
45 b
—
—
—
POST
404
162.159.128.233:443
https://discord.com/api/webhooks/1286417780064915477/iSKqnXNsS38Mp3xmzImXOMuFotY4uZqvZoroyArxqZPb-kaPg4Fc2I3cBwbv2FCbCB7L
unknown
binary
45 b
—
—
—
POST
404
162.159.136.232:443
https://discord.com/api/webhooks/1286417780064915477/iSKqnXNsS38Mp3xmzImXOMuFotY4uZqvZoroyArxqZPb-kaPg4Fc2I3cBwbv2FCbCB7L
unknown
binary
45 b
—
—
—
GET
404
51.38.43.18:443
https://api.gofile.io/getServer
unknown
text
14 b
—
—
—
POST
404
162.159.136.232:443
https://discord.com/api/webhooks/1286417780064915477/iSKqnXNsS38Mp3xmzImXOMuFotY4uZqvZoroyArxqZPb-kaPg4Fc2I3cBwbv2FCbCB7L
unknown
binary
45 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
unknown
3888
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
20.189.173.10:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3376
Exela.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3376
Exela.exe
162.159.137.232:443
discord.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
unknown
google.com
  • 142.250.185.142
unknown
www.microsoft.com
  • 184.30.21.171
unknown
ip-api.com
  • 208.95.112.1
unknown
discord.com
  • 162.159.137.232
  • 162.159.135.232
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.138.232
unknown
api.gofile.io
  • 51.38.43.18
  • 45.112.123.126
unknown
store1.gofile.io
  • 45.112.123.227
unknown

Threats

PID
Process
Class
Message
2256
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
3376
Exela.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2256
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
3376
Exela.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
3376
Exela.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
3376
Exela.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2256
svchost.exe
Potentially Bad Traffic
ET INFO Online File Storage Domain in DNS Lookup (gofile .io)
3376
Exela.exe
Misc activity
ET INFO File Sharing Related Domain in TLS SNI (gofile .io)
2256
svchost.exe
Potentially Bad Traffic
ET INFO Online File Storage Domain in DNS Lookup (gofile .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Exela.exe