Malware Analysis Report

2024-11-15 09:53

Sample ID 241109-jrvrzszmbt
Target 8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014
SHA256 8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014
Tags
pyinstaller upx exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014

Threat Level: Known bad

The file 8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014 was found to be: Known bad.

Malicious Activity Summary

pyinstaller upx exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer

Exela Stealer

Exelastealer family

Grants admin privileges

Modifies Windows Firewall

Checks computer location settings

Loads dropped DLL

Clipboard Data

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Network Service Discovery

Looks up external IP address via web service

UPX packed file

Enumerates processes with tasklist

Hide Artifacts: Hidden Files and Directories

Launches sc.exe

Permission Groups Discovery: Local Groups

Browser Information Discovery

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Detects Pyinstaller

Enumerates physical storage devices

Unsigned PE

System Network Connections Discovery

Runs net.exe

Gathers network information

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Collects information from the system

Detects videocard installed

Gathers system information

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Reported

2024-11-09 07:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 07:54

Reported

2024-11-09 07:57

Platform

win7-20240729-en

Max time kernel

21s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe

"C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe"

Network

N/A

Files

memory/2684-4-0x0000000002200000-0x0000000002210000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe

MD5 f2325513cec3a9a2ae5c3613b7c8604a
SHA1 51f54f9a39edada9fab81e630ac62b04f74427b9
SHA256 9f21637ec3141fb9d107cb73af85b5079435b0dc1acb5b0fa989fb03916f87cb
SHA512 ad1985865cb31081c3fbf24c57ce2cfa4b3b31b9db3cfde45e25b252162c25a31dabe464fdcbe96042d6ee3e3508e937bec838f6a8a91cbeddbdd45479afa17c

C:\Users\Admin\AppData\Local\Temp\_MEI22802\python311.dll

MD5 db09c9bbec6134db1766d369c339a0a1
SHA1 c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512 653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

memory/2888-61-0x000007FEF6350000-0x000007FEF6938000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 07:54

Reported

2024-11-09 07:57

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe"

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe" C:\Windows\system32\reg.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2936 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe
PID 2936 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe
PID 728 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe
PID 728 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe
PID 1884 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1912 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1912 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 60 wrote to memory of 2444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 60 wrote to memory of 2444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2720 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2720 wrote to memory of 2404 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1884 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 3984 wrote to memory of 3544 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3984 wrote to memory of 3544 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1884 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 4564 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4564 wrote to memory of 2636 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4084 wrote to memory of 4992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4084 wrote to memory of 4992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1884 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1056 wrote to memory of 1976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1056 wrote to memory of 1976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1884 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 2908 wrote to memory of 2684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2908 wrote to memory of 2684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1884 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 3048 wrote to memory of 1720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3048 wrote to memory of 1720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2168 wrote to memory of 1360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2168 wrote to memory of 1360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 1884 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 1884 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe C:\Windows\system32\cmd.exe
PID 2688 wrote to memory of 4656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2688 wrote to memory of 4656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1028 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1028 wrote to memory of 4320 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4224 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2388 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2388 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe

"C:\Users\Admin\AppData\Local\Temp\8d5a5ce35aa44311752bb0dca781c3618f4ef904a5f603891d0ddbb45a035014.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"

C:\Windows\system32\reg.exe

reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 127.0.0.1:55143 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
N/A 127.0.0.1:55153 tcp
N/A 127.0.0.1:55158 tcp
N/A 127.0.0.1:55163 tcp
N/A 127.0.0.1:55165 tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 162.159.135.232:443 discord.com tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
N/A 127.0.0.1:55418 tcp
N/A 127.0.0.1:55420 tcp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub.exe

MD5 f2325513cec3a9a2ae5c3613b7c8604a
SHA1 51f54f9a39edada9fab81e630ac62b04f74427b9
SHA256 9f21637ec3141fb9d107cb73af85b5079435b0dc1acb5b0fa989fb03916f87cb
SHA512 ad1985865cb31081c3fbf24c57ce2cfa4b3b31b9db3cfde45e25b252162c25a31dabe464fdcbe96042d6ee3e3508e937bec838f6a8a91cbeddbdd45479afa17c

C:\Users\Admin\AppData\Local\Temp\_MEI7282\python311.dll

MD5 db09c9bbec6134db1766d369c339a0a1
SHA1 c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256 b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512 653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

C:\Users\Admin\AppData\Local\Temp\_MEI7282\python3.DLL

MD5 34e49bb1dfddf6037f0001d9aefe7d61
SHA1 a25a39dca11cdc195c9ecd49e95657a3e4fe3215
SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
SHA512 edb715654baaf499cf788bcacd5657adcf9f20b37b02671abe71bda334629344415ed3a7e95cb51164e66a7aa3ed4bf84acb05649ccd55e3f64036f3178b7856

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_ctypes.pyd

MD5 b4c41a4a46e1d08206c109ce547480c7
SHA1 9588387007a49ec2304160f27376aedca5bc854d
SHA256 9925ab71a4d74ce0ccc036034d422782395dd496472bd2d7b6d617f4d6ddc1f9
SHA512 30debb8e766b430a57f3f6649eeb04eb0aad75ab50423252585db7e28a974d629eb81844a05f5cb94c1702308d3feda7a7a99cb37458e2acb8e87efc486a1d33

C:\Users\Admin\AppData\Local\Temp\_MEI7282\base_library.zip

MD5 2a138e2ee499d3ba2fc4afaef93b7caa
SHA1 508c733341845e94fce7c24b901fc683108df2a8
SHA256 130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c
SHA512 1f61a0fda5676e8ed8d10dfee78267f6d785f9c131f5caf2dd984e18ca9e5866b7658ab7edb2ffd74920a40ffea5cd55c0419f5e9ee57a043105e729e10d820b

memory/1884-65-0x00007FFD645D0000-0x00007FFD64BB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\VCRUNTIME140.dll

MD5 f12681a472b9dd04a812e16096514974
SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

memory/1884-73-0x00007FFD652E0000-0x00007FFD65304000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_uuid.pyd

MD5 3377ae26c2987cfee095dff160f2c86c
SHA1 0ca6aa60618950e6d91a7dea530a65a1cdf16625
SHA256 9534cb9c997a17f0004fb70116e0141bdd516373b37bbd526d91ad080daa3a2b
SHA512 8e408b84e2130ff48b8004154d1bdf6a08109d0b40f9fafb6f55e9f215e418e05dca819f411c802792a9d9936a55d6b90460121583e5568579a0fda6935852ee

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_socket.pyd

MD5 04e7eb0b6861495233247ac5bb33a89a
SHA1 c4d43474e0b378a00845cca044f68e224455612a
SHA256 7efe25284a4663df9458603bf0988b0f47c7dcf56119e3e853e6bda80831a383
SHA512 d4ea0484363edf284ac08a1c3356cc3112d410dd80fe5010c1777acf88dbd830e9f668b593e252033d657a3431a79f7b68d09eb071d0c2ceb51632dbe9b8ed97

C:\Users\Admin\AppData\Local\Temp\_MEI7282\select.pyd

MD5 c39459806c712b3b3242f8376218c1e1
SHA1 85d254fb6cc5d6ed20a04026bff1158c8fd0a530
SHA256 7cbd4339285d145b422afa280cee685258bc659806be9cf8b334805bc45b29c9
SHA512 b727c6d1cd451d658e174161135d3be48d7efda21c775b8145bc527a54d6592bfc50919276c6498d2e2233ac1524c1699f59f0f467cc6e43e5b5e9558c87f49d

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_sqlite3.pyd

MD5 d9eeeeacc3a586cf2dbf6df366f6029e
SHA1 4ff9fb2842a13e9371ce7894ec4fe331b6af9219
SHA256 67649e1e8acd348834efb2c927ab6a7599cf76b2c0c0a50b137b3be89c482e29
SHA512 0b9f1d80fb92c796682dba94a75fbce0e4fbeaedccd50e21d42d4b9366463a830109a8cd4300aa62b41910655f8ca96ecc609ea8a1b84236250b6fd08c965830

C:\Users\Admin\AppData\Local\Temp\_MEI7282\sqlite3.dll

MD5 895f001ae969364432372329caf08b6a
SHA1 4567fc6672501648b277fe83e6b468a7a2155ddf
SHA256 f5dd29e1e99cf8967f7f81487dc624714dcbec79c1630f929d5507fc95cbfad7
SHA512 05b4559d283ea84174da72a6c11b8b93b1586b4e7d8cda8d745c814f8f6dff566e75f9d7890f32bd9dfe43485244973860f83f96ba39296e28127c9396453261

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_lzma.pyd

MD5 bfca96ed7647b31dd2919bedebb856b8
SHA1 7d802d5788784f8b6bfbb8be491c1f06600737ac
SHA256 032b1a139adcff84426b6e156f9987b501ad42ecfb18170b10fb54da0157392e
SHA512 3a2926b79c90c3153c88046d316a081c8ddfb181d5f7c849ea6ae55cb13c6adba3a0434f800c4a30017d2fbab79d459432a2e88487914b54a897c4301c778551

C:\Users\Admin\AppData\Local\Temp\_MEI7282\libssl-1_1.dll

MD5 6cd33578bc5629930329ca3303f0fae1
SHA1 f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512 c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

C:\Users\Admin\AppData\Local\Temp\_MEI7282\libcrypto-1_1.dll

MD5 86cfc84f8407ab1be6cc64a9702882ef
SHA1 86f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512 b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

memory/1884-111-0x00007FFD644B0000-0x00007FFD64568000-memory.dmp

memory/1884-113-0x000001FF9CA30000-0x000001FF9CDA5000-memory.dmp

memory/1884-118-0x00007FFD72470000-0x00007FFD72482000-memory.dmp

memory/1884-117-0x00007FFD72490000-0x00007FFD724A5000-memory.dmp

memory/1884-116-0x00007FFD65A50000-0x00007FFD65A69000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_overlapped.pyd

MD5 97a40f53a81c39469cc7c8dd00f51b5d
SHA1 6c3916fe42e7977d8a6b53bfbc5a579abcf22a83
SHA256 11879a429c996fee8be891af2bec7d00f966593f1e01ca0a60bd2005feb4176f
SHA512 02af654ab73b6c8bf15a81c0e9071c8faf064c529b1439a2ab476e1026c860cf7d01472945112d4583e5da8e4c57f1df2700331440be80066dbb6a7e89e1c5af

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_asyncio.pyd

MD5 1b8ce772a230a5da8cbdccd8914080a5
SHA1 40d4faf1308d1af6ef9f3856a4f743046fd0ead5
SHA256 fa5a1e7031de5849ab2ab5a177e366b41e1df6bbd90c8d2418033a01c740771f
SHA512 d2fc21b9f58b57065b337c3513e7e6c3e2243b73c5a230e81c91dafcb6724b521ad766667848ba8d0a428d530691ffc4020de6ce9ce1eaa2bf5e15338114a603

memory/1884-112-0x00007FFD638E0000-0x00007FFD63C55000-memory.dmp

memory/1884-110-0x00007FFD64570000-0x00007FFD6459E000-memory.dmp

memory/1884-109-0x00007FFD63C60000-0x00007FFD63DD3000-memory.dmp

memory/1884-108-0x00007FFD645A0000-0x00007FFD645C3000-memory.dmp

memory/1884-107-0x00007FFD652B0000-0x00007FFD652DD000-memory.dmp

memory/1884-106-0x00007FFD65590000-0x00007FFD655A9000-memory.dmp

memory/1884-105-0x00007FFD78C20000-0x00007FFD78C2D000-memory.dmp

memory/1884-104-0x00007FFD7AD90000-0x00007FFD7AD9F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_ssl.pyd

MD5 fd0f4aed22736098dc146936cbf0ad1d
SHA1 e520def83b8efdbca9dd4b384a15880b036ee0cf
SHA256 50404a6a3de89497e9a1a03ff3df65c6028125586dced1a006d2abb9009a9892
SHA512 c8f3c04d87da19041f28e1d474c8eb052fe8c03ffd88f0681ef4a2ffe29755cfd5b9c100a1b1d2fdb233cb0f70e367af500cbd3cd4ce77475f441f2b2aa0ab8a

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_bz2.pyd

MD5 80c69a1d87f0c82d6c4268e5a8213b78
SHA1 bae059da91d48eaac4f1bb45ca6feee2c89a2c06
SHA256 307359f1b2552b60839385eb63d74cbfe75cd5efdb4e7cd0bb7d296fa67d8a87
SHA512 542cf4ba19dd6a91690340779873e0cb8864b28159f55917f98a192ff9c449aba2d617e9b2b3932ddfeee13021706577ab164e5394e0513fe4087af6bc39d40d

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_queue.pyd

MD5 0614691624f99748ef1d971419bdb80d
SHA1 39c52450ed7e31e935b5b0e49d03330f2057747d
SHA256 ac7972502144e9e01e53001e8eec3fc9ab063564678b784d024da2036ba7384d
SHA512 184bc172c7bb8a1fb55c4c23950cbe5e0b5a3c96c1c555ed8476edf79c5c729ed297112ee01b45d771e5c0055d2dc402b566967d1900b5abf683ee8e668c5b26

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_multiprocessing.pyd

MD5 849b4203c5f9092db9022732d8247c97
SHA1 ed7bd0d6dcdcfa07f754b98acf44a7cfe5dcb353
SHA256 45bfbab1d2373cf7a8af19e5887579b8a306b3ad0c4f57e8f666339177f1f807
SHA512 cc618b4fc918b423e5dbdcbc45206653133df16bf2125fd53bafef8f7850d2403564cf80f8a5d4abb4a8928ff1262f80f23c633ea109a18556d1871aff81cd39

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_hashlib.pyd

MD5 0629bdb5ff24ce5e88a2ddcede608aee
SHA1 47323370992b80dafb6f210b0d0229665b063afb
SHA256 f404bb8371618bbd782201f092a3bcd7a96d3c143787ebea1d8d86ded1f4b3b8
SHA512 3faeff1a19893257c17571b89963af37534c189421585ea03dd6a3017d28803e9d08b0e4daceee01ffeda21da60e68d10083fe7dbdbbde313a6b489a40e70952

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_decimal.pyd

MD5 e9501519a447b13dcca19e09140c9e84
SHA1 472b1aa072454d065dfe415a05036ffd8804c181
SHA256 6b5fe2dea13b84e40b0278d1702aa29e9e2091f9dc09b64bbff5fd419a604c3c
SHA512 ef481e0e4f9b277642652cd090634e1c04702df789e2267a87205e0fe12b00f1de6cdd4fafb51da01efa726606c0b57fcb2ea373533c772983fc4777dc0acc63

C:\Users\Admin\AppData\Local\Temp\_MEI7282\_cffi_backend.cp311-win_amd64.pyd

MD5 0f0f1c4e1d043f212b00473a81c012a3
SHA1 ff9ff3c257dceefc74551e4e2bacde0faaef5aec
SHA256 fda255664cbf627cb6a9cd327daf4e3eb06f4f0707ed2615e86e2e99b422ad0b
SHA512 fcfa42f417e319bddf721f298587d1b26e6974e5d7589dfe6ddd2b013bc554a53db3725741fbc4941f34079ed8cb96f05934f3c2b933cda6a7e19cda315591a7

C:\Users\Admin\AppData\Local\Temp\_MEI7282\unicodedata.pyd

MD5 06a5e52caf03426218f0c08fc02cc6b8
SHA1 ae232c63620546716fbb97452d73948ebfd06b35
SHA256 118c31faa930f2849a14c3133df36420a5832114df90d77b09cde0ad5f96f33a
SHA512 546b1a01f36d3689b0fdeeda8b1ce55e7d3451731ca70fffe6627d542fff19d7a70e27147cab1920aae8bed88272342908d4e9d671d7aba74abb5db398b90718

C:\Users\Admin\AppData\Local\Temp\_MEI7282\pyexpat.pyd

MD5 fe0e32bfe3764ed5321454e1a01c81ec
SHA1 7690690df0a73bdcc54f0f04b674fc8a9a8f45fb
SHA256 b399bff10812e9ea2c9800f74cb0e5002f9d9379baf1a3cef9d438caca35dc92
SHA512 d1777f9e684a9e4174e18651e6d921ae11757ecdbeb4ee678c6a28e0903a4b9ab9f6e1419670b4d428ee20f86c7d424177ed9daf4365cf2ee376fcd065c1c92d

C:\Users\Admin\AppData\Local\Temp\_MEI7282\libffi-8.dll

MD5 decbba3add4c2246928ab385fb16a21e
SHA1 5f019eff11de3122ffa67a06d52d446a3448b75e
SHA256 4b43c1e42f6050ddb8e184c8ec4fb1de4a6001e068ece8e6ad47de0cc9fd4a2d
SHA512 760a42a3eb3ca13fa7b95d3bd0f411c270594ae3cf1d3cda349fa4f8b06ebe548b60cd438d68e2da37de0bc6f1c711823f5e917da02ed7047a45779ee08d7012

C:\Users\Admin\AppData\Local\Temp\_MEI7282\multidict\_multidict.cp311-win_amd64.pyd

MD5 5587c32d9bf7f76e1a9565df8b1b649f
SHA1 52ae204a65c15a09ecc73e7031e3ac5c3dcb71b2
SHA256 7075185db068e3c8f1b7db75e5aa5c500fc76ed8270c6abc6f49681d7119a782
SHA512 f21d0530389138457d6fdcdb3487a3c8b030338c569b2742f9e691e43af1d9e779c98426bad81b152f343b324a9375fe1322ef74030b1c8f8ba606d19e562e97

memory/1884-121-0x00007FFD64490000-0x00007FFD644A4000-memory.dmp

memory/1884-123-0x00007FFD64470000-0x00007FFD64484000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\yarl\_quoting_c.cp311-win_amd64.pyd

MD5 1fa0ad3deb7f851a231c1a973b121b93
SHA1 65ae7bb5fec98da8665c70290c40082c8358b688
SHA256 0054d20391ebcd1ed30ef2d5aaa1efbbc5aceb7d8f716c16de0ac0d9d2680121
SHA512 64b6cf9d90daca0fb5e2d0eb91c853edaa2fb90edea064b96032ce968ee46961464772e353bf503e05b05471330c5afc8ffc72273e6ebdb6b1ad22fbce331fbf

memory/1884-126-0x00007FFD64440000-0x00007FFD64462000-memory.dmp

memory/1884-128-0x00007FFD637C0000-0x00007FFD638DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\propcache\_helpers_c.cp311-win_amd64.pyd

MD5 16d88c0afeecf94b78f1497b1072b0fe
SHA1 d710adfd375d7ffda0fa4986ba48a13708a7ca91
SHA256 a6d81bfe53de077332b82094d20b04d57efcaa0c58c7b6eb6240fd0626d35409
SHA512 fa6e392c7b9c1c8907b7646fac518e908d9bfbcc65ea3464f531ff5af39e3e8cfb314e3d13ed4041ffda692b364c2f7d5617aaf9867bbeeff1e08d286a5ae2ae

memory/1884-132-0x00007FFD63E20000-0x00007FFD63E3B000-memory.dmp

memory/1884-131-0x00007FFD645D0000-0x00007FFD64BB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\aiohttp\_helpers.cp311-win_amd64.pyd

MD5 6329786659cdb8b94266f7f602e093ca
SHA1 26b3462eef66b2b447b7f25aa731e0d8b0ef6d0b
SHA256 219f86dcf68ee6e197eaa004db824db672bfd7a4334b48c916b4ec05f6ebcf4d
SHA512 aa62673e136b896edc2fcd1bc39f066ae2443e760a68797e60487dbd5625b3a54b2ed3f2982b2cd601f3a24ca29ac090304c488df2df105241a7da3973bdc2ca

memory/1884-135-0x00007FFD637A0000-0x00007FFD637B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\aiohttp\_http_writer.cp311-win_amd64.pyd

MD5 69c4149247d7fb6958a1a38efdcedc63
SHA1 d530e7da9910bca8b78a5fd1fc1dffc0e8bf5752
SHA256 ecae08a8ed98388a987bc36ad231e4e63d21e9ccb59376bc46cc22ea769f5e99
SHA512 2678d369a83a786b6adcacf3beebce723b9c7cf81823fd6a5e6931773b1b1b0c2b56f7a0f2c80ac2b96d38fa7496049a584f81a61260ae97095abf1ce98dff29

memory/1884-138-0x00007FFD652E0000-0x00007FFD65304000-memory.dmp

memory/1884-154-0x00007FFD636F0000-0x00007FFD6370E000-memory.dmp

memory/1884-153-0x00007FFD72490000-0x00007FFD724A5000-memory.dmp

memory/1884-152-0x00007FFD75960000-0x00007FFD7596A000-memory.dmp

memory/1884-151-0x00007FFD63730000-0x00007FFD6377D000-memory.dmp

memory/1884-150-0x00007FFD638E0000-0x00007FFD63C55000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\frozenlist\_frozenlist.cp311-win_amd64.pyd

MD5 4958b93afcea376c56d67eb2d70645bc
SHA1 a5b31435c2925b585a14666cb23682bcba38a576
SHA256 bfeb41b7d1aeae29992a44dc992fd7c752b87b0f87d67cf452eba15e85341cbe
SHA512 be32abe68cef6c8e396de42f2b5adaff4373172b5b980e1bfff0944330f1bfad92b58cf00997f072da129522cd14b54d48b8a39dba1d3e0798ad863d7ba32a39

memory/1884-148-0x00007FFD644B0000-0x00007FFD64568000-memory.dmp

memory/1884-147-0x00007FFD64570000-0x00007FFD6459E000-memory.dmp

memory/1884-145-0x00007FFD63710000-0x00007FFD63721000-memory.dmp

memory/1884-144-0x00007FFD63780000-0x00007FFD63799000-memory.dmp

memory/1884-143-0x000001FF9CA30000-0x000001FF9CDA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7282\aiohttp\_websocket.cp311-win_amd64.pyd

MD5 86a658eb19727b88129c283fd6fcc33c
SHA1 e64da6c74518e96186a428d5f19e376710a7f7a4
SHA256 1c331eba1fb262ae878124456291c38a7bf342c1bec107e06fdc7a704f6ce937
SHA512 ee23ef0dd8fb9ca02d16923da2b0d2175975322afdf35274f7fb8350baa6c8ec044d24f371ad147336e8948a19e10a93b8b8edc8ca2f6f99e330e502e7200c95

C:\Users\Admin\AppData\Local\Temp\_MEI7282\aiohttp\_http_parser.cp311-win_amd64.pyd

MD5 c2020c40f438f0cc39b2017758a1b7b4
SHA1 4ebe220f1b72c9daec854bbeda64396f462742d7
SHA256 7374dd42a06745a6e293c55c8cfce56aaeb380a8209913ec48c5a691f2593a75
SHA512 d5eb7499270b192f34981386ab2cca8161c18565474f44aec34c0aeb67c489bf65dfed3fa2ae27e631f523c305c9b5ed8c1fe030f5045a25a7fb1174e7597900

memory/1884-155-0x00007FFD62F60000-0x00007FFD636EA000-memory.dmp

memory/1884-156-0x00007FFD62F20000-0x00007FFD62F57000-memory.dmp

memory/1884-168-0x00007FFD64440000-0x00007FFD64462000-memory.dmp

memory/1884-206-0x00007FFD74EF0000-0x00007FFD74EFD000-memory.dmp

memory/1884-205-0x00007FFD637C0000-0x00007FFD638DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mlid2gd0.lna.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4320-218-0x000001B1E6350000-0x000001B1E6372000-memory.dmp

memory/1884-223-0x00007FFD637A0000-0x00007FFD637B6000-memory.dmp

memory/1884-224-0x00007FFD63780000-0x00007FFD63799000-memory.dmp

memory/1884-225-0x00007FFD63730000-0x00007FFD6377D000-memory.dmp

memory/1884-262-0x00007FFD636F0000-0x00007FFD6370E000-memory.dmp

memory/1884-259-0x00007FFD62F60000-0x00007FFD636EA000-memory.dmp

memory/1884-247-0x00007FFD72470000-0x00007FFD72482000-memory.dmp

memory/1884-246-0x00007FFD72490000-0x00007FFD724A5000-memory.dmp

memory/1884-244-0x00007FFD644B0000-0x00007FFD64568000-memory.dmp

memory/1884-243-0x00007FFD64570000-0x00007FFD6459E000-memory.dmp

memory/1884-242-0x00007FFD63C60000-0x00007FFD63DD3000-memory.dmp

memory/1884-235-0x00007FFD652E0000-0x00007FFD65304000-memory.dmp

memory/1884-261-0x00007FFD74EF0000-0x00007FFD74EFD000-memory.dmp

memory/1884-260-0x00007FFD62F20000-0x00007FFD62F57000-memory.dmp

memory/1884-245-0x00007FFD638E0000-0x00007FFD63C55000-memory.dmp

memory/1884-234-0x00007FFD645D0000-0x00007FFD64BB8000-memory.dmp

memory/1884-277-0x00007FFD72490000-0x00007FFD724A5000-memory.dmp

memory/1884-285-0x00007FFD63780000-0x00007FFD63799000-memory.dmp

memory/1884-274-0x00007FFD64570000-0x00007FFD6459E000-memory.dmp

memory/1884-265-0x00007FFD645D0000-0x00007FFD64BB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupRedo.MTS

MD5 49326dbcf6004a6d1992c8191e81cd97
SHA1 8e3f83a4c2b7c3b151edc99460ff862d8c8bb3ce
SHA256 b87bf0d83938550e657fc3e788295dab85f079964474f4c0a5c9762dd7cdd684
SHA512 75186eee8f6b21d75459386558bfea78ff88066fcd2f123a3d45f199a7703ce87ddb05d948cbb61621e4744bf326c4684b06ab010179e0b6e0c607c9eb884002

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\DenyDisconnect.docx

MD5 9250717f6efbf542ee85d7362c96ce14
SHA1 0bf9fef82ffc203715e2852cf339e930b35e586a
SHA256 28cacba513b74e29deb5a57b6aa49ed81f9780c087552b57c8854fc3b77c33d9
SHA512 c5ca0de8283c256b496e7b736e86359f6af7b2258d4db77fbda27e6e05be25dc4545832fffa81fa82fb20a42a4f0d6cc14b6e0e33da8ff63f04181cb3c24d19e

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\GroupUnprotect.xlsx

MD5 481ac45d58e3534e3b691b302eb5ff3c
SHA1 61a56764dc11e58ff7368aa83c3ca91caceb945b
SHA256 f3e93e9b0901cfc5395eaf929eb0b6dd62c59452bbb11199981b52128d6a07c2
SHA512 e70049c9103c8db710ebfce0831841b63d58aa8d97122fb39f05b7dcf1cd83e5c03563071eb2fa6c0776196af3a98817dd118a398f0c20a8736a0dea1abf72fd

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RemoveSet.docx

MD5 cfafcebdd0db9d696f64621415d18402
SHA1 fe74fa613f34a6b6c3869a73f806622c7ebbc675
SHA256 da3fbc316a4d4f134d6a7e443b7b0ffa1cacdf503396ccade00b180ab34b8fbe
SHA512 a48f2a98c0d3c61b1d214027b8919c67d4e125e2e612116f4cedc8867fae93d7e3434923509ea42038131218e8bc624b0f6dddc3c9f990e3a4f7a5df64676a86

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RevokeStep.docx

MD5 c475500e940ee7b0a394ccdacc3455ff
SHA1 19459f3f82926871354e48b1fbcee0a65a050f9f
SHA256 a6489d7dac15c52db0ebbacbaac4073f6bb533a6e315c5bf6ec871c38893de89
SHA512 2697d6e56cc31facf4def6cee69752dbfd52a426fc86f7ec6b0dd23d049565314c6948e96612d252a5a754b66e2942bc0f17b44237af1eac3d95b1b679d8ef01

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BackupInvoke.odt

MD5 548c34de1e14763bf08b3c9e5407a18e
SHA1 1aee04027d64918dd30d76837ded893349f6c317
SHA256 f34cc29f3660d716035695a251000632c5af045ebc1a1a6e16fde219b6ee04fa
SHA512 c3f6c7fb3e0bb62267e9f1ce4d0ab0c2b495c8953893cba794caae8855c2ab7e1c3b9c1e46a652b0d1c8a27049cb00f67991400370d885f6a7ab0f0f8ae638ce

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ShowTrace.xlsx

MD5 010f7aa1b94f2015d7468680637c89ed
SHA1 fcb3b3abf59cf94ae9f7b8b071eaa5c69610f9c6
SHA256 53cd9c7da0ef7f4aa5774aa9d34e8a43cdcf50f71e5b1f62b9a18fcb6e06b7b8
SHA512 15b5f1a952479da7404da77d19dc40c3b739fa2ff6af47a1933790c279ced83aaebebb3b4033499bebd74406130da25bba09fad59508bd6c5b4f5bcf02dbaf67

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SendRepair.xlsx

MD5 2135f1ac4817a18482ed4e8d7a2fb6a9
SHA1 41916c35375b565cd741f989a6307a08030a10d5
SHA256 9481e9370ce64f3c1c0515a45514662733dd40c33191d70f4216f2e961d4a0e4
SHA512 896edbe567ad52dcab980351d5798525ccb4729f0ee6cc55e66fb4903327ffef6f8c943a1616d7cffe472056440e40249aaacb01fb75fc54c0496f228613e30e

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BackupRestart.odt

MD5 9f6f6c372c6f702dc3a72824528505e2
SHA1 007aea21b355397297c57f4a8deb4a2ff3f2c876
SHA256 e2b28db47e1d9bf1b86d584734085614084ef55703815ece44d4e1bde3ce907f
SHA512 90335e5636d6ca1403848127f268ff1a1b38f069eca4388859b20705d4c110bfa1d575b3ce96824d22045603936079c8f4d42009cde264ed96f05b11f6ab0166

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BlockBackup.xlt

MD5 44dbaf38bdc9d9ec3e480198f167bd35
SHA1 6e785deb2377c7f70d02b32fc43d590e87c9c0e7
SHA256 2d24304b7f138ada99b9bcc1ec03851b228841eba7c834de7cf70a52f81bf39e
SHA512 f6bae6dc919faf68717acef4e67fba7a3614e5d36f1df1d4e8f7b64fbe7a104c634082aa861d0447828b7a95ad02589c17b00549b0df334b1abc6b713884a4a2

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\FindEnter.xls

MD5 bb6b34747d70b90e25cb91c184a8d785
SHA1 20cb9904da78417b60d565a6b953f8dbf6532560
SHA256 a7848f0924baf3db5395266f287bb8621f1a2064b96cd3d5b9e38014c405a496
SHA512 0455a1e8c074141b8e2ba6a7b3bdc78068f3415e18d8992dcc4e1219322c565fb93eb3ff65467adf64bce708a357be005bda7cd7b8dddfa687f4969d0f653a58

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OptimizeBackup.ods

MD5 0cac7e011ba504651afbfeee20439e9d
SHA1 c7729c3ad57d9c5acb4b63c501afd15d23e79e41
SHA256 41c836b42303b48c37b858c117a01e3f4031206240d1c0ba69fa948a9da3648d
SHA512 48be79efb11af50558c17b0df54859b53b6b79828b9ff2c6d27337cca432c31fe2cd46fbfe54a485fddc3573ba24737285181bc4c216764871c28efcdb915ade

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RemoveOut.xlsx

MD5 5d07241ed58d19d72e4a8cdc91e90af1
SHA1 ee8e7270388ca89bd4d4883818d85b12e87043b8
SHA256 49ba5d7d95a77785733cb7b7e0c73765feb14253cd3b953d6f918fceb376ba86
SHA512 ad50c17d1dfa7c43b3534b4b9afd6623c6e6503f4322951d5c74301dfc0edab9bacc20d5ab246771ccedba931cad0a5b957119b29284cb60681851ac1561a36c

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SelectUpdate.docx

MD5 767deb3a894df3dee6f97c836e36e22b
SHA1 116306e0d13b60d6b748eda7fd1fee1e36ce04d1
SHA256 f3b7d971902b80c089d320f8d7331262f2ba81c68824ebbfcda68cb7895eb19c
SHA512 2189d0608dfb50f87701e897b61bd67c524deb72f19d212e7e083672f7fb1077ac935dfcb46f3e3b297b076d5df3f23668b4366ad4a9c2f1f4b9099ae4143709

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnprotectBackup.xla

MD5 a787f8ba290c4cb28b4dcb8f4ae1c35e
SHA1 0946994b02fab729cf33af0d47f532761180d85a
SHA256 0009b48014c3042df79aac0457fe2da55ed484a0e35cfdc42fa6621c9ae35020
SHA512 a0dd4c620949603c75228d14fe03bb2827bd0d7a74a55205add8d2f037abbd489d9759d0988ee1fc00f82a4103b9311cdcff9f8c6ff7d53bd1dfa9106a5c6d37

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\AssertMeasure.mp3

MD5 f7079faf8ae2f4274c122c9503c560a4
SHA1 0996d006c39b9a2cfe4523eebce851e08343361b
SHA256 030d33b1a403297cb9e4b4bf7b979d35ab8b494aedeed749e2d98416837e3d5b
SHA512 97e92301b3e431438ea2033ccbdb9e85cf69812be3e6312215c567bb3d84ae35400759bac4a3042bb36e9ba5aa35299a86546dff84702df1dc495413216626d9

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UpdateUnprotect.docx

MD5 0b43b82e242dd2d66456eb1f8517e30a
SHA1 6766ce4f880c76fe07a0babe89113e6f4a66cd79
SHA256 7b189c4deb1eb9a1d751e861d06939d36d045bb50d58fc6507c103f6a970302d
SHA512 c56fa3d71049e437fe6f9a867217a42a0409892e44e79bd0166da4d81325097567ba33909a2f10b1fbb86151ba633ed627df96d50c73cf40efa4a013adf60ad4

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnlockExport.xls

MD5 2f532e9ce5906262865695b8c149c43f
SHA1 750347f0bb165e63dad317377718116a4235e08c
SHA256 a667cc4fd176d234062d062ab3b18e06fc3fc4bf72a96d6bfc7caad4c68ecd2e
SHA512 8f73f981645f59ef1f102c3359ec1961b256f240afbb60c3d88192c2f95186cc4546bb7dbe6cf379512caae61f5afc4ad63fde090acca115e2823b48df7e652b

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\CheckpointWatch.zip

MD5 f79d9eb94e3c014482f1af661a992583
SHA1 53fb7434c0cb8934543e3e22ea01df98a9013349
SHA256 6595a4e6bd076a138ee9de7401d265f69d0a9280d25e411f6a3849a5f2eb4a84
SHA512 8436b96da0e2ec75540cc290a212419704ae6ca21b4152b19f20cccbb771642b14beb7de428ee1805a1743bc860449099ee0286e2b8983657c7363c2eb5a374c

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnlockDeny.xlsx

MD5 600e102df4f6c233fbaa87e5d3b25f7a
SHA1 900954e365f2d87ab6f5e57b17c62d8b342d39c7
SHA256 6c52e0dbe100a7f3a829708d63b8a555a27b558678ccf0d20a673e565b9200da
SHA512 fa67d0f87729b700b7990059fb30c117efced6d1a08faa3563096f48dc28dbeaf78a4d48224f31b716ece18e4e8f50465431cd6dea2f87a1fe4ddbc47d2aaf01

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ResumeInvoke.docx

MD5 b94fe8237f87580a2076acb0da3dc9f4
SHA1 1153bcb91613469c19d34afb713d5d0d053afc14
SHA256 c696afb018fcbde2b38a8c392dfac6d2e0250b878e11b424aa5086c92aebc5ef
SHA512 3bde1adb5eb25ed225a29bff8437cd2f0a69b5462e638dd8f2f4dad1a1d656ca9864fc4e2c6c77d297119a67adb1be5a02b034fecbb259fea03cbe08d49c2463

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SplitAssert.pdf

MD5 efb3d1bf56b0aa28e8772370d34e425c
SHA1 a60c8dce730775fa1b883878d14429f5ccbde7e6
SHA256 86376354cf995b82f2b1596714b2727e6d4d09599648a82b1e3d28bbe08fc636
SHA512 1bc6d5623dced46e6c282a50de7ecca756ebcd5c2af75fc03876ed6d15d064372a30092050cbad4e5f62384018b369dc94ce1013aaba091b37c857177051f4dd

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\TestUse.docx

MD5 0bd734609be60fc577335671dc71302d
SHA1 5f1fff1f0e03f712d0490309477cb21d23a713a6
SHA256 ee8c80029a8db3f670d1d91f6286e409cfef3fea7df529b3ffcf06b189ad0763
SHA512 57ceda51a21af6f9050fdbc81e14ffbb175321f9625996d432dc57f06fd5ec2342b216e83ff2d03668731bba72975e1eba49e5a9ef1829341d8584d20c546b25

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ExportConnect.jpeg

MD5 610c7cee032bff0cea3b66ea2a6cfc7e
SHA1 4f32768d97b2cd07cb16a09087135c6393ec1caf
SHA256 4fdfdaf8edd8ccf1f8d8ae346ae76ad35182b15f5772bc2df04224162fb482a6
SHA512 3a2c44e839415b2b9ff55c1639ce18a4c8f46091022f20231c5da84ea3eae9b823694aeec84f124684ae26426eb2bebb4be0d611a117b9d597bd2081416c56a3

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RestoreApprove.png

MD5 d75f0f0f9067a4e7d1caec32bd18d525
SHA1 44ddb1136ac5c72cd6f01da5204fecb6ec2e8b36
SHA256 1049f6fcfd2758a55498a28153ecf797241aa98e1ba9a3a3c8fbc47150160d76
SHA512 f06a15864da3107b42392570c03ad8e3501abc070e3d5c6405956a8dd810854c26822dbafe0f376514a7a956cba6a28b6deef21efa24d3b89cc3cf0c48b7362a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SyncPublish.jpeg

MD5 a8e2d7942831b9336c2854eafc728e1f
SHA1 12fcfd6c77a26d6206b3d702ca60514df19a77de
SHA256 2a5eabcc1c929fe48b9802d056b5c73e24922ff4e31df3c60acf73bd2213fc5c
SHA512 42a070946df13674df54adf93a0650564b16219ac578b3ba3a34ce7fe4e7e6f36a9aff6496d5d297e76376da871c1d97df3fa2d9c44bc0a9a3ac0b2027e98e52

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\StopConfirm.jpeg

MD5 0b3d0657b0bfe15fa0e3df850f1d4593
SHA1 ce6c3fc45ba83d7fd76f855a488fd047f00b74cc
SHA256 da3b6e7fe15ae9414e55a7d654da784f654e197d2ea59b31c9cb3d678e5bcbb2
SHA512 bf4fbe2a58a17e019171bbd56137037202c1d4b3257975f6c99382957c73882695c68515d74ee60e4a8dbed7f2c731174bdab0085080302e0a96294abec0b057

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RepairSend.jpg

MD5 678d909b11e927405a17c84363bb1aae
SHA1 49fb93e40d2f209c77cf9fe4b88050c4e9362f09
SHA256 666dda393115aaaa06adee1377dd861936c90810f4a93bf012e870e2415f5f02
SHA512 295e7deb727ffca3a903963114cc6a13bd793894b0a580f469ef1bca5755ff2aa2c13f33fb17ee96131db3db5c86a64b37d3612b10c792fee4c19f74d133a2d6

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\RegisterConnect.png

MD5 a431eb4b9006b0457b46a1aa9e9e4a92
SHA1 7549a24227c1a131c83bc842fab7221dcb0d394c
SHA256 41d9bedfc136021095cd588c19cc394a0934f4a5e7aa25613bd4360bbb78a023
SHA512 289e96baf99f9af814e97c01017b8f18424d291ac5de9795f0a8522d910ffb5dd583c4d628b219f6719331d980c0756b425ad0be0e6591bb7345b3dbcf9ad577

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ExpandSend.jpeg

MD5 d585efcc710f8a66d737b8b05c291993
SHA1 7a40285bdfec37365347220a3067c24349c02319
SHA256 6c26141c37255b6c3e41c66add115c74c01613148ed96559bd0decf956c2c2d6
SHA512 78cb49d3ba806c5c9a45157e7b6e2819dd75be10626f1d7ab8445f03f7706053c1864371a3b81b7932d27e4302581d353107e244cb16788e2587d6aa73c5b906

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\UnpublishSet.csv

MD5 569a7ccdd42c687a3acaf12a7bb034d8
SHA1 1cada85769c45263b942a67901e728201fb599bc
SHA256 098d99aca11e6734fe0f729f67febbd12e4cf4ab6875532a40761cbeffd561d9
SHA512 7c3e80a28175414287ecfd259f8c6e0ba3fa2c3f7d1975c18ee67939b9004ab755ca3ecea4b3993fe1d8624d7160fffccca06b94dfb0ee647b2677070fba96ea

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SearchSplit.jpg

MD5 27cefd189934246377a43bd95af85fda
SHA1 5d11dc1b4ffc28a58eaa092b99d539081573103e
SHA256 a04555677cb8293652f4c63923d0a0d3ed6b7ea9ea851482e9eb614ab8bbbc86
SHA512 b7d835145a483b1286583db5b2dd89b4abb1c38a3f58111ef55a49367a50f7f2f0ad42a45e3b0579c4ae0223c77b954b9ca0fc713d734a61b97b804f5b31e87d

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\RevokeRead.mp4

MD5 080963b454c2132bf3e2fc9e736a49f5
SHA1 c4e80e774bc694d66f76910236a442b621375854
SHA256 3ed565a2eaa55d15de38e186cb911b5b5755bd436e22f1af7857f064267526cc
SHA512 060ffb6cac8a948c272b4dc11583fe9bce318eb5ebe983ae375b1d25ef009e1749ea41f3ae8809df6a45d31c2aa1287344bcc845625b778bae70485093bf7e92

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\PublishMeasure.png

MD5 3e71b0b369d51bcef4990d63a0df7b49
SHA1 e32229e35d737cc694ac9efe71098f8290426174
SHA256 f6a157edeed4a90a3dd36c5c9c819304338d03ab0759a8837858e1c6948810be
SHA512 8404b59676a079e09b0c9deff6854aee0de327f7e8c9061c5d926ed5521917b5e68ba80a15736f55cced850808ff11af0a2fe7b3bebc40b6a2b998a4b4d2b893

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupResize.js

MD5 f73a9881d3df70192c1bb1f23a170f73
SHA1 1dfd0418d338842a1fb513c01db43c50d0106c9a
SHA256 bf37416b69d935d38232e9c744f68a179012381f499e874cfb2220cdd8b6b586
SHA512 6a3b954056ef34522a79ba8851184f0efde47d315600ecfd37de8ddaf61fdb71ee1a06e14a9e01c2822dd5233364cd59edb99c9e2135e8eaee848de86fe14d04

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RegisterSave.mp4

MD5 05068be3635fb0765af1399e8a6461a7
SHA1 7a71bba8b4eb63dae8acde3606d3e4e2cdb26165
SHA256 380564af2ac4c2a706a9613c3caf09193a60035ac23fef0f93766d935119a94d
SHA512 33842a38f81bd02141b9ee287e33a3db617a37a08c10804971bf50e352c2573c731b48a740f133fe9ef1d4cb51935f62eb484ce024ef86cce7405436796c2208

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\EnableStart.zip

MD5 27282fb8af8c1a488ef172e282440115
SHA1 dd5953f3cfb784383a90f7cf92cc01107a135df4
SHA256 c79fff01a35ea9f3cf1f3299ebd6efe0d1611d2ff3f6dfa5c9e0ade3f8a9a844
SHA512 34dd21bdc3ae2b0a344c2faad92ca1da09906f0855718ff21971b873379e74273d47d4a5c9f92058c32bd2fa141ed227c430a79c0153ef1d9740744be6bde976

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\DismountSwitch.pdf

MD5 cedfd4358cc33cb575594b122f70f41d
SHA1 fe91289a141c97a42acadcfcdde15d2437cad63e
SHA256 667e8a07ae04d113e095212cc29a985ad448e5938cdd5b995423fc6b6cb7f5ed
SHA512 4cba446b78d2c77b76e30e009bd27f9043e270d66bc736a395f73e7e4b7d374c4d5aef2c96d769560e26204a135b812a97845e10093581c2f21fff740ce74ac3

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\GroupConfirm.jpeg

MD5 56bd4a21d9e1de12768c85a40df717b6
SHA1 120ad246cf893b8341ed95400d3fb86cfa6ef8f3
SHA256 97df5b81db0c78c26d635804dea373c6bfb34a02ef5e4171d63e20849218027d
SHA512 3f6d9267f535da07dfc016ab98d93eca2be190f00d01ff24032dd56816794540cd6e285a42eb91b06468ced0b90a9c91019453424a5912ff94a0f033b3b6976b

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\InvokeRemove.jpeg

MD5 bf013b0bbd2a50f62910eb74af019436
SHA1 d0aa2fc6eec1dd16cb3a00a2dcf3f91227268f96
SHA256 7d7400e1eba1e94cfc267f07e526b2efba3657204e08e67609e0c373f81643ae
SHA512 a4a6651485574b307965e378075a5477077a5eae28a75d2f804b47425b743591d9475d65ca11fe6f5e085881e0447734c5098b2b014b0c91a254dcd1bf321787

memory/1884-762-0x00007FFD644B0000-0x00007FFD64568000-memory.dmp

memory/1884-764-0x00007FFD636F0000-0x00007FFD6370E000-memory.dmp

memory/1884-778-0x00007FFD62F60000-0x00007FFD636EA000-memory.dmp

memory/1884-780-0x00007FFD74EF0000-0x00007FFD74EFD000-memory.dmp

memory/1884-779-0x00007FFD62F20000-0x00007FFD62F57000-memory.dmp

memory/1884-777-0x00007FFD72490000-0x00007FFD724A5000-memory.dmp

memory/1884-776-0x00007FFD652B0000-0x00007FFD652DD000-memory.dmp

memory/1884-775-0x00007FFD63710000-0x00007FFD63721000-memory.dmp

memory/1884-774-0x00007FFD63780000-0x00007FFD63799000-memory.dmp

memory/1884-773-0x00007FFD637A0000-0x00007FFD637B6000-memory.dmp

memory/1884-772-0x00007FFD63E20000-0x00007FFD63E3B000-memory.dmp

memory/1884-771-0x00007FFD637C0000-0x00007FFD638DC000-memory.dmp

memory/1884-770-0x00007FFD64440000-0x00007FFD64462000-memory.dmp

memory/1884-769-0x00007FFD64470000-0x00007FFD64484000-memory.dmp

memory/1884-768-0x00007FFD64490000-0x00007FFD644A4000-memory.dmp

memory/1884-767-0x00007FFD65A50000-0x00007FFD65A69000-memory.dmp

memory/1884-766-0x00007FFD63730000-0x00007FFD6377D000-memory.dmp

memory/1884-765-0x00007FFD645D0000-0x00007FFD64BB8000-memory.dmp

memory/1884-763-0x00007FFD638E0000-0x00007FFD63C55000-memory.dmp

memory/1884-761-0x00007FFD64570000-0x00007FFD6459E000-memory.dmp

memory/1884-760-0x00007FFD63C60000-0x00007FFD63DD3000-memory.dmp

memory/1884-759-0x00007FFD645A0000-0x00007FFD645C3000-memory.dmp

memory/1884-758-0x00007FFD75960000-0x00007FFD7596A000-memory.dmp

memory/1884-757-0x00007FFD65590000-0x00007FFD655A9000-memory.dmp

memory/1884-756-0x00007FFD78C20000-0x00007FFD78C2D000-memory.dmp

memory/1884-755-0x00007FFD7AD90000-0x00007FFD7AD9F000-memory.dmp

memory/1884-754-0x00007FFD652E0000-0x00007FFD65304000-memory.dmp

memory/1884-753-0x00007FFD72470000-0x00007FFD72482000-memory.dmp