Malware Analysis Report

2025-03-15 03:45

Sample ID 241124-amfmtszrcj
Target ElectronV3.exe
SHA256 fdb9f742ec550af9a8ca330f0a1d3aa012b1df6348e8182a52b6aac0f74a781b
Tags
pyinstaller upx exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fdb9f742ec550af9a8ca330f0a1d3aa012b1df6348e8182a52b6aac0f74a781b

Threat Level: Known bad

The file ElectronV3.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller upx exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer

Exelastealer family

Exela Stealer

Grants admin privileges

Modifies Windows Firewall

Reads user/profile data of web browsers

Loads dropped DLL

Clipboard Data

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Network Service Discovery

Enumerates processes with tasklist

UPX packed file

Hide Artifacts: Hidden Files and Directories

Launches sc.exe

System Network Connections Discovery

Permission Groups Discovery: Local Groups

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Unsigned PE

Detects Pyinstaller

Browser Information Discovery

Gathers network information

Detects videocard installed

Uses Task Scheduler COM API

Views/modifies file attributes

Gathers system information

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Collects information from the system

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-24 00:19

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-24 00:19

Reported

2024-11-24 00:22

Platform

win7-20240903-en

Max time kernel

117s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI25322\python310.dll

MD5 fc7bd515b12e537a39dc93a09b3eaad6
SHA1 96f5d4b0967372553cb106539c5566bc184f6167
SHA256 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512 a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

memory/2724-49-0x000007FEF5850000-0x000007FEF5CBE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-24 00:19

Reported

2024-11-24 00:22

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 756 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
PID 756 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
PID 2404 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 1768 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3716 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3716 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1768 wrote to memory of 5048 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1768 wrote to memory of 5048 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2756 wrote to memory of 2080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2756 wrote to memory of 2080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2404 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 4672 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4672 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2404 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3564 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3564 wrote to memory of 2724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2348 wrote to memory of 4528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2348 wrote to memory of 4528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2404 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 4652 wrote to memory of 2384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4652 wrote to memory of 2384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2404 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3244 wrote to memory of 5092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3244 wrote to memory of 5092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2404 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 4604 wrote to memory of 2552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 4604 wrote to memory of 2552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2404 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 4692 wrote to memory of 2776 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 4692 wrote to memory of 2776 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2404 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 4380 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4380 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4376 wrote to memory of 2004 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4376 wrote to memory of 2004 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2404 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3480 wrote to memory of 4804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3480 wrote to memory of 4804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""

C:\Windows\system32\schtasks.exe

schtasks /query /TN "ExelaUpdateService"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 127.0.0.1:60262 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
N/A 127.0.0.1:60271 tcp
N/A 127.0.0.1:60277 tcp
N/A 127.0.0.1:60282 tcp
N/A 127.0.0.1:60284 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 162.159.138.232:443 discord.com tcp
N/A 127.0.0.1:60514 tcp
N/A 127.0.0.1:60516 tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 210.68.20.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI7562\python310.dll

MD5 fc7bd515b12e537a39dc93a09b3eaad6
SHA1 96f5d4b0967372553cb106539c5566bc184f6167
SHA256 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512 a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

C:\Users\Admin\AppData\Local\Temp\_MEI7562\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

memory/2404-51-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\base_library.zip

MD5 5c712503cdf703ab569b2397371c9723
SHA1 07d5109714feee34f7386072ac87f3f70289cab6
SHA256 a995fcaada1fc114583e23d14dd0f5deeb03edda005c9d57934346fc66837841
SHA512 c6a51c9e4e9aadde6bebb564181fb72928ec42ff3aed1833bb4676871eaf398b497bc03a0f1cdfbbd7545585d438763d19a5411ea5bcf021383fad1124307596

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_ctypes.pyd

MD5 4b90108fabdd64577a84313c765a2946
SHA1 245f4628683a3e18bb6f0d1c88aa26fb959ed258
SHA256 e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1
SHA512 91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

C:\Users\Admin\AppData\Local\Temp\_MEI7562\python3.DLL

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

memory/2404-59-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\libffi-7.dll

MD5 d50ebf567149ead9d88933561cb87d09
SHA1 171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA256 6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
SHA512 7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

memory/2404-61-0x00007FF911330000-0x00007FF91133F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\libcrypto-1_1.dll

MD5 86cfc84f8407ab1be6cc64a9702882ef
SHA1 86f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512 b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

C:\Users\Admin\AppData\Local\Temp\_MEI7562\libssl-1_1.dll

MD5 6cd33578bc5629930329ca3303f0fae1
SHA1 f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512 c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_uuid.pyd

MD5 59cfd9669367517b384922b2485cb6a7
SHA1 1bd44298543204d61d4efd2cd3980ad01071360d
SHA256 e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f
SHA512 d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_ssl.pyd

MD5 7e9d95ac47a2284706318656b4f711d3
SHA1 f085104709201c6e64635aeacf1da51599054e55
SHA256 38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9
SHA512 294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_sqlite3.pyd

MD5 e7d68df8f65fbb0298a45519e2336f32
SHA1 ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d
SHA256 2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79
SHA512 626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_socket.pyd

MD5 53e72716073038c1dd1db65bfdb1254c
SHA1 7bf220a02a3b51aa51300b3a9ea7fa48358ca161
SHA256 e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d
SHA512 c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_queue.pyd

MD5 5c4c43763fb1a796134aa5734905c891
SHA1 44a5e1ae4806406a239129d77888bd87d291a410
SHA256 4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c
SHA512 07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_overlapped.pyd

MD5 5c1441f6ee11632183a83dac2d22853b
SHA1 eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2
SHA256 104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf
SHA512 e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_multiprocessing.pyd

MD5 4fbc5fd5da9da74c04fe0374387b34d3
SHA1 1e9c98db0486f98fb7d8eb9fa57a949494b649b5
SHA256 b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950
SHA512 ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_lzma.pyd

MD5 8edbeeccb6f3dbb09389d99d45db5542
SHA1 f7e7af2851a5bf22de79a24fe594b5c0435fca8a
SHA256 90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f
SHA512 2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_hashlib.pyd

MD5 3b5530f497ff7c127383d0029e680c35
SHA1 fb5dc554bb9ff49622184cc16883a7567115c7ca
SHA256 5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573
SHA512 12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_decimal.pyd

MD5 20985dc78dbd1992382354af5ca28988
SHA1 385a3e7a7654e5e4c686399f3a72b235e941e311
SHA256 f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43
SHA512 61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_cffi_backend.cp310-win_amd64.pyd

MD5 7727212e7bdbf63b1a39fb7faad24265
SHA1 a8fdec19d6690081b2bf55247e8e17657a68ac97
SHA256 b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c
SHA512 2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_bz2.pyd

MD5 6250a28b9d0bfefc1254bd78ece7ae9f
SHA1 4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd
SHA256 7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b
SHA512 6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_brotli.cp310-win_amd64.pyd

MD5 94c13e0636646019a4c7d405c2d919df
SHA1 8ed8519e9b310f59e5b40f3c8fb675791cae09f9
SHA256 10517c02bb69dafd60053152e65d00c02e24952f63ca230af807ec6b2053f2a6
SHA512 82fba52c4db4206f7a1ebb1a3ebf12fc60f3deff4763fd5a059b00f46aa7513279da994a815a0883ce3301c3cdd1d20923db21b926c43b2ee732c28852979945

C:\Users\Admin\AppData\Local\Temp\_MEI7562\_asyncio.pyd

MD5 7d4f9a2b793e021f7e37b8448751ed4e
SHA1 0ea07b5024501aad5008655cfeae6d96b5da957a
SHA256 2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4
SHA512 af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

C:\Users\Admin\AppData\Local\Temp\_MEI7562\unicodedata.pyd

MD5 fed35db31377d515d198e5e446498be2
SHA1 62e388d17e17208ea0e881ccd96c75b7b1fbc5f7
SHA256 af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b
SHA512 0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

C:\Users\Admin\AppData\Local\Temp\_MEI7562\sqlite3.dll

MD5 6a3a34c9c67efd6c17d44292e8db8fad
SHA1 339b1e514d60d8370eaec1e2f2b71cead999f970
SHA256 7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9
SHA512 6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

C:\Users\Admin\AppData\Local\Temp\_MEI7562\select.pyd

MD5 3797a47a60b606e25348c67043874fe8
SHA1 63a33fedffd52190236a6acd0fc5d9d491e3ac45
SHA256 312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac
SHA512 3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

C:\Users\Admin\AppData\Local\Temp\_MEI7562\pyexpat.pyd

MD5 46331749084f98bcfe8631d74c5e038f
SHA1 5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347
SHA256 21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df
SHA512 edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

memory/2404-83-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp

memory/2404-87-0x00007FF90F620000-0x00007FF90F639000-memory.dmp

memory/2404-89-0x00007FF90C070000-0x00007FF90C09D000-memory.dmp

memory/2404-91-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp

memory/2404-85-0x00007FF90F840000-0x00007FF90F84D000-memory.dmp

memory/2404-93-0x00007FF8FCC00000-0x00007FF8FCD71000-memory.dmp

memory/2404-95-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

memory/2404-101-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

memory/2404-122-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

memory/2404-121-0x00007FF90BED0000-0x00007FF90BEE7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\yarl\_quoting_c.cp310-win_amd64.pyd

MD5 e73b7c4ab697651094b83841e21370a0
SHA1 3093c418051c4d4e32ddb041ebcd7920cd77a191
SHA256 4ed26f8531dfb4a33d88ccb591a36fbbb25f28ce4720a92e840897316b01ac5d
SHA512 4846a981773c89bbdb5999e4472ec7f25d359e8bb16528a059b925078e0896d476e125b6cfede022a4ecce53cce30e001e2d1bcc90d03a0b2de29e6c6c8eba49

memory/2404-119-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp

memory/2404-118-0x00007FF8FC6A0000-0x00007FF8FC7B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\yarl\_helpers_c.cp310-win_amd64.pyd

MD5 15591df44ee64cb8772f1a5583465094
SHA1 7c75d1f1e234e00d0023d803642d4fedce3b7b80
SHA256 1de4a743bf1182dcfd04942696201ad1a3babd9455adafa2283709a1f3dcbaf1
SHA512 6f65bfcfdb155841ebc58494f947218a17e06b370c39b289cb86aba6d8f0ce9aab71bb8fe74b3c37f4049f99b9097718c718a337a2da2a98d6445fa24c143a6e

memory/2404-113-0x00007FF90BEF0000-0x00007FF90BF04000-memory.dmp

memory/2404-111-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\multidict\_multidict.cp310-win_amd64.pyd

MD5 7f691747ce66d3ed05a7c2c53220c8b5
SHA1 1d3f247042030cf8cf7c859002941beba5d15776
SHA256 7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228
SHA512 b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

memory/2404-109-0x00007FF90C660000-0x00007FF90C670000-memory.dmp

memory/2404-108-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp

memory/2404-105-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

memory/2404-103-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

memory/2404-102-0x0000021BF9060000-0x0000021BF93D5000-memory.dmp

memory/2404-100-0x00007FF8FCB40000-0x00007FF8FCBF8000-memory.dmp

memory/2404-99-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_helpers.cp310-win_amd64.pyd

MD5 543e83e6396cae6570f30eb0b07dbd85
SHA1 330c63d832b06cd94de04cdb9c3777b5fc0daf9c
SHA256 37f70d7409d0ff362ba1fdfc7717ed220f6b03cdbf04665b9a29a164cadc6384
SHA512 b5a7549d92c93861ba68b72f3d9e02de4c09b7ae41fba204604910c4e05bc88b8e32c40ae999cf3ccaabb3c6aee4618d285dc060c9f08a9a70d0ee31f1ff4d51

memory/2404-126-0x00007FF90BB40000-0x00007FF90BB57000-memory.dmp

memory/2404-125-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_http_parser.cp310-win_amd64.pyd

MD5 899af4aa2d81d3ef292518511b1dcec5
SHA1 a24d25f12b0e6cd68d4385f6227dcb686f223170
SHA256 533b97f4363ddd5a7d43cadd835404ff23b2ad9fe9a79fbed4b1ce9c12f0cebd
SHA512 cfec8c07c23a2a4ff29e366216494d48061be6c28ab0cde0fdaae04c648292170855491bee678116e9e76ccf3821781f776f03cf09896e5f0530c753999b0342

C:\Users\Admin\AppData\Local\Temp\_MEI7562\frozenlist\_frozenlist.cp310-win_amd64.pyd

MD5 6106b4d1eec11d2a71def28d2a2afa46
SHA1 e10039eff42f88a2cd8dfe11d428c35f6178c6ce
SHA256 19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da
SHA512 d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43

C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_websocket.cp310-win_amd64.pyd

MD5 6d0b455fc452f5ab428cca27ba603e46
SHA1 d3ff9006c48217306808c2bf3ab1cc5ba0505369
SHA256 e8129a7262e537ce6377d6e58f047ec5c69216e4a7bee588d4c69578bb01be8b
SHA512 48873a1ee4871f0ad0d28aa0f58ed027cd11484caa232de8534260a2fd231a58bec939d851a5ee6bba788d939b696485136c3ee24e8b9f94db9803dcab6b169e

C:\Users\Admin\AppData\Local\Temp\_MEI7562\aiohttp\_http_writer.cp310-win_amd64.pyd

MD5 d77dcee3f14c440a8759afa058a12f89
SHA1 e106cb383a0116079e64d881efd172f2c1e53da4
SHA256 dcb467aad3b7281c04489c2fcb499a8f63b081d1388a8fde482a3392667e6391
SHA512 5327cc895467061159891e85da61dc6c0287a6961d820878d88b23514a81fdb7e01103e025e8e0cb74d3918725d128427c06c4749e7d33ad883ac0ed99335a6d

memory/2404-137-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

memory/2404-138-0x0000021BF9060000-0x0000021BF93D5000-memory.dmp

memory/2404-143-0x00007FF90C110000-0x00007FF90C12E000-memory.dmp

memory/2404-145-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

memory/2404-144-0x00007FF8FB780000-0x00007FF8FBF1A000-memory.dmp

memory/2404-142-0x00007FF90C130000-0x00007FF90C13A000-memory.dmp

memory/2404-141-0x00007FF90C140000-0x00007FF90C151000-memory.dmp

memory/2404-140-0x00007FF90C210000-0x00007FF90C25D000-memory.dmp

memory/2404-139-0x00007FF90B950000-0x00007FF90BA1F000-memory.dmp

memory/2404-147-0x00007FF90C0D0000-0x00007FF90C107000-memory.dmp

memory/2404-146-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

memory/2404-196-0x00007FF90C0C0000-0x00007FF90C0CD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vrmjvfev.get.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4540-204-0x000001D1A8BA0000-0x000001D1A8BC2000-memory.dmp

memory/2404-213-0x00007FF90BED0000-0x00007FF90BEE7000-memory.dmp

memory/2404-214-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

memory/2404-215-0x00007FF90BB40000-0x00007FF90BB57000-memory.dmp

memory/2404-224-0x00007FF8FCC00000-0x00007FF8FCD71000-memory.dmp

memory/2404-245-0x00007FF90C210000-0x00007FF90C25D000-memory.dmp

memory/2404-246-0x00007FF8FB780000-0x00007FF8FBF1A000-memory.dmp

memory/2404-243-0x00007FF90C0D0000-0x00007FF90C107000-memory.dmp

memory/2404-237-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

memory/2404-229-0x00007FF90C660000-0x00007FF90C670000-memory.dmp

memory/2404-228-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

memory/2404-223-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp

memory/2404-217-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

memory/2404-216-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

memory/2404-278-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

memory/2404-269-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

memory/2404-266-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

memory/2404-275-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

memory/2404-268-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

memory/2404-267-0x00007FF8FCB40000-0x00007FF8FCBF8000-memory.dmp

memory/2404-257-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupOpen.odt

MD5 c979e8c62e2a69ab6daa60fe5ba4ab54
SHA1 4012f23e4fa81bc3713e0ba9b57b8d519ed1528f
SHA256 450fae2520cdd94e2e8f9e11e4e7c3a88b6ce3d6763285afaede983cb4b559ba
SHA512 70d8cd5b00247ecdce79b3cdad20f6d7243ef738b06bf21177ca6b0912e88eb5c9741fe9604c0550c46119f29dd9d8da477851c2c2a90f1130fc63971458edba

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BlockSwitch.png

MD5 ca96f3295e79246f9d17122aa25c737a
SHA1 0b9278297c84d2e645a23a0938de305091bdb236
SHA256 03bec7fafc445bb734fbb57dd4eaf64a2ac47789af9648c31ae7a9ded47854db
SHA512 db8d596e8bdf19e492e3447f390998ab0230ff59a80f3978790ea721609048ab5eea234e118920f223b78d10fde5766881a74d50ef8a58a1e71b1baab01a3c63

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\JoinStart.xls

MD5 1ef93a0a15097834c6b676eaed705b18
SHA1 a05fd53c7bb8faa496ea78c86fa75c9c0eda7a08
SHA256 dac475c1e4d1f2b035e73bc41d1f0513c838ceed55057a726e96b817fc403a9e
SHA512 b99c8e60bd8be9f80e54683331a1dad9a15eddc39fe80bdb2e01c3a9c35b40f5d0bffe40cd3a8adc2a84bb06f03a741ee12fcce7b2a566d993b10045dd17941a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RepairOut.docx

MD5 a54cf9a4c2e286875588b1d51bc21b74
SHA1 ff344d17ca61da34e9c39fb21f9402177d93db85
SHA256 b85015a77491a345acf51db1be199f026d0f6c439eeaa2ad0c20cfe2926e39b7
SHA512 a82b36c64340003584d8c0b9bba8cca5c9dd5b139cfc9576f2d996dd6e7b5f28574e7e87e6badfe052c7f5a1dd0ac5351ab1f2d38726bf74f2403c9529c0dd3d

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RegisterUnlock.xlsx

MD5 3d9182c22b821063dbeb8218bb68b78f
SHA1 b68e39b73aeff60e02e9118d00962f6841224053
SHA256 5f3400fd532ee0dc7c839527e5601729603b3435d1abc7ffba4f8df0dc457aaf
SHA512 754cdc8826c5382e3327ccadf56555a1d9335691c24023e1ff80947dfa99e21c0186783c9c597fa23b2dc401057c1317258e91bc8bd7a718709db08fa618421a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\MeasureCheckpoint.docx

MD5 616ee35eff8b91a4b381a3c91267cbda
SHA1 0cae4ab267b79aa4ec7fa7d0dcfd46fc6f0cff0c
SHA256 980cc4d1b3ded997e50e02260813782e49a609f8927b1e80c0e189253f1b34e1
SHA512 2aa7600b916308b5ec587f08a069c3496997f9ea699acf3fc6693862d73ba8eaa45e87b6d16fc39a0c33bd9b5294e649ca8975057076365ad8be91bb315d1287

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\DisconnectPublish.xls

MD5 ba85eb58b2686bca7027f20ede8f3b81
SHA1 5c061ab8cc2254e2ae2324339983cf0bb746ebb7
SHA256 e810d4888bda39607991a7563344c5ecd25b31e36225ffd5c80b9f3afd72bdde
SHA512 9defec9bb8ed83aa13041ffd3a9cfe88b0aad3e3a6b7ff28067ccd18b69e095fc6c36ccf813452350df809f3cfac1215d6e8a0bbb7e5ef49f761001ca40c7450

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\SetUse.png

MD5 03498db36b3fea5d568773def25fa33f
SHA1 5578efe046e83c64f3a0abb8f48a69d26ecdccdf
SHA256 216d6228e9651496c10671721c116ede7d227256f4e1b916597cdf6869716b07
SHA512 e78bf7eb626ccd29ad4c258ba3c55ae9fbb07c12ad39abb014befacfe45640b4b68446b5d453018b75f09e63508ce7c6bf2806af58577c444417db781996008f

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConnectBackup.tif

MD5 31dd47e6810b07caff575eb53cfeeae1
SHA1 25e9971558de91e51b50ae27dd1d8e92c9ca29ee
SHA256 f6a06f2ccdc1d5ac0582ad4fdd15afd523f985eea2e20ebf0897e8d7ad21ca73
SHA512 6daeb79edf19d9639fd1980a61e8cbc79fe5e033e55bad9c5e92cbbf69ca802b7aac0520f5be3bb8e4ddd3d03acf4a3b1f1539bf0286d0699f101a459df39904

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnregisterWait.jpg

MD5 8e5201a34fb9d77150f4b49c1adc9a77
SHA1 725c9853fbfd2dacf6de5c6e10151e2f792089bc
SHA256 56bf19e4124d041c482df3f07817312951824e0c45d35857dbe44091f87b7706
SHA512 c39cd67dcfb81af953cba6cd81c1046601b2ca3ecdf0a3ab894a9bc5fe5fd5729b6712a2c9ef94a37ae961f955d1967d73799be5757e98756265d1f54a93cee4

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SetUse.jpeg

MD5 65bda4ba239082565b3107b3ce5652b4
SHA1 5aea1462520cae0b21e5e2e3b5b2ad32bbc3e823
SHA256 21840eaf473632bb7dc7ef071dedf6c0b4f5fb147a4fd119356e0858bede30e0
SHA512 a9b07fc6c257cbc43763f5a59b1874542d7d7711d5ff7c657cde204803dedb1d5f9ca08dbbbea956c825653fb88a16e2d162af1cad1bc711eb1c1d9ec3887011

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SuspendLock.jpeg

MD5 d0add0b226a771f2a46f4ed662a44af1
SHA1 c177921129040f3f6399fcda68637f479aad6b25
SHA256 1e31c75035e58b1777a46e57d4f9a9475207cca25f382e3ea3ed13e0c6064c21
SHA512 6551760eddb6f98d79d605aa993cd14621aa267bca34e5670f5e2502ae2c418a3c7a7501fdcc464199008cff63c8116cf946a5210984731df427228f07ddb88a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ResetDeny.jpg

MD5 8d20ca114472cd122b4e84cdc27ee647
SHA1 d4921b0b89d97a4fd63737141f9b3659df60ec16
SHA256 dd45031c93467c41ca11c15dff7e96066cb58b3d59f450ffe3e6ad58bfb74e64
SHA512 dd47ebb4040ee88ca269b1aa1e9780e985c228be83700b6e84e7a51e73ece57437719c241747940ced3db40585f3f1f8dbc23f4f22be25d2f7f5724d77f129ac

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\PingInstall.jpeg

MD5 dcb0634bfc4f2b06b8c6f30502eb00e9
SHA1 2e85301bc4c5ac48e4aa9b6decb1d1ebb43b3be4
SHA256 0ebc0b129f6593d7858544ba3c4972dcc90ba6eecb223f9ae92bc93d1dbc2c35
SHA512 51c677a36fca687a7058ba0f2dce6dd6f586e0ed640e5d665a3ff9fab249a3c69b0277822396dc938060dc442d73d1b82a76b541af3364c8f0023be5e1e14d01

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\LimitGrant.jpg

MD5 6aa959814bc8c8baebf96991f2cfb4d3
SHA1 6d06f53a363ca6a39d6042d1bd5291c73ba8d41e
SHA256 09f25e2126e969f4c1e374fae2e79783a776682c7871eef0b8de90e19e123099
SHA512 e6ad2b1034eff57ac0ac0be293f2426b175adf5cd50b8e5921a264fa5bd3dd8115606c574ab0103597184693c5cd12e705f9cb00dd92d485c0a29830c1ec4279

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnlockOpen.jpg

MD5 9e9986a555a2f133e370c9549fc04ad6
SHA1 cf81305fe34685f9a6a518eb1adf00813d898952
SHA256 65b9241c08317a772b8a515f5c596f1c910d945765c420a7f2d4b6d2b4fd8e97
SHA512 946f852a9e98a711f062879891f270ad2dcebc9c9d068ec2f4fe75e7a662ca80bc0ca81825b661c6f055ce406dd247b24f89925f37152162cced07af3822e379

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\PushGet.xlsx

MD5 89412491be57f77e39dfc6acc5fb9b90
SHA1 65e9756a44a48b0f9b73f5c16c64021a8badd2e5
SHA256 9eb0f4ea9927b42b74c0b5acc36426e16b5503141ffb509bc5a6d6682a987cd7
SHA512 a561c3938ffe43b57986e2c4f9215ea6542a0ed1aa1cb414a1b2e84a396ce4286b648bf00a4a3a74ca8819ec9b59da2523c0d8ab28ef15a81a8d417e3a89b93a

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupSync.xltm

MD5 f3d89ee7bcb886e18f9194703d6a1547
SHA1 4fd72045df770f4ce3ec408dd52a0aadc8baa734
SHA256 dfb7cdbd6263d4afb0122b8f75a6734adb8198faf5858251ef11dad95bd729cd
SHA512 07555a723515a9f7269478c903ab5b6ee8bc29840f4878d43e8f3ba49669419682003c4a164f65169d18d7f749c2dd17ed51347b46f0c5de624a8408da89218d

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\BackupNew.svg

MD5 897cc5a0dbd35ec8ddff4a5042f7e286
SHA1 859ee6e5c94a796d270bd00a45b59c6c2378a8b1
SHA256 0efc6cd5b567fca29acc63854373830793655bb64351ebfb6d2741c842b58965
SHA512 3aa526827c873ed3c059418c96462d25acd0f37a4c70da4d063da650513e9b76cdc5a02e2e89bd542b52dc87f5d258d9a3d2f1a72848ac3028648bec6232bae8

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RevokeCopy.xlsx

MD5 06c55f886dc268454760efa293731270
SHA1 38fd70dab141ec190477152a881e47035281110b
SHA256 609001d0300aff78fe13ed61aa01221490f1f60c8c252c4f8f4903dfe909deb2
SHA512 ac97e130510df19b8bfd223c69b0d44d038fb9784a4b14d7dfe3f59bd917f84a8822a46e3fb00e9e48927502231f02df30068b848b304150c1cee4b240846f95

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ExpandMerge.docx

MD5 17707217425a96d8eddd3d28fe0eeb4a
SHA1 0cfee4f1efde573d727458bfbe2bd7a8c8e266b5
SHA256 517e16aaa73d9b37d71874e019708f417fef82c760a3915118af65a27d5a1257
SHA512 87af23b4031275b5ac155c05dbd5ef518be5801e1061636749eff3dea622f08a8ecbd5111842037d0d81e135908b21ab3e9b757e607835b8b785ba1bf847d112

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\EnableClear.pdf

MD5 df7a6651643e75535d8412c6c0970d79
SHA1 af51989bebe2d5db9c34876605c8d88f0054105d
SHA256 1e0befc73d0fee48e0b314a0551ad4c4f4daec583dd8166888f011cad4dc8d8e
SHA512 cad9310f8a99a5591e091d1afe00a6a0e5a13c925b6ea19a57772fd0e87fe6732d90e5cb436dd759379a0d290eca1e50b627a647a131638d9f597c48510f9cca

memory/2404-597-0x00007FF8FCD80000-0x00007FF8FD1EE000-memory.dmp

memory/2404-603-0x00007FF90C070000-0x00007FF90C09D000-memory.dmp

memory/2404-602-0x00007FF90F620000-0x00007FF90F639000-memory.dmp

memory/2404-601-0x00007FF90F840000-0x00007FF90F84D000-memory.dmp

memory/2404-600-0x00007FF90F6B0000-0x00007FF90F6C9000-memory.dmp

memory/2404-599-0x00007FF911330000-0x00007FF91133F000-memory.dmp

memory/2404-598-0x00007FF9113F0000-0x00007FF911414000-memory.dmp

memory/2404-621-0x00007FF90C110000-0x00007FF90C12E000-memory.dmp

memory/2404-625-0x00007FF90C0C0000-0x00007FF90C0CD000-memory.dmp

memory/2404-624-0x00007FF90C0D0000-0x00007FF90C107000-memory.dmp

memory/2404-623-0x00007FF8FCB40000-0x00007FF8FCBF8000-memory.dmp

memory/2404-622-0x00007FF8FB780000-0x00007FF8FBF1A000-memory.dmp

memory/2404-620-0x00007FF90C130000-0x00007FF90C13A000-memory.dmp

memory/2404-619-0x00007FF90C140000-0x00007FF90C151000-memory.dmp

memory/2404-618-0x00007FF90C210000-0x00007FF90C25D000-memory.dmp

memory/2404-617-0x00007FF90B950000-0x00007FF90BA1F000-memory.dmp

memory/2404-616-0x00007FF90BB40000-0x00007FF90BB57000-memory.dmp

memory/2404-615-0x00007FF90BED0000-0x00007FF90BEE7000-memory.dmp

memory/2404-614-0x00007FF8FC6A0000-0x00007FF8FC7B8000-memory.dmp

memory/2404-613-0x00007FF90BEA0000-0x00007FF90BEC2000-memory.dmp

memory/2404-612-0x00007FF90BEF0000-0x00007FF90BF04000-memory.dmp

memory/2404-611-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp

memory/2404-610-0x00007FF90C660000-0x00007FF90C670000-memory.dmp

memory/2404-609-0x00007FF90C000000-0x00007FF90C015000-memory.dmp

memory/2404-608-0x00007FF8FC7C0000-0x00007FF8FCB35000-memory.dmp

memory/2404-607-0x00007FF910AA0000-0x00007FF910AB9000-memory.dmp

memory/2404-606-0x00007FF90C020000-0x00007FF90C04E000-memory.dmp

memory/2404-605-0x00007FF8FCC00000-0x00007FF8FCD71000-memory.dmp

memory/2404-604-0x00007FF90C050000-0x00007FF90C06F000-memory.dmp