Malware Analysis Report

2025-03-15 03:46

Sample ID 241124-ah6cpazpgr
Target ElectronV3.exe
SHA256 fdb9f742ec550af9a8ca330f0a1d3aa012b1df6348e8182a52b6aac0f74a781b
Tags
pyinstaller exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fdb9f742ec550af9a8ca330f0a1d3aa012b1df6348e8182a52b6aac0f74a781b

Threat Level: Known bad

The file ElectronV3.exe was found to be: Known bad.

Malicious Activity Summary

pyinstaller exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer upx

Exela Stealer

Exelastealer family

Grants admin privileges

Modifies Windows Firewall

Clipboard Data

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Network Service Discovery

Legitimate hosting services abused for malware hosting/C2

UPX packed file

Hide Artifacts: Hidden Files and Directories

Enumerates processes with tasklist

Drops file in Program Files directory

Launches sc.exe

Event Triggered Execution: Netsh Helper DLL

System Network Connections Discovery

Browser Information Discovery

Unsigned PE

Permission Groups Discovery: Local Groups

System Network Configuration Discovery: Wi-Fi Discovery

Detects Pyinstaller

Suspicious use of WriteProcessMemory

Collects information from the system

Suspicious behavior: EnumeratesProcesses

Gathers system information

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Views/modifies file attributes

Enumerates system info in registry

Scheduled Task/Job: Scheduled Task

Runs net.exe

Gathers network information

Detects videocard installed

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-24 00:13

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-24 00:13

Reported

2024-11-24 00:15

Platform

win10ltsc2021-20241023-en

Max time kernel

30s

Max time network

35s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\81ededb3-b04d-41c4-872f-f2f96fb132ca.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241124001507.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4384 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
PID 4384 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe
PID 3528 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 4556 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4556 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3388 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3388 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1948 wrote to memory of 4784 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1948 wrote to memory of 4784 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3528 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3252 wrote to memory of 4112 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3252 wrote to memory of 4112 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3528 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 572 wrote to memory of 3080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 572 wrote to memory of 3080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4468 wrote to memory of 3672 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4468 wrote to memory of 3672 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3528 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 548 wrote to memory of 1092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 548 wrote to memory of 1092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3528 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 1864 wrote to memory of 3552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 1864 wrote to memory of 3552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3528 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3644 wrote to memory of 1700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3644 wrote to memory of 1700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3528 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 2176 wrote to memory of 2224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2176 wrote to memory of 2224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3528 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 5008 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 5008 wrote to memory of 2428 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 2196 wrote to memory of 4016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2196 wrote to memory of 4016 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3528 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 3528 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe C:\Windows\system32\cmd.exe
PID 1672 wrote to memory of 1968 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1672 wrote to memory of 1968 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe

"C:\Users\Admin\AppData\Local\Temp\ElectronV3.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""

C:\Windows\system32\schtasks.exe

schtasks /query /TN "ExelaUpdateService"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ReadExit.mht

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x140,0x150,0x7ffe8ca946f8,0x7ffe8ca94708,0x7ffe8ca94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff7992d5460,0x7ff7992d5470,0x7ff7992d5480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16443352593482903856,10242903408437928140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
N/A 127.0.0.1:49869 tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
N/A 127.0.0.1:49884 tcp
N/A 127.0.0.1:49892 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
N/A 127.0.0.1:49900 tcp
N/A 127.0.0.1:49902 tcp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 checkappexec.microsoft.com udp
US 162.159.136.232:443 discord.com tcp
GB 51.11.108.188:443 checkappexec.microsoft.com tcp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 172.165.69.228:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 228.69.165.172.in-addr.arpa udp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 172.165.69.228:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 data-edge.smartscreen.microsoft.com tcp
N/A 224.0.0.251:5353 udp
FR 2.18.40.153:443 www.bing.com tcp
US 8.8.8.8:53 153.40.18.2.in-addr.arpa udp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
N/A 127.0.0.1:56184 tcp
N/A 127.0.0.1:56186 tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
FR 2.18.40.144:443 th.bing.com tcp
FR 2.18.40.153:443 th.bing.com tcp
FR 2.18.40.153:443 th.bing.com tcp
FR 2.18.40.144:443 th.bing.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI43842\python310.dll

MD5 fc7bd515b12e537a39dc93a09b3eaad6
SHA1 96f5d4b0967372553cb106539c5566bc184f6167
SHA256 461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164
SHA512 a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

memory/3528-51-0x00007FFE8E4C0000-0x00007FFE8E92E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI43842\python3.DLL

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_ctypes.pyd

MD5 4b90108fabdd64577a84313c765a2946
SHA1 245f4628683a3e18bb6f0d1c88aa26fb959ed258
SHA256 e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1
SHA512 91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

C:\Users\Admin\AppData\Local\Temp\_MEI43842\libffi-7.dll

MD5 d50ebf567149ead9d88933561cb87d09
SHA1 171df40e4187ebbfdf9aa1d76a33f769fb8a35ed
SHA256 6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af
SHA512 7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

memory/3528-61-0x00007FFEA7370000-0x00007FFEA737F000-memory.dmp

memory/3528-59-0x00007FFEA1DA0000-0x00007FFEA1DC4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\base_library.zip

MD5 5c712503cdf703ab569b2397371c9723
SHA1 07d5109714feee34f7386072ac87f3f70289cab6
SHA256 a995fcaada1fc114583e23d14dd0f5deeb03edda005c9d57934346fc66837841
SHA512 c6a51c9e4e9aadde6bebb564181fb72928ec42ff3aed1833bb4676871eaf398b497bc03a0f1cdfbbd7545585d438763d19a5411ea5bcf021383fad1124307596

C:\Users\Admin\AppData\Local\Temp\_MEI43842\libcrypto-1_1.dll

MD5 86cfc84f8407ab1be6cc64a9702882ef
SHA1 86f3c502ed64df2a5e10b085103c2ffc9e3a4130
SHA256 11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307
SHA512 b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_uuid.pyd

MD5 59cfd9669367517b384922b2485cb6a7
SHA1 1bd44298543204d61d4efd2cd3980ad01071360d
SHA256 e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f
SHA512 d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_socket.pyd

MD5 53e72716073038c1dd1db65bfdb1254c
SHA1 7bf220a02a3b51aa51300b3a9ea7fa48358ca161
SHA256 e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d
SHA512 c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

memory/3528-89-0x00007FFE9DDC0000-0x00007FFE9DDED000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\sqlite3.dll

MD5 6a3a34c9c67efd6c17d44292e8db8fad
SHA1 339b1e514d60d8370eaec1e2f2b71cead999f970
SHA256 7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9
SHA512 6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

memory/3528-93-0x00007FFE9C5D0000-0x00007FFE9C741000-memory.dmp

memory/3528-95-0x00007FFE9D560000-0x00007FFE9D58E000-memory.dmp

memory/3528-100-0x00007FFE9D050000-0x00007FFE9D108000-memory.dmp

memory/3528-103-0x00007FFEA1DA0000-0x00007FFEA1DC4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_asyncio.pyd

MD5 7d4f9a2b793e021f7e37b8448751ed4e
SHA1 0ea07b5024501aad5008655cfeae6d96b5da957a
SHA256 2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4
SHA512 af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_overlapped.pyd

MD5 5c1441f6ee11632183a83dac2d22853b
SHA1 eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2
SHA256 104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf
SHA512 e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

memory/3528-112-0x00007FFE9D540000-0x00007FFE9D554000-memory.dmp

memory/3528-114-0x00007FFE9D520000-0x00007FFE9D534000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_brotli.cp310-win_amd64.pyd

MD5 94c13e0636646019a4c7d405c2d919df
SHA1 8ed8519e9b310f59e5b40f3c8fb675791cae09f9
SHA256 10517c02bb69dafd60053152e65d00c02e24952f63ca230af807ec6b2053f2a6
SHA512 82fba52c4db4206f7a1ebb1a3ebf12fc60f3deff4763fd5a059b00f46aa7513279da994a815a0883ce3301c3cdd1d20923db21b926c43b2ee732c28852979945

C:\Users\Admin\AppData\Local\Temp\_MEI43842\aiohttp\_http_parser.cp310-win_amd64.pyd

MD5 899af4aa2d81d3ef292518511b1dcec5
SHA1 a24d25f12b0e6cd68d4385f6227dcb686f223170
SHA256 533b97f4363ddd5a7d43cadd835404ff23b2ad9fe9a79fbed4b1ce9c12f0cebd
SHA512 cfec8c07c23a2a4ff29e366216494d48061be6c28ab0cde0fdaae04c648292170855491bee678116e9e76ccf3821781f776f03cf09896e5f0530c753999b0342

C:\Users\Admin\AppData\Local\Temp\_MEI43842\frozenlist\_frozenlist.cp310-win_amd64.pyd

MD5 6106b4d1eec11d2a71def28d2a2afa46
SHA1 e10039eff42f88a2cd8dfe11d428c35f6178c6ce
SHA256 19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da
SHA512 d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43

C:\Users\Admin\AppData\Local\Temp\_MEI43842\aiohttp\_websocket.cp310-win_amd64.pyd

MD5 6d0b455fc452f5ab428cca27ba603e46
SHA1 d3ff9006c48217306808c2bf3ab1cc5ba0505369
SHA256 e8129a7262e537ce6377d6e58f047ec5c69216e4a7bee588d4c69578bb01be8b
SHA512 48873a1ee4871f0ad0d28aa0f58ed027cd11484caa232de8534260a2fd231a58bec939d851a5ee6bba788d939b696485136c3ee24e8b9f94db9803dcab6b169e

memory/3528-140-0x00007FFE9D130000-0x00007FFE9D14E000-memory.dmp

memory/3528-139-0x00007FFEA24A0000-0x00007FFEA24AA000-memory.dmp

memory/3528-141-0x00007FFE8D9A0000-0x00007FFE8E13A000-memory.dmp

memory/3528-146-0x00007FFE9D240000-0x00007FFE9D257000-memory.dmp

memory/3528-145-0x00007FFE9D760000-0x00007FFE9D77F000-memory.dmp

memory/3528-144-0x00007FFE9C420000-0x00007FFE9C457000-memory.dmp

memory/3528-138-0x00007FFE9D150000-0x00007FFE9D161000-memory.dmp

memory/3528-137-0x00007FFE9C460000-0x00007FFE9C4AD000-memory.dmp

memory/3528-136-0x00007FFE9D170000-0x00007FFE9D189000-memory.dmp

memory/3528-135-0x00007FFE9C960000-0x00007FFE9CA2F000-memory.dmp

memory/3528-134-0x00007FFE9D190000-0x00007FFE9D1A7000-memory.dmp

memory/3528-133-0x00007FFE9D1B0000-0x00007FFE9D1D2000-memory.dmp

memory/3528-132-0x00007FFE9C4B0000-0x00007FFE9C5C8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\aiohttp\_http_writer.cp310-win_amd64.pyd

MD5 d77dcee3f14c440a8759afa058a12f89
SHA1 e106cb383a0116079e64d881efd172f2c1e53da4
SHA256 dcb467aad3b7281c04489c2fcb499a8f63b081d1388a8fde482a3392667e6391
SHA512 5327cc895467061159891e85da61dc6c0287a6961d820878d88b23514a81fdb7e01103e025e8e0cb74d3918725d128427c06c4749e7d33ad883ac0ed99335a6d

C:\Users\Admin\AppData\Local\Temp\_MEI43842\aiohttp\_helpers.cp310-win_amd64.pyd

MD5 543e83e6396cae6570f30eb0b07dbd85
SHA1 330c63d832b06cd94de04cdb9c3777b5fc0daf9c
SHA256 37f70d7409d0ff362ba1fdfc7717ed220f6b03cdbf04665b9a29a164cadc6384
SHA512 b5a7549d92c93861ba68b72f3d9e02de4c09b7ae41fba204604910c4e05bc88b8e32c40ae999cf3ccaabb3c6aee4618d285dc060c9f08a9a70d0ee31f1ff4d51

C:\Users\Admin\AppData\Local\Temp\_MEI43842\yarl\_quoting_c.cp310-win_amd64.pyd

MD5 e73b7c4ab697651094b83841e21370a0
SHA1 3093c418051c4d4e32ddb041ebcd7920cd77a191
SHA256 4ed26f8531dfb4a33d88ccb591a36fbbb25f28ce4720a92e840897316b01ac5d
SHA512 4846a981773c89bbdb5999e4472ec7f25d359e8bb16528a059b925078e0896d476e125b6cfede022a4ecce53cce30e001e2d1bcc90d03a0b2de29e6c6c8eba49

C:\Users\Admin\AppData\Local\Temp\_MEI43842\yarl\_helpers_c.cp310-win_amd64.pyd

MD5 15591df44ee64cb8772f1a5583465094
SHA1 7c75d1f1e234e00d0023d803642d4fedce3b7b80
SHA256 1de4a743bf1182dcfd04942696201ad1a3babd9455adafa2283709a1f3dcbaf1
SHA512 6f65bfcfdb155841ebc58494f947218a17e06b370c39b289cb86aba6d8f0ce9aab71bb8fe74b3c37f4049f99b9097718c718a337a2da2a98d6445fa24c143a6e

C:\Users\Admin\AppData\Local\Temp\_MEI43842\unicodedata.pyd

MD5 fed35db31377d515d198e5e446498be2
SHA1 62e388d17e17208ea0e881ccd96c75b7b1fbc5f7
SHA256 af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b
SHA512 0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_hashlib.pyd

MD5 3b5530f497ff7c127383d0029e680c35
SHA1 fb5dc554bb9ff49622184cc16883a7567115c7ca
SHA256 5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573
SHA512 12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

C:\Users\Admin\AppData\Local\Temp\_MEI43842\multidict\_multidict.cp310-win_amd64.pyd

MD5 7f691747ce66d3ed05a7c2c53220c8b5
SHA1 1d3f247042030cf8cf7c859002941beba5d15776
SHA256 7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228
SHA512 b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

memory/3528-110-0x00007FFEA2520000-0x00007FFEA2530000-memory.dmp

memory/3528-107-0x00007FFE9D710000-0x00007FFE9D725000-memory.dmp

memory/3528-106-0x00007FFEA4D70000-0x00007FFEA4D89000-memory.dmp

memory/3528-105-0x00007FFEA7370000-0x00007FFEA737F000-memory.dmp

memory/3528-102-0x00007FFE8E140000-0x00007FFE8E4B5000-memory.dmp

memory/3528-101-0x0000029572F20000-0x0000029573295000-memory.dmp

memory/3528-99-0x00007FFE8E4C0000-0x00007FFE8E92E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\libssl-1_1.dll

MD5 6cd33578bc5629930329ca3303f0fae1
SHA1 f2f8e3248a72f98d27f0cfa0010e32175a18487f
SHA256 4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0
SHA512 c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_ssl.pyd

MD5 7e9d95ac47a2284706318656b4f711d3
SHA1 f085104709201c6e64635aeacf1da51599054e55
SHA256 38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9
SHA512 294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

memory/3528-91-0x00007FFE9D760000-0x00007FFE9D77F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_sqlite3.pyd

MD5 e7d68df8f65fbb0298a45519e2336f32
SHA1 ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d
SHA256 2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79
SHA512 626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_lzma.pyd

MD5 8edbeeccb6f3dbb09389d99d45db5542
SHA1 f7e7af2851a5bf22de79a24fe594b5c0435fca8a
SHA256 90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f
SHA512 2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

memory/3528-87-0x00007FFEA19D0000-0x00007FFEA19E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_bz2.pyd

MD5 6250a28b9d0bfefc1254bd78ece7ae9f
SHA1 4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd
SHA256 7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b
SHA512 6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

memory/3528-85-0x00007FFEA63E0000-0x00007FFEA63ED000-memory.dmp

memory/3528-84-0x00007FFEA4D70000-0x00007FFEA4D89000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI43842\select.pyd

MD5 3797a47a60b606e25348c67043874fe8
SHA1 63a33fedffd52190236a6acd0fc5d9d491e3ac45
SHA256 312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac
SHA512 3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_queue.pyd

MD5 5c4c43763fb1a796134aa5734905c891
SHA1 44a5e1ae4806406a239129d77888bd87d291a410
SHA256 4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c
SHA512 07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_multiprocessing.pyd

MD5 4fbc5fd5da9da74c04fe0374387b34d3
SHA1 1e9c98db0486f98fb7d8eb9fa57a949494b649b5
SHA256 b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950
SHA512 ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_decimal.pyd

MD5 20985dc78dbd1992382354af5ca28988
SHA1 385a3e7a7654e5e4c686399f3a72b235e941e311
SHA256 f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43
SHA512 61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

C:\Users\Admin\AppData\Local\Temp\_MEI43842\_cffi_backend.cp310-win_amd64.pyd

MD5 7727212e7bdbf63b1a39fb7faad24265
SHA1 a8fdec19d6690081b2bf55247e8e17657a68ac97
SHA256 b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c
SHA512 2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

C:\Users\Admin\AppData\Local\Temp\_MEI43842\pyexpat.pyd

MD5 46331749084f98bcfe8631d74c5e038f
SHA1 5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347
SHA256 21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df
SHA512 edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

memory/3528-147-0x00007FFE9C5D0000-0x00007FFE9C741000-memory.dmp

memory/3528-152-0x00007FFE9D560000-0x00007FFE9D58E000-memory.dmp

memory/3528-156-0x00007FFE9D050000-0x00007FFE9D108000-memory.dmp

memory/3528-157-0x0000029572F20000-0x0000029573295000-memory.dmp

memory/3528-162-0x00007FFE8E140000-0x00007FFE8E4B5000-memory.dmp

memory/3528-200-0x00007FFE9C950000-0x00007FFE9C95D000-memory.dmp

memory/3528-199-0x00007FFE9D710000-0x00007FFE9D725000-memory.dmp

memory/1968-201-0x0000015B14E80000-0x0000015B14EA2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldxvxhft.kwt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3528-215-0x00007FFEA2520000-0x00007FFEA2530000-memory.dmp

memory/3528-218-0x00007FFE8E4C0000-0x00007FFE8E92E000-memory.dmp

memory/3528-245-0x00007FFE9C420000-0x00007FFE9C457000-memory.dmp

memory/3528-239-0x00007FFE9D170000-0x00007FFE9D189000-memory.dmp

memory/3528-230-0x00007FFE9D710000-0x00007FFE9D725000-memory.dmp

memory/3528-240-0x00007FFE9C460000-0x00007FFE9C4AD000-memory.dmp

memory/3528-244-0x00007FFE8D9A0000-0x00007FFE8E13A000-memory.dmp

memory/3528-237-0x00007FFE9D190000-0x00007FFE9D1A7000-memory.dmp

memory/3528-236-0x00007FFE9D1B0000-0x00007FFE9D1D2000-memory.dmp

memory/3528-226-0x00007FFE9C5D0000-0x00007FFE9C741000-memory.dmp

memory/3528-225-0x00007FFE9D760000-0x00007FFE9D77F000-memory.dmp

memory/3528-219-0x00007FFEA1DA0000-0x00007FFEA1DC4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f6126b3cef466f7479c4f176528a9348
SHA1 87855913d0bfe2c4559dd3acb243d05c6d7e4908
SHA256 588138bf57e937e1dec203a5073c3edb1e921c066779e893342e79e3d160e0b4
SHA512 ef622b26c8cee1f767def355b2d7bffb2b28e7a653c09b7e2d33f6468a453fff39fd120cacbffd79ce35722592af0f3fb7d5054e2dca06310e44dc460533f3d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dda6e078b56bc17505e368f3e845302
SHA1 45fbd981fbbd4f961bf72f0ac76308fc18306cba
SHA256 591bf3493eb620a3851c0cd65bff79758a09c61e9a22ea113fa0480404a38b15
SHA512 9e460013fd043cee9bdbcdaf96ac2f7e21a08e88ddb754dddbd8378ee2288d50271e66b42092d84a12e726469465185be11a6fafab6ed4236a244524bd60f502

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 90cc75707c7f427e9bbc8e0553500b46
SHA1 9034bdd7e7259406811ec8b5b7ce77317b6a2b7e
SHA256 f5d76f8630779de1fe82f8802d6d144861e3487171e4b32e3f8fffd2a57725fb
SHA512 7ad692bce11aee08bf65bb7c578b89a4a3024211ee1deaf671c925d65cc016943f2caad3d57b365e16d1764c78c36cae35c3c45cef0928dd611a565b0313e511

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7d0d4b7fd2ba11ff9a903f497dd96e72
SHA1 c426b45898657f9d2d9952602597d7ca737dfb4e
SHA256 5ed00391bff966f9ffc027ac57dfdc53b8c97a474da8ef18ad3a3c746e6fac34
SHA512 099194d173c2903b0849e8b9b0436951a37e2469a7c8287f005422ff1c7df3582846625d91473d2106c0a2d22bfd72d9ac1cea9a6651d7e3cb3de3aeadf2ffc5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

memory/3528-357-0x00007FFE8E4C0000-0x00007FFE8E92E000-memory.dmp

memory/3528-366-0x00007FFE9D560000-0x00007FFE9D58E000-memory.dmp

memory/3528-378-0x00007FFE9D170000-0x00007FFE9D189000-memory.dmp

memory/3528-375-0x00007FFE9D1B0000-0x00007FFE9D1D2000-memory.dmp

memory/3528-369-0x00007FFE9D710000-0x00007FFE9D725000-memory.dmp

memory/3528-367-0x00007FFE9D050000-0x00007FFE9D108000-memory.dmp

memory/3528-368-0x00007FFE8E140000-0x00007FFE8E4B5000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 d7e3e1e9373b80fcf7256519aa2bff31
SHA1 a7d67188b44a724c0d6a3b3d3f5757af72d3daf4
SHA256 e4cb825eafa5f61ad150529f65f51667c33306e11e7c630e3026775e9234efe6
SHA512 66ad770cb85b87a48ef3003b14a1b2dba2c8e083777ebfeb6abe9d7dc5c12630c4a3d2fca0a14b16c05012dd751eeb6023b382bac3a7a65cbd0e8403eb94939f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 e526600aa68e46e8278ed0eb19891493
SHA1 7fd4850582853d408544ca5f26c51386805fa101
SHA256 85b96fcf35f1c4aa7cc4749b4e17c194fd120d2983f152d1efcbed506abe74c8
SHA512 dd73e0868d103c4834c53d1b512ee4fa41cd6149ed18325fa18fa23ce67ea13efa5353e7364b424ff87c3bda49f4387066dc5cdbf0b6590909e2a5420077ec56

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConnectRegister.xlsx

MD5 51c953521a8dae3d608e7221aad99542
SHA1 f520b3c5586e32b074383f3d49794c5d4bf8bb51
SHA256 37fd0cbb2f2ea740a4c73989ea97a1338bc80d2dd2e1a2c005ca24340dd3f97b
SHA512 24ce1a24bb7a79c0eb752c3dc59fdc1ecfe07566aa69b59a42b63d46e4968a0c959d716d977e79b2c5ba01cd1faf6b3e550316707f4ab3411d543562cf301f20

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\GroupLock.xlsx

MD5 5c70143c4a21afd490c735c38fc134e1
SHA1 91d008c625869f128a9cc6453addb9849638a3b6
SHA256 ef13065278b49bc6439fbbbb069106ac8a65c963fdadd3f36c28f7aa9a06b6f9
SHA512 0444762d15528400f0d02142f91c015066edae41e65fbd90b81c3e0fcc76582d24906b8d486485e4ae074c48c6e2f7144d1f3e9442b36b42f3dfd84fb712a6fc

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\InstallProtect.png

MD5 3b6a24f554f10040ffb4f43efd420ca4
SHA1 cd19cce65206897f77ff0f43455c7774445b5e91
SHA256 87f186d0aa45f07974466fee6dcd3cc6a042cd57632b1c653eee2dae7d7f8624
SHA512 07116aef9e76a8b7bd40a347c7a67b908fdf7ae980b47d69600cd9ece40ea83ef15dbdf3746feacf34087f6527ffe60d5964e57518ce72002de95c7506b598f1

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\PushConvertTo.doc

MD5 af960aaeacd9fe14bb9b2e8f70d7d054
SHA1 8f58d5dfc5914913084bd0ca8f722c5d02a69afe
SHA256 6b923343df6c1834ee1738ab5494348a6e1d3071dfe36534eeee1de397d143af
SHA512 6b2974532913b38f3db44ce2f9f9b0fd45787c0cc55e2cc2aad1a6412151652ccec00aa04f54e1c824a3fecb77c8ccc08f8cc8e444a80d14e7dbe111a9c4ced5

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RenameConvertFrom.jpg

MD5 33202dbdc6b617d85025a0e266f3ffac
SHA1 c887430a9b62ec16477ea76cd9301749c292f8ee
SHA256 bab8583bab90cd5268ede843514aae22851cd6a767d6b0f2340bfd9236abd199
SHA512 7009d6dfe3724ff7278b174edfa6b4495a5a921b5ef6622e3bd80ddc7df58d21d5439a325aebe44023c56d04ce09975a2fda7aa05a20989bc8bbc4087a7f5093

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ReadRename.xlsx

MD5 2427f40c76d71021bf4bbd42abae95b6
SHA1 d19e64305912f6503aa877349816c9a5c18188d4
SHA256 27c9116f862fc06d6290564416d014f80eaee644867af101ffb274f9ad1d7deb
SHA512 4ee2f35e0b92932c8c5d4f0479065ba73bd16fcb88ae9db88962b90d44fccb9e0aff154a7f4c41b5fb61fd97a43eac2076fd1baa9299060614d8624c93ec2242

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ResizeLimit.png

MD5 66ade1b272568bf954f899fb2924f3f9
SHA1 a975f56bf00d200e2d34ec173c8d74c2734dfd44
SHA256 450e9744eb060d56ce8feecb8a0d85aaf38c6b34f268b5552dd1a223c7d2f100
SHA512 fcc40bb8306e721ec6c1bd7306d0dd588ec684af2866398239da5b1c8cc5414351a6fac5ca40591fc731fdfa2da3a793a374bbbe8b28580ad90128265bc9b49f

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UnregisterGet.zip

MD5 5c730e4c1ef353a4b766fe1fac08cb14
SHA1 4ae1d85642a02c530c21dd587444e75823f95138
SHA256 458362df43f7aafba5e88884912f440bceea1758dcad833c5dbc02e95ff0a727
SHA512 1d61df4493ba4ac3b105f7364c22e0146b3653bce2b7ccb858d233779965ef91c5e9f0d8f81d81571eaf5f4d4dfb54fb55d2f33bbf6363a284d4eb3cb73c4f32

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UseCompare.docx

MD5 5294012a0e77cd0501b04fae04b68364
SHA1 b69bfa5a0d7d45f277451014f1e4e4ce77249ca4
SHA256 4000a222b4104690ba459cc935fa1bf7d6064f9cc8577203628a8c7b1839705c
SHA512 0b84abe44bf979c0b0d64dd359af02159b356ab07cee09b16217e45b628866f7f69eded154a00be1097508ed4ab6d0e1b36797970bc61f52d16b4053bdfc3be2

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UnregisterInstall.xlsx

MD5 c6aa0fb60416d3c8b165050941f40194
SHA1 e705503bdbe1dbffd2ee3895f1e6450537679a47
SHA256 6b7786b6442088d3608f9174663e33265b690f8bdfb3b82c847b0eedeec8430d
SHA512 757bd69edfcecfbd1f0eccc3d982aa0e044301da919813acc00a233d24bc4ba8fdbc5ed361ad0598a0195d8778b5f306d0bc23fb73a80c997aff1159e33b4560

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BackupFind.xltm

MD5 74e5df4a63c623e7162249e9f21ef36d
SHA1 2a40ca6a1718a0bfad53290e7dac2d348304fef2
SHA256 37bb9f6692f41d86b43a7c16f8370f9d241f3e0f787fc67eacee3e3a8279639f
SHA512 ab30e296ad36bc75e2221177492d67730978700a21b8f241b2dd3690d74dc9f358ab87f28fc3a352a8172b39ddad19d174cd4b5b5671c909302daf99ecc69d63

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\WriteLimit.docx

MD5 c6ea5a698a99bba87e55d428775141cc
SHA1 0efbd42a15188442858c9afd421b8e3a2f913af3
SHA256 7ce626d4a36360bffe7dfaa2a22f105cc47292d7e5e0de760588a8cf243999c9
SHA512 f1dff1b926ccb250d3a4a99b76dd1f94d50548b38233926e889e423d9a35aa4667f0b6239295e431ea062ca0ab6a7ef351506d22501fe4b62d5a125e94988cdc

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BackupRedo.mhtml

MD5 7556a095c16a1dbd22e67e8d01b692f7
SHA1 ba48f890d9fd59d0c3c0c837f1dc0216e9e728bd
SHA256 db1644918f604605c7b43339cb0271f5a94e48ff23d481db04390151c1e3aff6
SHA512 995450778420a6c8d9d3ae02ee26ae81b39734cfae797231b0d16fc167a1480e5080c65d587d572100edc3e06578d8986b18b27a88b58be9f2c138c469e67eaf

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BackupRequest.txt

MD5 0367154b97717ef7912899a690e91ed3
SHA1 6238c6964f3c23d0e4d2126697c1fbbbbf5e2b12
SHA256 b4e7c4aed8afce0bcc457ef3fe9846be51c0b1029175281678ec674b1803b15c
SHA512 9321114d8cb826611e1e867ee8b15d5098daaf20029b896372a042b160afc51edde45d3ca95c1ceb35c62f3facf66fef33c95fc093cdd06e7c93028e82f0fbfd

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SendBackup.ods

MD5 a99e9d181166c3e9c6794ad0e988e127
SHA1 1a26605c8992ddef07b518b0a5c1c136a6015bf4
SHA256 1f7f61676265cbb85b59f45bedf1378ec97ea192488c6e710ad0317ef4f74e1c
SHA512 e40281b81a49057d399a4aa41443603fd67ed5c2bc1f0f27b84f1ebd00be853e26176fd61fae038a384809aaa0903c5f35d86798cefc9a096a29259fcffc0f0c

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UseBackup.wps

MD5 bb28a902c9b5c5870a3103dd18ddca48
SHA1 544cf02180b7b921b734c625b1600e1d929d0a78
SHA256 457cad2643d4f3421c6d654eaef9d3f1249d9ad4a45b3bad8ef0b591e029bbea
SHA512 5b71898e272ba11deffe87a78c1392e65c3f42a767d7cc261f4753ec51192489cf19c8f76a112abf9dddca0c891583bf2f908295cee130391cb671b514c88e43

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\MergeUndo.xlsx

MD5 99f0e6e05446161dad78704b15d86d41
SHA1 32cf7ce99270f296be834e40d75bb2199fb833cd
SHA256 18b1d22cba135dcea830b195ef608fcf00bb5d4ae062fe07b38c5ca37a38c7bc
SHA512 177076b01a52924b0b27b2455c19ca2ce864409852c7d28e7edda72d399f9bc0b55bed0ca076ec9714008d9afc48412f720e7c41b5852df2e5c68994c0a083ac

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\GroupMeasure.csv

MD5 b8ebc85ebc74c5ffbb51479784129cf9
SHA1 b3b4a4950f20729867b94119f23c74a9eddaf845
SHA256 083d803a784cdf91797e737985f4d196390b66e8aa7160e312754fa28dd5da62
SHA512 e865a2aff5129598f6546e6816ee4a8edc3615e3d9ec85397690eadf2114e538c9615e846cf58047f2fb0137703cfb39f92918802746a0e77ebc0f5b9c6c13b1

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\PopPing.pdf

MD5 0be4b84d329296f3b7115c335c0fdad6
SHA1 710cb2ba49d0277e9891c4e97a967b863a48f8c9
SHA256 95a83399b18d6a2fae74799cd6303d36ed307355704d705304f8f30d7ce72baa
SHA512 9b2863cf3bae589ebc96003fdfa80d1d794f11f130cd400ddc4df8582eb073a6de7eb04adc075748b74b0a1eaab98c1c05f4cc22d7a9ce9b34487854fac22536

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\UnregisterMove.xls

MD5 c3bf0f40579ab5bc8b4db4f4ead73382
SHA1 4bd109bf8419a6d2c77f439493d6b65ff0faa61a
SHA256 5be0520504f8d0c5ec8d22cabaf4d9b4497b5478411546d395eb8b9a9ff99d4a
SHA512 0a6dce2e2b34c971f8c05f554d8cd82e1ff29d08983da9d077db514497b3ad03251adf4223c93c8954d34f54a90f0bd14ebfc2e3971714649245893ad9a68718

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\WatchBackup.ods

MD5 71dd38ecf11a16bfa5f57b46e0205a24
SHA1 8700ccce723e58272882e374c0534262b5ed7361
SHA256 94edad6786c5f4a6a75843551e6504e3a4b72d82cb680e8ce3398068763660f6
SHA512 d105eaf14bda7bfe947522dadece43465c81f3ff8fdffaf5d90daa5318f231857266e0726411acc71e159d0c43dd0cd4092eac336724bc96a7e73818acb13375

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\DenyRestart.jpeg

MD5 5a5d39054aa458c8604b302c550bf2e7
SHA1 38fd87d3a244d04e1998139fd72d70dabbfc6c80
SHA256 e57b11f30eccd4d7462a3a301f05e3e99ffaa1e893fca284a61696553497796b
SHA512 f85bd40fbf26cd38e6059db92c515cca363a35b3587e91363abab27788d4d415116610dd4af637108538e8da8d90a8a7284a8c5e4954e48a4ca1cb8438d7a67b

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ExportBlock.jpg

MD5 ba846745e8812052b27a851f913ee874
SHA1 0aacaf998e0befcdd349f74b2da2842071df998d
SHA256 019889765589e572701eafa4948ffea1123c2053d5232347261832c6e77d452e
SHA512 9f3ce12d5fdb3e71273889294228a488d555faa5f29480d31a40d510904a83ad3834e0e627bb1f1f2f2c1425236fb7dc0eed4fea83084201b262947c2838ca2c

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\CopyUpdate.zip

MD5 5522c45e68aa7dfbb48629268992e15c
SHA1 79aa9bdc810877bf43167712e07d9642d9e4e931
SHA256 43c781b997f7a2bc91677f97aa0ec6a8014fa43315b4aaa1dbc4e72c3af28b09
SHA512 cf40a2684fa46a4eb4b629e20cdda7b37702e5f09a5e2112b1cdfca28c43c314cc41fdb6a0fca7e293651bf4a02ac66a3943bb18161d87efaaed46fa453ea427

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\JoinGrant.mp3

MD5 2cff9420e42f0b11511bad03c20be53e
SHA1 c015215023c5b457cbbf67b411ee71648c37c1d1
SHA256 9672216f684f3fb5f161ad284d3c6ec5677ea1f559723daa18107b37810a5dc2
SHA512 7587df1cd54ae989ccab4fcbb0bd8385febb7f50aba7e5152c3252b9eacce302771709070f8bb9b00588db58dcfe8c530bd6010136c83211da44a61ed3a825e9

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CompressExpand.jpeg

MD5 2a6ef1763cb77edfbc51b9e4a92cd360
SHA1 f5d3cbbb4f2c1aeeeabb4156901da8a3559a49ff
SHA256 7ae4888ee6db0aaee5272e0d5de296631d8e75528fa065fb818d51a540f4b1a2
SHA512 bd26f0231860d8a26f46749f69bb2853d1b22287f25b5312ec9ea1897d56c4a3f1b901efe1ba9dd5b46f4cd80c910981ec35829c9fa26680a5f6fb427407fa32

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\DebugBackup.tif

MD5 6e40015d348f514d2de43b35cf69e9aa
SHA1 4ecd3e9f6f3d5da2943b1f6e8be4c18a0b2677f2
SHA256 295213cf7a297d2c16e9238033825d3e3c32ff75b299ab8de90811211bcc6377
SHA512 f87a77132197321d0f412dad49fd8c9c275bcff49ca08c0b0e1fa3cec43f205bc0de55c51ce6532773517dcf58b0d0c1fe423221e93e51eaa7a7a0fde92d1335

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\EnableBackup.emf

MD5 93e84923f61819e4e5b64a7592bb3cb0
SHA1 86e2b922e0a83cd7fda1b6d79d0c473d65577341
SHA256 507eb950b8601ad6f5f2534a685d8a37c0bc45889d1f4a0d13412981e7542a68
SHA512 263d96a21157e42c27fcab60b6011d32e9041493710b9fad3b472f68a2ccd2367ed2551dbd1fefb310e5b5f198dbf8966ca867dc45ee6ec05d08e301ecb7d968

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\InstallSet.jpg

MD5 bf91039b9e053d3ae793a855699a07cb
SHA1 f40ff8005c45d90349531ebbc68b22a6a1f3583a
SHA256 46ba3374989da0550b6c890e03bd938f37b719e40e5fc45de8b32970f9531ba5
SHA512 f918df0a37ae5f4cde893e3ba0bf2adf4d825280afb6edb62221233170e511fe1a0eabc5bf4873619fc994c2293a809fa9346a1e879e74416bd710448550c7d1

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SelectFind.jpg

MD5 1138ce3b33db3abee4854ffcbbd587ec
SHA1 3436dc66c11062358d8f077e0124b48473218b59
SHA256 8e986adda02f75638e676ae37eca573d50a589184ae774b28d896191d5779f61
SHA512 e9bb58277aed64f7d5371ea219d797e3ad09150b881b4395f281426877c5764a55fc90e9b7ecb4d2168b3c4a774b9cdb65a51916fe9668daedeeb7ead43ee887

C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a743d55d-78fe-413e-b1fc-e68cb77b6d49.tmp

MD5 47d8e8fc29039f5da1856ea038129044
SHA1 fcb121ab041cce71a77223a47678486cec72dab7
SHA256 2683e10f374da8f4d05fddef6be274003b1834117c8151a320b2ae46fbdbb7b7
SHA512 31770336393b6e0a1e226a878a1c766b3dcf9ab379e1af2cd55b75ea2f22768f7368f941d8f2db2f9be37470df89e3337bb962b23e03f750635c175bd98b165c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e081e0b3cd41d50ea06c83141731182c
SHA1 5f6987270f824f1d14707768e2f2c8a266334ef0
SHA256 321cea4caafb41c5fe113c516a804432ec3d9deaff37bee8900ec2032d219ae6
SHA512 23d0fedd2db69abd057e0fffb74d4589539b3f88381a1b0e073e40e25f4fbc722f808c78d2854dc964fdd28ac68807bb3975486f2be4a8a69ad40b6dd6b1b81c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 0d8c8c98295f59eade1d8c5b0527a5c2
SHA1 038269c6a2c432c6ecb5b236d08804502e29cde0
SHA256 9148e2a2ba2a3b765c088dc8a1bdcc9b07b129e5e48729a61ebc321cb7b8b721
SHA512 885a734a97a6f8c4a8fb5f0efa9fe55742f0685210472ed376466e67f928e82ddf91ba1211389d9c55dd1e03dc064aa7a81d1fca3cf429fbaf8f60db8b1348c6