exelastealer | 784bcea5c7347a78e18b915f9e9d2d9ded3cb64dfbbe6a3a6b13faa2fe385ee6

Analysis

max time kernel
104s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2025, 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe
Size

12.3MB
MD5

9a93c1a62dd491268ba09d507bdf79c9
SHA1

c4248379666cad4072a23d9f5d69183c678b72a9
SHA256

784bcea5c7347a78e18b915f9e9d2d9ded3cb64dfbbe6a3a6b13faa2fe385ee6
SHA512

b1f59b6003f9a7c16fa1690fa970c62d97b1106681f715d346caff8782845eda5ea2ac29cc33d89da0b431f325b10449f49eaa86b2d3146f0a6dcbc08456096c
SSDEEP

196608:90Q7prm7JBfuknqkPYezurErvI9pWj+LPvzmesaXCeEOKRIUGOr/kqXC0:5AtuSTurEUWjI3zzyexIIUGOr/kqXC0

Score

10^/10

exelastealer collection defense_evasion discovery persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1708	netsh.exe
3976	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5912	cmd.exe
2036	powershell.exe

Deletes itself 1 IoCs

pid	Process
5328	Exela.exe

Executes dropped EXE 3 IoCs

pid	Process
3508	Nurlan.exe
5432	Exela.exe
5328	Exela.exe

Loads dropped DLL 33 IoCs

pid	Process
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe
5328	Exela.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
44	discord.com
45	discord.com
46	api.gofile.io
47	api.gofile.io
81	discord.com
84	api.gofile.io
86	discord.com
43	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5264	cmd.exe
1004	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5444	tasklist.exe
1636	tasklist.exe
2068	tasklist.exe
1996	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2536	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5328-116-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp	upx
behavioral1/files/0x000700000002432a-113.dat	upx
behavioral1/files/0x00070000000242d1-118.dat	upx
behavioral1/memory/5328-124-0x00007FF803380000-0x00007FF8033A4000-memory.dmp	upx
behavioral1/memory/5328-171-0x00007FF80C9D0000-0x00007FF80C9DF000-memory.dmp	upx
behavioral1/memory/5328-172-0x00007FF803360000-0x00007FF803379000-memory.dmp	upx
behavioral1/memory/5328-173-0x00007FFFFA820000-0x00007FFFFA84D000-memory.dmp	upx
behavioral1/memory/5328-176-0x00007FFFFA7F0000-0x00007FFFFA813000-memory.dmp	upx
behavioral1/memory/5328-175-0x00007FF80C9C0000-0x00007FF80C9CD000-memory.dmp	upx
behavioral1/memory/5328-174-0x00007FFFFAE10000-0x00007FFFFAE29000-memory.dmp	upx
behavioral1/files/0x000700000002432e-170.dat	upx
behavioral1/memory/5328-179-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp	upx
behavioral1/memory/5328-182-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp	upx
behavioral1/memory/5328-181-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp	upx
behavioral1/memory/5328-178-0x00007FFFF3320000-0x00007FFFF33ED000-memory.dmp	upx
behavioral1/memory/5328-177-0x00007FFFF33F0000-0x00007FFFF356E000-memory.dmp	upx
behavioral1/files/0x000700000002432c-169.dat	upx
behavioral1/files/0x000700000002432b-168.dat	upx
behavioral1/files/0x0007000000024328-167.dat	upx
behavioral1/files/0x0007000000024323-166.dat	upx
behavioral1/files/0x0007000000024321-165.dat	upx
behavioral1/files/0x0007000000024322-123.dat	upx
behavioral1/memory/5328-183-0x00007FF803380000-0x00007FF8033A4000-memory.dmp	upx
behavioral1/memory/5328-184-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp	upx
behavioral1/memory/5328-185-0x00007FFFF5150000-0x00007FFFF5162000-memory.dmp	upx
behavioral1/memory/5328-186-0x00007FFFF4BC0000-0x00007FFFF4BD4000-memory.dmp	upx
behavioral1/memory/5328-187-0x00007FFFF2AF0000-0x00007FFFF2B04000-memory.dmp	upx
behavioral1/memory/5328-189-0x00007FFFF2AC0000-0x00007FFFF2AE2000-memory.dmp	upx
behavioral1/memory/5328-188-0x00007FFFFAE10000-0x00007FFFFAE29000-memory.dmp	upx
behavioral1/memory/5328-190-0x00007FFFF29A0000-0x00007FFFF2ABC000-memory.dmp	upx
behavioral1/memory/5328-193-0x00007FFFF2980000-0x00007FFFF299B000-memory.dmp	upx
behavioral1/memory/5328-191-0x00007FFFFA7F0000-0x00007FFFFA813000-memory.dmp	upx
behavioral1/memory/5328-194-0x00007FFFF3320000-0x00007FFFF33ED000-memory.dmp	upx
behavioral1/memory/5328-200-0x00007FFFF2700000-0x00007FFFF274D000-memory.dmp	upx
behavioral1/memory/5328-199-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp	upx
behavioral1/memory/5328-198-0x00007FFFF24D0000-0x00007FFFF2502000-memory.dmp	upx
behavioral1/memory/5328-197-0x00007FFFF26E0000-0x00007FFFF26F1000-memory.dmp	upx
behavioral1/memory/5328-196-0x00007FFFF2750000-0x00007FFFF2769000-memory.dmp	upx
behavioral1/memory/5328-195-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp	upx
behavioral1/memory/5328-201-0x00007FFFF26C0000-0x00007FFFF26DE000-memory.dmp	upx
behavioral1/memory/5328-202-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp	upx
behavioral1/memory/5328-203-0x00007FFFF1CD0000-0x00007FFFF24CC000-memory.dmp	upx
behavioral1/memory/5328-204-0x00007FFFF2680000-0x00007FFFF26B7000-memory.dmp	upx
behavioral1/memory/5328-248-0x00007FF803350000-0x00007FF80335D000-memory.dmp	upx
behavioral1/memory/5328-265-0x00007FFFF2AC0000-0x00007FFFF2AE2000-memory.dmp	upx
behavioral1/memory/5328-266-0x00007FFFF29A0000-0x00007FFFF2ABC000-memory.dmp	upx
behavioral1/memory/5328-267-0x00007FFFF2980000-0x00007FFFF299B000-memory.dmp	upx
behavioral1/memory/5328-296-0x00007FFFF24D0000-0x00007FFFF2502000-memory.dmp	upx
behavioral1/memory/5328-292-0x00007FFFF1CD0000-0x00007FFFF24CC000-memory.dmp	upx
behavioral1/memory/5328-291-0x00007FFFF26C0000-0x00007FFFF26DE000-memory.dmp	upx
behavioral1/memory/5328-288-0x00007FFFF2700000-0x00007FFFF274D000-memory.dmp	upx
behavioral1/memory/5328-281-0x00007FFFF5150000-0x00007FFFF5162000-memory.dmp	upx
behavioral1/memory/5328-280-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp	upx
behavioral1/memory/5328-279-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp	upx
behavioral1/memory/5328-278-0x00007FFFF3320000-0x00007FFFF33ED000-memory.dmp	upx
behavioral1/memory/5328-277-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp	upx
behavioral1/memory/5328-276-0x00007FFFF33F0000-0x00007FFFF356E000-memory.dmp	upx
behavioral1/memory/5328-295-0x00007FFFF2750000-0x00007FFFF2769000-memory.dmp	upx
behavioral1/memory/5328-293-0x00007FFFF2680000-0x00007FFFF26B7000-memory.dmp	upx
behavioral1/memory/5328-268-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp	upx
behavioral1/memory/5328-269-0x00007FF803380000-0x00007FF8033A4000-memory.dmp	upx
behavioral1/memory/5328-307-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp	upx
behavioral1/memory/5328-326-0x00007FFFF2750000-0x00007FFFF2769000-memory.dmp	upx
behavioral1/memory/5328-319-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4496	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00070000000242cb-11.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nurlan.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3636	cmd.exe
4620	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2988	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
2372	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3888	ipconfig.exe
2988	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4492	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2036	powershell.exe
2036	powershell.exe
2036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1036	WMIC.exe
Token: SeSecurityPrivilege	1036	WMIC.exe
Token: SeTakeOwnershipPrivilege	1036	WMIC.exe
Token: SeLoadDriverPrivilege	1036	WMIC.exe
Token: SeSystemProfilePrivilege	1036	WMIC.exe
Token: SeSystemtimePrivilege	1036	WMIC.exe
Token: SeProfSingleProcessPrivilege	1036	WMIC.exe
Token: SeIncBasePriorityPrivilege	1036	WMIC.exe
Token: SeCreatePagefilePrivilege	1036	WMIC.exe
Token: SeBackupPrivilege	1036	WMIC.exe
Token: SeRestorePrivilege	1036	WMIC.exe
Token: SeShutdownPrivilege	1036	WMIC.exe
Token: SeDebugPrivilege	1036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1036	WMIC.exe
Token: SeRemoteShutdownPrivilege	1036	WMIC.exe
Token: SeUndockPrivilege	1036	WMIC.exe
Token: SeManageVolumePrivilege	1036	WMIC.exe
Token: 33	1036	WMIC.exe
Token: 34	1036	WMIC.exe
Token: 35	1036	WMIC.exe
Token: 36	1036	WMIC.exe
Token: SeDebugPrivilege	1996	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1036	WMIC.exe
Token: SeSecurityPrivilege	1036	WMIC.exe
Token: SeTakeOwnershipPrivilege	1036	WMIC.exe
Token: SeLoadDriverPrivilege	1036	WMIC.exe
Token: SeSystemProfilePrivilege	1036	WMIC.exe
Token: SeSystemtimePrivilege	1036	WMIC.exe
Token: SeProfSingleProcessPrivilege	1036	WMIC.exe
Token: SeIncBasePriorityPrivilege	1036	WMIC.exe
Token: SeCreatePagefilePrivilege	1036	WMIC.exe
Token: SeBackupPrivilege	1036	WMIC.exe
Token: SeRestorePrivilege	1036	WMIC.exe
Token: SeShutdownPrivilege	1036	WMIC.exe
Token: SeDebugPrivilege	1036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1036	WMIC.exe
Token: SeRemoteShutdownPrivilege	1036	WMIC.exe
Token: SeUndockPrivilege	1036	WMIC.exe
Token: SeManageVolumePrivilege	1036	WMIC.exe
Token: 33	1036	WMIC.exe
Token: 34	1036	WMIC.exe
Token: 35	1036	WMIC.exe
Token: 36	1036	WMIC.exe
Token: SeDebugPrivilege	5444	tasklist.exe
Token: SeDebugPrivilege	1636	tasklist.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	WMIC.exe
Token: SeSecurityPrivilege	2372	WMIC.exe
Token: SeTakeOwnershipPrivilege	2372	WMIC.exe
Token: SeLoadDriverPrivilege	2372	WMIC.exe
Token: SeSystemProfilePrivilege	2372	WMIC.exe
Token: SeSystemtimePrivilege	2372	WMIC.exe
Token: SeProfSingleProcessPrivilege	2372	WMIC.exe
Token: SeIncBasePriorityPrivilege	2372	WMIC.exe
Token: SeCreatePagefilePrivilege	2372	WMIC.exe
Token: SeBackupPrivilege	2372	WMIC.exe
Token: SeRestorePrivilege	2372	WMIC.exe
Token: SeShutdownPrivilege	2372	WMIC.exe
Token: SeDebugPrivilege	2372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2372	WMIC.exe
Token: SeRemoteShutdownPrivilege	2372	WMIC.exe
Token: SeUndockPrivilege	2372	WMIC.exe
Token: SeManageVolumePrivilege	2372	WMIC.exe
Token: 33	2372	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3508	1220	2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe	88
PID 1220 wrote to memory of 3508	1220	2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe	88
PID 1220 wrote to memory of 3508	1220	2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe	88
PID 1220 wrote to memory of 5432	1220	2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe	90
PID 1220 wrote to memory of 5432	1220	2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe	90
PID 5432 wrote to memory of 5328	5432	Exela.exe	91
PID 5432 wrote to memory of 5328	5432	Exela.exe	91
PID 5328 wrote to memory of 6032	5328	Exela.exe	95
PID 5328 wrote to memory of 6032	5328	Exela.exe	95
PID 5328 wrote to memory of 3232	5328	Exela.exe	98
PID 5328 wrote to memory of 3232	5328	Exela.exe	98
PID 5328 wrote to memory of 528	5328	Exela.exe	99
PID 5328 wrote to memory of 528	5328	Exela.exe	99
PID 3232 wrote to memory of 1036	3232	cmd.exe	102
PID 3232 wrote to memory of 1036	3232	cmd.exe	102
PID 528 wrote to memory of 1996	528	cmd.exe	103
PID 528 wrote to memory of 1996	528	cmd.exe	103
PID 5328 wrote to memory of 2536	5328	Exela.exe	106
PID 5328 wrote to memory of 2536	5328	Exela.exe	106
PID 2536 wrote to memory of 3456	2536	cmd.exe	108
PID 2536 wrote to memory of 3456	2536	cmd.exe	108
PID 5328 wrote to memory of 5316	5328	Exela.exe	109
PID 5328 wrote to memory of 5316	5328	Exela.exe	109
PID 5316 wrote to memory of 5444	5316	cmd.exe	111
PID 5316 wrote to memory of 5444	5316	cmd.exe	111
PID 5328 wrote to memory of 4384	5328	Exela.exe	112
PID 5328 wrote to memory of 4384	5328	Exela.exe	112
PID 5328 wrote to memory of 5256	5328	Exela.exe	113
PID 5328 wrote to memory of 5256	5328	Exela.exe	113
PID 5328 wrote to memory of 1604	5328	Exela.exe	114
PID 5328 wrote to memory of 1604	5328	Exela.exe	114
PID 5328 wrote to memory of 5912	5328	Exela.exe	115
PID 5328 wrote to memory of 5912	5328	Exela.exe	115
PID 5256 wrote to memory of 828	5256	cmd.exe	120
PID 5256 wrote to memory of 828	5256	cmd.exe	120
PID 1604 wrote to memory of 1636	1604	cmd.exe	121
PID 1604 wrote to memory of 1636	1604	cmd.exe	121
PID 5912 wrote to memory of 2036	5912	cmd.exe	122
PID 5912 wrote to memory of 2036	5912	cmd.exe	122
PID 828 wrote to memory of 3664	828	cmd.exe	123
PID 828 wrote to memory of 3664	828	cmd.exe	123
PID 4384 wrote to memory of 2252	4384	cmd.exe	124
PID 4384 wrote to memory of 2252	4384	cmd.exe	124
PID 2252 wrote to memory of 2384	2252	cmd.exe	125
PID 2252 wrote to memory of 2384	2252	cmd.exe	125
PID 5328 wrote to memory of 3636	5328	Exela.exe	126
PID 5328 wrote to memory of 3636	5328	Exela.exe	126
PID 5328 wrote to memory of 5264	5328	Exela.exe	128
PID 5328 wrote to memory of 5264	5328	Exela.exe	128
PID 3636 wrote to memory of 4620	3636	cmd.exe	130
PID 3636 wrote to memory of 4620	3636	cmd.exe	130
PID 5264 wrote to memory of 4492	5264	cmd.exe	131
PID 5264 wrote to memory of 4492	5264	cmd.exe	131
PID 5264 wrote to memory of 4664	5264	cmd.exe	134
PID 5264 wrote to memory of 4664	5264	cmd.exe	134
PID 5264 wrote to memory of 2372	5264	cmd.exe	135
PID 5264 wrote to memory of 2372	5264	cmd.exe	135
PID 5264 wrote to memory of 2908	5264	cmd.exe	136
PID 5264 wrote to memory of 2908	5264	cmd.exe	136
PID 2908 wrote to memory of 4884	2908	net.exe	137
PID 2908 wrote to memory of 4884	2908	net.exe	137
PID 5264 wrote to memory of 4944	5264	cmd.exe	138
PID 5264 wrote to memory of 4944	5264	cmd.exe	138
PID 4944 wrote to memory of 3764	4944	query.exe	139

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-13_9a93c1a62dd491268ba09d507bdf79c9_black-basta_elex.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\Nurlan.exe
  "C:\Users\Admin\AppData\Local\Temp\Nurlan.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3508
- C:\Users\Admin\AppData\Local\Temp\Exela.exe
  "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Exela.exe
    "C:\Users\Admin\AppData\Local\Temp\Exela.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:6032
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5316
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2252
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:2384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5256
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c chcp
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:828
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:3664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
      4⤵
      Clipboard Data
      Suspicious use of WriteProcessMemory
      PID:5912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
      4⤵
      Network Service Discovery
      Suspicious use of WriteProcessMemory
      PID:5264
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:4492
    - - C:\Windows\system32\HOSTNAME.EXE
        
        hostname
        5⤵
        
        PID:4664
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic logicaldisk get caption,description,providername
        5⤵
        Collects information from the system
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\system32\net.exe
        
        net user
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        6⤵
        
        PID:4884
    - - C:\Windows\system32\query.exe
        
        query user
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4944
      - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        6⤵
        
        PID:3764
    - - C:\Windows\system32\net.exe
        
        net localgroup
        5⤵
        
        PID:5308
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        6⤵
        
        PID:4288
    - - C:\Windows\system32\net.exe
        
        net localgroup administrators
        5⤵
        
        PID:920
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        6⤵
        
        PID:5044
    - - C:\Windows\system32\net.exe
        
        net user guest
        5⤵
        
        PID:4812
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        6⤵
        
        PID:5040
    - - C:\Windows\system32\net.exe
        
        net user administrator
        5⤵
        
        PID:4048
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        6⤵
        
        PID:4896
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic startup get caption,command
        5⤵
        
        PID:4400
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /svc
        5⤵
        Enumerates processes with tasklist
        
        PID:2068
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        5⤵
        Gathers network information
        
        PID:3888
    - - C:\Windows\system32\ROUTE.EXE
        
        route print
        5⤵
        
        PID:4840
    - - C:\Windows\system32\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        
        PID:1004
    - - C:\Windows\system32\NETSTAT.EXE
        
        netstat -ano
        5⤵
        System Network Connections Discovery
        Gathers network information
        
        PID:2988
    - - C:\Windows\system32\sc.exe
        
        sc query type= service state= all
        5⤵
        Launches sc.exe
        
        PID:4496
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show state
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1708
    - - C:\Windows\system32\netsh.exe
        
        netsh firewall show config
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:1832
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:872
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Exela.exe

Filesize
12.3MB

MD5
3c7024670450b3e196493fd43a80d9fb

SHA1
856450bb204b69a76bca4ea9601998cca92a9a98

SHA256
2e3397242d041f8f3bcb810f943967333008e68c37e7850c880768b60ceb4b6a

SHA512
b717c4e3927c833fd96487c781d996c4789841b3c65b645c1176bfe7bb0d1a90c245c8d19f8f8d206aeb8fb866a5fe2d3236b0fabb7d898c4c607a9e40ea98d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nurlan.exe

Filesize
62KB

MD5
27732c0410f305b5fb6aa08612d6e5ae

SHA1
9b41ab8c34fd05b5da92f28e2c2188d507c5b7b0

SHA256
16c964a323d3496210ec664239cfa5a8a78cc810b3770486ba347694b55007f0

SHA512
aa26154dc0bb0bc6f237e34d72e27e388b0e2de231c03f68c540a575b3366b4897d8bb3bfd876a7ec6526f8253ef7f6466f9c8d3dbb6b5ac8742425e1c926f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupProtect.xml

Filesize
422KB

MD5
ef913dd0394360d1df865b2945ce9357

SHA1
4925362d2006b8b8012c9c8c9e4b644aded5eb85

SHA256
27b71c144b4f5cd566d70d3e0919e72d51beed46c06dff5b9e795a1798cd4a04

SHA512
c9b753713f80e3f7578968cad566ff4add2324b7ac0804923d4840da2c37ceecd34e4cfc8fa0835022b6e8acf25a7b57cc202a9b67cf5b3a52611101690e0744

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConvertFromUnpublish.docx

Filesize
17KB

MD5
56708e834a9803594b6c6daf15c1e93e

SHA1
8174a264dc4af8d8ee632eea504d35c004c5200d

SHA256
fcea185ff2b09bb7bdf0341c0fb8a678af2b2e0ec6ce1726848e8a7d89360d75

SHA512
536049fe1d33ce65453c108c3ee12ffdae11f2aab1c26dd290fffb0018529bb290e5942f24c543c1aad4ca3e4031e7e694c9927f72c2f6b1933d93eaf46ea520

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\LimitProtect.xlsx

Filesize
10KB

MD5
58e8ca8e03bbce142d0d24624d442a3e

SHA1
8afd16c33b52b60a0b9171aaf210951c97edd9e2

SHA256
3b1c6aea59781620363ee2ad14af6ecad14eb277503a278bea46d242e10f6923

SHA512
0e93a1073b7c2cb88bdfadb09f9ba0759132501dd92e1f4d096f8a4959c968ce029a029c9bafaf27052361bf4545cca7e888cc06812bbe1310c38aacd7b482c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\MergeConvertTo.xlsx

Filesize
13KB

MD5
2dd59c4f11d14daa5257b69f7492d57a

SHA1
67bbff4a1616b7cc39cf296d146122739586d835

SHA256
79713bf39626d1f9d46784370fd8c5699d6177cc43e3c2a52d2ee10930a590ab

SHA512
bfd395749030e18ed83a1693330bc1f61cd678ba6bc60db9808f5562fe10cabf04de47237a9175cfc68d21105a8caa05c96f76fe5686e630ebc2a55058ea229c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UnprotectProtect.jpeg

Filesize
245KB

MD5
615caf2ada859286c3830d9bc33f4203

SHA1
015df6e7aaa2da1ca144740234e93dd9067ca1d4

SHA256
646f8cbbb04d97d976f1cc4e3bceb1838e31cc6d26c6de5f8bde5f5ab3659fbf

SHA512
7ff855330aafaeded6b62296cd28a016135823a3a801cec8ef3b6c84bf830a75db7665ad297cf71359c7c1105169a1d0a62e2bc046bc07e892999415353f28c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\OutApprove.xlsx

Filesize
11KB

MD5
841796896b23c7331fb2216cd328242b

SHA1
e3b8aefc230017d101631b8766ec49fb5ee0b1e6

SHA256
78e4c021563f728316df88b7ebb21dd8032cac8c5f6d3b418e270fd70e8234e0

SHA512
8aaaf630e469f5c1499fda3b08a89a5ebd84459bca031cf8b58c78c07fcbd9d079118f4e101025b0e617f7f50f5008086fe6d30749b5e874e08bad0a74caa203

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\TraceGroup.docx

Filesize
18KB

MD5
ebd84a8287b4255d93bc6050a107bd19

SHA1
26e14d06405e4f7da636d272c3b99c9b9a195dc6

SHA256
be1ff725c12292a76e84d8d6c896248ed7ae481f1f99b2993f151f2c2a5ef107

SHA512
02668a23a59c84f579b9e12e451eb504a580a8c8e86d2212d02735b129a021d45ac0e046ab1445e8d0066c8cea7355001b1b275f5eabc4e3f49131fdae4358b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\WaitGrant.docx

Filesize
12KB

MD5
611e5a1a2710c38f6f6329584718e00f

SHA1
f38df13e49dec9ddfd0f2009aa232a2fe916aa82

SHA256
04842459274ccd9c7261c12642e22af7d4ea7e902141a2c5a8d500790cdf786f

SHA512
97bc72dddf07e633c08cf1abe59f3ec3d213f91e00c28d8be20dfe2c5c8066121490d8ff6617e6148749fdbfeb1e9d06dccc04e59c057b07bf1ce327c3f13320

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ConvertSearch.mp4

Filesize
1013KB

MD5
53d2674a87ef8b177aefd1e38fceb094

SHA1
b4bc95d0b87bfa3bfe5ab351a2e419640ad4b04a

SHA256
fd31e8cd604c2156e4dc3ad8c4962ade35de4b255d791c805a9f3b661f2e6cf7

SHA512
fef65b70eb45ff0d7fc6358617f3efd535f7fd0018fd75ac5ac3d289e8036322001c0f875daabf415dff590d1d27efad692a760e9539800437607317ac4627b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\PingBackup.xhtml

Filesize
351KB

MD5
f87f0e97fde9e2d3f55aaf33a5ea7a35

SHA1
32ab6f21b18b34da1fe742a06dd5d68c1a5e614a

SHA256
55d991f7d338c3234cb47a509554f53d6f457a0c65de797e22b0562987540eb2

SHA512
608c0f993cfb03c7cec7ee9132b9859e549561f38905fd7a689340d8b4f721e66890421ee3ec7beea0f78b8c2ee92bd120704c60adf58d03ceddfbe9d9a9d9f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RevokeBackup.3gpp

Filesize
491KB

MD5
8d3254db8d835ebc822a703f34e651e8

SHA1
fc961989730350a285b0ba76fe506f5d3e5d47a3

SHA256
42908beaf504dcc1335fe674b0f645a8f632a99cef8addc77be8c9edb93b0fff

SHA512
a1c2a2050401bc46f998671cf5fa7927abdb13ef19592360da8c6839cc9ea0bf450945bc06d1c785dd416a8c70d6079a50b28ff020d2a561d53c410c67219e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\NewExpand.txt

Filesize
575KB

MD5
3848ddbd08a19761aa8ac6cf9fb4da16

SHA1
6b4652b482e2cc9d5d49b4cee18147f05f778a7a

SHA256
fefeda96d6fae58070a4984a5b723023fdde415e326fc83ec56d6fefb99e2e9b

SHA512
3f18747bf59b6f920b435cd34cd6e30a2c0db856d3b8232f923c21fc9ddd5fb43804116a04e4a2c0fcc8dda190e8f258042a4b5f1112fcf0cf84ff6aa948a7dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConvertToDismount.png

Filesize
324KB

MD5
5bd76acb51b087ee501f47ce6698b1f7

SHA1
d1c388cd4c579e694a0b779c93c3f7cdc584c49a

SHA256
d5441b36864802eb37341c656580bea0294745847896893708de8cc26132e787

SHA512
92bfded757071fbce78724718da994fb9aeb9e98f556affd231de7133ac63a4e60827b0df27f7adbaf7ebd27b8781ee2d9aee2f63e8f2d3f22a51d9105cf27b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\InvokeRename.jpg

Filesize
192KB

MD5
05415e077a978e2a7c0b8202deefefac

SHA1
b39a30f7aff899e461ea6db60ccd65ee73e9810f

SHA256
84b8d875cd3ab0493f176e228036ae41c2567ec847196e7043e54af64f7c533e

SHA512
34d67083c4a22b5861ad909617c17d765b5768ff7d296ab4247ec03c38a5cb89272790ec0c908532fa83b2c2a114348f7f698a8b69eb30713504ca5922da5d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SuspendRegister.jpeg

Filesize
239KB

MD5
65f0af917a782f16e9d982290221eab5

SHA1
dd52a23ad9261616f361a398a7c216424451ab12

SHA256
89de985714bb1e9df2445c84f3c82de13439caef5ba044d2ffbcde24b9cb3840

SHA512
e10d235f92c2760c641d3c2779a115dece1867a352cb6505e095098cd0b94d02365e279f883b341f8afd285f138b3eb5d91eea24691b85fbbb01d88a26222d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\UninstallPublish.jpeg

Filesize
211KB

MD5
94fa32f53c0e6bdba3e7968b76fe315e

SHA1
52bd6ba1ad21376966e787d127a4b24047b697af

SHA256
20277b2a30a8b28a3a3723dd85f71af9cdce51e4a9cb84ea64d3b1e88b96520c

SHA512
82bbf6ca806636f9781e2803910c6b32f6660f09cbc480cc8d21295c055eefd793314ce1aa7bfcc223007346f581eddca3dcfb215cf448ca141cfe7cad6210ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\_ctypes.pyd

Filesize
58KB

MD5
c687c554a505abcdf2d4b4a8d1aa9884

SHA1
b526045c347423e301e37576eb1e7f98619a70d9

SHA256
335a36fd21131736d36d8d8d947ab581b62da9ecb9c826a17b105bc9809ff0e6

SHA512
23a31a3238fe64fde854a484360874bfe3962654262b54e6bfae61fcb88913755c6b6af5c62ffe8d006d9f87c971d143b085e407d261853e62963ee1ec356d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-console-l1-1-0.dll

Filesize
20KB

MD5
39852d24acf76cf0b3a427f46663efdf

SHA1
92b9730c276c6f2a46e583fc815374c823e6098b

SHA256
191e08dea0ad5ac02e7e84669d9fffa5aa67dc696e36077c5fa20d81c80b6a56

SHA512
e6f0898871b769244818d93117fe3cb82cc8f12bb24d6b3406ffcaa2a26f0b5754246b5c739e9cbcf07cb94aabba2fd934e7054607b4086b2f4c5592607e8385

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-datetime-l1-1-0.dll

Filesize
20KB

MD5
b71c18f8966cead654800ff402c6520f

SHA1
a6f658ea85ad754cf571f7b67f3360d5417f94bd

SHA256
a94b80a5111aabefb1309609abdd300bb626d861cd8e0938b9735ab711a43c22

SHA512
17867aaa57542c1cd989ca3000f3d93bbb959eb5a69100c70c694bde10db8f8422d3e86e1a5fc0848677e4343c424013cdf496b8bb685f8875c3330271242369

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-debug-l1-1-0.dll

Filesize
20KB

MD5
a998282826d6091984d7d5f0bf476a31

SHA1
b958281ad7b861e0adcbeb0033932057082ae4fc

SHA256
263e038363527b7bed05110f37f7e5b95f82aab9c0280c9c522cf7bfce10fd7d

SHA512
ba46b6e7649cded62e9c097c29d42a8ea3da52109d285b8ed7aaea9a93c203efcfd856d25cee9bd825c0835b37a1d7a37a8ae55e0e10dc237f0da7013056cf5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
20KB

MD5
c148a26d3d9d39777dabe28dc08cee60

SHA1
4f7537ba8cee5ff774f8d7c3fe4174fc512b70d4

SHA256
085968d938ea924827c4740697713674850218a8fe91dd9982e93b0effacc820

SHA512
6689dfb19898f420632295fb9982668919011784278dc6840716c91ca8dcb434057096640a15fab7a93edf722530451da274d02bb344cd429388412ad11a79e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-fibers-l1-1-0.dll

Filesize
20KB

MD5
ee3f0d24e7e32e661ac407c60b84b7db

SHA1
09107fb9ace59a1ac3a8b8dbb4ff00b91182929b

SHA256
c86ebc9f48e2db659e80d9c7ad5f29e6b6c850eea58813c041baeff496ae4f18

SHA512
c3fbba7fad4fe03a3a763ad86681655f1bb04d6dd9f64c0083aaa0262ce18f82970365532337825d44ec92b3d79b3212817b25f188537a3771807ad17e7f8d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-file-l1-1-0.dll

Filesize
24KB

MD5
e933cdd91fd5725873f57532f262f815

SHA1
e48f6f301a03beb5e57a0727a09e7c28a68e19f3

SHA256
120c3afed9ce2a981c61208757fca0665f43926751ec8d0d13e10ef1096a0d48

SHA512
d1c598f964a98a30c6a4926f6b19f8213884224861c36aba839f5a91acefaa8c0e8b3d7cd555103885520432a343b489044e4ad3a1c33d77cf3fda4493eb48fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-file-l1-2-0.dll

Filesize
20KB

MD5
b59d773b0848785a76baba82d3f775fa

SHA1
1b8dcd7f0e2ab0ba9ba302aa4e9c4bfa8da74a82

SHA256
0dc1f695befddb8ee52a308801410f2f1d115fc70668131075c2dbcfa0b6f9a0

SHA512
cbd52ed8a7471187d74367aa03bf097d9eac3e0d6dc64baf835744a09da0b050537ea6092dcb8b1e0365427e7f27315be2145c6f853ef936755ad07ef17d4a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
4c9bf992ae40c7460a029b1046a7fb5e

SHA1
79e13947af1d603c964cce3b225306cadff4058b

SHA256
18655793b4d489f769327e3c8710aced6b763c7873b6a8dc5ae6f28d228647f4

SHA512
c36d455ac79a73758f6090977c204764a88e929e8eaa7ce27a9c9920451c014e84ae98beb447e8345a8fa186b8c668b076c0ed27047a0e23ad2eeaf2cbc3a8d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-handle-l1-1-0.dll

Filesize
20KB

MD5
f90e3b45c7942e3e30ecf1505253b289

SHA1
83beec2358de70268bc2e26ed0a1290aaef93f94

SHA256
7e45a1b997331f4d038f847f205904d6ec703df7a8c5c660435697e318ced8fc

SHA512
676450eb70a5ceae1820a978412ef3df746f14790322122b2de3e18ef013802c27867ad315950fc9b711e66f36628b062e57a7ec44d1ddc06f443655383cdc14

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-heap-l1-1-0.dll

Filesize
20KB

MD5
f2c267153db0182cca23038fc1cbf16a

SHA1
10d701ab952cacbf802615b0b458bc4d1a629042

SHA256
dd1e8c77002685629c5cd569ee17f9aa2bcb2e59d41b76ae5bc751cae26d75bf

SHA512
84f3c587be5a91752eeffd4f8e5ded74877930515fd9f4d48021b0f22a32feb3a4ddb9a0f14748e817f8c648bd307942ec026fc67eea922247499b5f412b4914

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
20KB

MD5
5f2e21c4f0be6a9e15c8ddc2ecdd7089

SHA1
1282b65a9b7276679366fe88c55fab442c0cc3a1

SHA256
ea60d03a35ef2c50306dbbd1ad408c714b1548035c615359af5a7ce8c0bd14a8

SHA512
a32c5ed72d4bfda60b2259e5982e42a79040225a4877246f3a645e05bfb8be395555fa22b2f0ed884f5fd82a8021bba85637727544c9adbb3a8c97b80e7a30f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
20KB

MD5
7b828554daa24f54275b81dfa54e0c62

SHA1
03fa109c21c0dc2e847117de133a68c6cd891555

SHA256
929298566ba01d1c3e64356a1f8370c1e97f0599f56f823c508cde9ae17f130b

SHA512
1f4f030d4a1cd3f98ba628dee873978b3797a4a7db66615fc484270a2b3fa68f231d9d12142840cfb52d7592c1ae7af6e35ae7a410878774a9fb199d7a647985

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
9d8e7a90dd0d54b7ccde435b977ee46d

SHA1
15cd12089c63f4147648856b16193cf014e6764f

SHA256
dc570708327c4c8419d4cced2a162d7ca112a168301134dd1fb5e2040eee45b6

SHA512
339fe195602355bce26a2526613a212271e7f8c7518d591b9e3c795c154d93b29b8c524b2c3678c799d0ea0101eabea918564e49def0b915af0619e975f1c34b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-memory-l1-1-0.dll

Filesize
20KB

MD5
e56f2d05d147add31d6f89bcd1f008ca

SHA1
dde258c7b42b17363bca53b5554a5e13ea056f80

SHA256
8a4b66cea7b474506fbdbe4c45e78923645f5f0a13f7f4e43449649f50ea38b8

SHA512
9fd1afd32fda24a92af4bb24661f7cf791cc6686b65f13dae97c56a1e83b25f0f2710c77167e6a9a491001877a0712c9a011833bb6026e08ae536744f0b40905

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
20KB

MD5
f08cd348ac935ac60436ac4cb1836203

SHA1
fd0608e704677fd4733296c2577647057541f392

SHA256
e8382a73730c2f7f873b40e2fcc5e1cd4847e7cb42fef3c76bea183af5891d65

SHA512
595e08301a0cbfd4f943ea3555dbce27d37b16c340b6972b054097b889285bbf942cc0314797a714a2e393956075c5dd95a5d2c2d4bde143b5f5387793e7a8de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
20KB

MD5
88916eed5164cb8884ebba842cd540cc

SHA1
f15674fbfef5b09cc02c924336554c17b715db00

SHA256
9c1afc7cd0b0e0d136d09b65dd082ace136fc306f8f116f3d13956211ec146c8

SHA512
2929c3ab67b364a7caf6c8fe1a42309917a0620f36c5d7194ca8a41ab7703a564ded32a4f9291a4f8fdd7d3a35383715fd8bef10ff603554b95519d109469617

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
20KB

MD5
42e99c89e241f21bf2fb20f3ff477eba

SHA1
e3b0012cd6d74f0ac2bf0c34997a87333c895834

SHA256
6e5bd110a2f4dc345b68e9a8fb081783586c8c25f46027c58443ade2d3e1bf01

SHA512
8eed3b21695cccae0dbf2db844efa11ad4957cd7bcd6c8ab7cfd4f0653bbacfd6bedd82ac27c3995f6418ae38ed0b8d46afa0bdfc627c16619aab775c5f8da16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
20KB

MD5
d399c926466f044f183faa723ba59120

SHA1
a9534b4910888d70eefba6fcc3376f2549cb4a05

SHA256
19b018be16afe143fb107ef1dd5b8e6c6cb45966806eb3d31ec09ff0dc2b70d1

SHA512
fc55f4cfe7c6c63e0720971d920c5c6ead4db74a671f7bb8dc830aa87cb54459a62e974456875bdfda449d82a0acb368e3b6c2cc20c32b1b407e8de7cc532057

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-profile-l1-1-0.dll

Filesize
20KB

MD5
7b746cda44a5773455c455690ba26a4f

SHA1
d6ff8a5ac6c71e0b037236fad32f9bbecfc68aec

SHA256
cc3c609193f2e99f80a6a21064d10c5c591101e386338879326775ccdd77dcb6

SHA512
25fd04facb3ddabbcb0265cd7a306d6c159ac6419a3e2ff4de7bb9fe41eb9a1e3afecea6558771b9e4b3f912227dda65021822fbe1ab52d7dcf6cd115bea84f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
20KB

MD5
d6fc6c9da69334221c5438f5c7444336

SHA1
ac385fee49c6a4f7ff918fa93ef3324e71943505

SHA256
bcb9a6dd2cc0caaa700d95fa3af5163a8246388c2efefbbc4cf6e1fe2687c72e

SHA512
646d23590974acf8ea523018b97d994df4d760500c5bbddc9d6bcbb5c0fc5665b82b40b49b7636050b83269aea4fa802b3be016a02403fe189cbe72fc1de0ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-string-l1-1-0.dll

Filesize
20KB

MD5
82fa7c54d034123805b57c96a5bced7f

SHA1
bbc6ebffbf21996f187345b7e28b9dfeca31829e

SHA256
9b071b842445a5dd90148445af148d024674085927d079864f7893807fd1b305

SHA512
715b2e794b2c2af5cdec22653d569ed33cf91bc092fae49449111cf7450385d1e5a1c713feac231bcedfa12fab7af57005c53f7721330400aef7c17dabddafff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-synch-l1-1-0.dll

Filesize
20KB

MD5
6dbc816b9aef0f91b57bfc9a3ab18972

SHA1
e88cb7a5955630d29d24d2f05f540403ed9498e3

SHA256
a981a24c9231e0230031bb1cba8f2509565ece1f53ebdb4d0a50efd722ab4330

SHA512
bfb4cfc89eb8b1409a826e59699f2c3f4af765f114281bb30026dad02d2353ca95ec3b544f522833e657be4cf69b1070dc9bd3767b7a6014c2cbacba38c023e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-synch-l1-2-0.dll

Filesize
20KB

MD5
da5d400ade0d2288b17dcc11ed339e25

SHA1
f4a340079477a2c91e091968fe2d252cb01eeae2

SHA256
69dd52caffe1ea6e0900fb9604a57a87618f8468dc68cbb2a9bcefd1265f3f49

SHA512
3bfa3b4f93a0a68e1c0ac17c74c91c0a01b779961af4811756223fd1f47a86ce1f3ebd7ee4190a2edb84a50b1b444318965cad3a74d1ed4acfa014d0f5bbe34a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
20KB

MD5
6971c41c21eb35668520f0bb949b3742

SHA1
5de3a45c15afb7c2038dc7fc0d29275b7fb90a36

SHA256
3513cffa44c88ec13d6a8c9b63e5d505a131b46746d13ee654144f08a96f20c3

SHA512
dd9914f547d5c34efd0f2879ebffd2d3ec9daf7465dffb7644ae0f4bc05f9f75df8b49ca8d692a8de7a92854a1b44c81e6f1b15ee691bf1995a1da76d3c3b82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-timezone-l1-1-0.dll

Filesize
20KB

MD5
ea5f768b9a1664884ae4ae62cec90678

SHA1
ae08e80431da7f4e8f1e5457c255cc360ef1cac0

SHA256
24f4530debf2161e0d0256f923b836aeccc3278a6ff2c9400e415600276b5a6d

SHA512
411db31e994ebbc69971972e45d6e51186d8f8790e8c67660b6a846e48a5a5c53a113916a5a15d14c33d8c88037d7f252135e699cb526c4bb3b5abd2e2dfee7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-core-util-l1-1-0.dll

Filesize
20KB

MD5
7fcf9a2588c1372d6104333a4cfc4603

SHA1
8c1ea131a30178c4f250d0cef254557fded0d132

SHA256
2e1cc12f93837a4e1fe95e0c640b147be29793705628f9c6cd91a0b5c0c50262

SHA512
2fb84dcedfeddbf41109dbadb59ede86ceeb168db08955dbf9395fab7a18941cc7313bcb47cb31cfd2978540e9beed346044e6c5b5defa61f59b9b78535e784b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-conio-l1-1-0.dll

Filesize
20KB

MD5
a5daf7d2dd7d447196f5aa65c3b48755

SHA1
847c75d74be334298a8cdb414905cad66bbf0b49

SHA256
1368b9af85f186a2b35e2a744eb2103555234b32fdfbfdb94c0f5e525c588e46

SHA512
32b1463dee8cbc4ccb5296b22281e014f432887eec07773e41477ecebbd1fb85087ff6adc6b7ac68d5fee818f3289daceb2817881bdbe2838cc104d2166a9607

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-convert-l1-1-0.dll

Filesize
24KB

MD5
cf95a8f66313283f046ba9e6e5cdbba4

SHA1
b25c686fcc6729a88a8776cdb75ff21cbceb1c5d

SHA256
2ccb01b62188ddc051a582c128bf880608111c602534e487ec09a7cf67c22d17

SHA512
59f5901e513aceeeb819c73c5b9fe2504e80af28df54db19775d7c0e0481f14c21ce38e6db207672cc10facfdd217638829af2d3f0f85a0a413d10e3a81dae9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-environment-l1-1-0.dll

Filesize
20KB

MD5
71407c52ff12b113cc0498fdd42db8dc

SHA1
f0c6a3c1308177b090b2a94fee90156e1df6bb9b

SHA256
5a2ae5b270c1eaf467878e7f5dbdc689b71914bdf30293d7d46c01d9dd11bdd4

SHA512
b9bb29d76a144c10b234835b6006637c84103abeb8f5db19991f3ab2baaabe3ea3fc1a87132263d097addd01afcad08e77c9834dccd4c6723b3ca204f50aac1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
bbbf361746440219a3f7933ced5234bb

SHA1
1e3ededaa28e41f51e903c2ca66e7bd048fbaee7

SHA256
42a99227775e85ca8c197811a86aad0e2af496bd21623e4c9a2dd747571c8990

SHA512
f6681875bc02903676cd3ea3303920202c563a1a6e82dd687ed9bd0fafe92c9abba4a6df3e9c93f2bb0da9dccf0abb4543b6a5e5f0c92fa06e809b30b84085aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-heap-l1-1-0.dll

Filesize
20KB

MD5
bacc491eb1dee4786ade841e7b480cd8

SHA1
84cb8f770cdf873415403edf48e625514aecad02

SHA256
43c80120970be1efed3ea60bf7aa37b46fcce946b94fb11ca6e3ffff2f16bb29

SHA512
7832912f38cd6ba145af57548c2a1d4da3bed9392a0ab3a0faffe18fab40087e1d74676e2af004627a37f7e079b9146dccf7aaa04e360a88443196fede4ccadc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-locale-l1-1-0.dll

Filesize
20KB

MD5
fb992bbb73e0127c70d075f81e52aaf9

SHA1
e9d326d436e2e55c521261ad9a5b73d2e998f644

SHA256
6011ece89f4833dcb4cefb02ea366b828725205eae6f25ab704b76fd9e5d86eb

SHA512
f568898a660c3850998b71a854fb5b8ffee59f02ebe7bc8c12ad9bc68f5472a0c812cf0a8ebc096fcc462e941a86a2a46619d4f03030e7ab69a0e4a9e7b1e0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
0936c89e36a8bac313de187e50c61078

SHA1
7f0e64a66301e1926fa9acdc36ad728958ce6d78

SHA256
5ba8f9c2842990ccdb447fc6d22023103b03f5387f341d3375809f060b5bb4ef

SHA512
a72fcadc55d12c97770f1222bb3b605b7d58157f6f55814d900fe0f1b5ff8075f84914c7ac66d4b0e59ef41c01504a35c391bfb182e2e9019d152037ef4ec20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-process-l1-1-0.dll

Filesize
20KB

MD5
437e85738168dd8a2894005b01451001

SHA1
49b20fdc8e6287e684af3877352408bfea71a624

SHA256
cfc12dd7c1deabf35c8e0fbe01248171c49555fe2d1bed72c5fdba2102090870

SHA512
025148a7278c06e20d00fb0287d0168d4c367bef21ea8334f746b094250e488711cdb5780f8e08ebf501784b151c4bbe8caca925f7b7268f3324dfd9f49e5612

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
24KB

MD5
01380df01b9e61fc241f82f8fb984c2d

SHA1
18f92390b292af0db8aaa7c7e6f6aa24463f9b84

SHA256
698fa887c5b994375c9271222e21d0d4c74810e73d377ad898927549fb69dcb3

SHA512
743d45fae759d8ff3ef862ffa70584696824b86991f262ddc897f6f469fbb4264cf7da3fe001f33c6305523753d37a7a64874c5010cc7fe63252c53cd96b06f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
a3f3ffcde3dd59cc94fb7dba16715671

SHA1
bbf272dab014d4cde1a57831a2daf4fde03b4884

SHA256
c1541ed4dc6879a136bf532393f7cefd3c48ad371d2ed9965e7cbd44c87a1137

SHA512
0e323b44b4ed7959c5f6409e565707e6e402382c950d2a0fc18d18f56ab588a49a260c99ecbda1bdb3778be131fb71b1b1158d852981e2e86d0b989b05496e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
535d1195f493f7d92fe9007258494ebc

SHA1
1bf95ec546a6c1a8832d9002b7cd01265a1bbdad

SHA256
4429b8e6707645fb503ebc3bd50ce2a84f559b6a2ed778196835808bdfec2f48

SHA512
cd47f34032fc59a89dd286115db2cc2d1918f6ecc069fa37d2295126876fc5c931d6272892fb22db5eff1f810de818e64e6140617786a4d3fb153fd80c107468

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
ed44b4aac3c881a9bc524d15ae3f3944

SHA1
a87983d6c714aac9242bb60037864139863b1848

SHA256
f3e6f692cec86adb3985b929345c731469777aeaeb088e3ce070957df481f924

SHA512
25513c666f228365ce7e092782a92fb7eb144f6b3293f896b08317c36323006ba10f4133bbfdadd2576053c1d6ac0e28cc3ad5798b92eec34fc8fa36e8d83047

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\api-ms-win-crt-utility-l1-1-0.dll

Filesize
20KB

MD5
e79464524fbc2c266da52d0a903d85d3

SHA1
6bad715617992277751a8ddfc180ba291ba75d59

SHA256
6c78d4aba91877c5bb33e545b6a69a818f377e07ff62e791b804fa5b4d2bcf02

SHA512
def71789e238ecd3b2d68dbd204acc62537ad39ce50a5bf09f320fc8cacc1b3f561822784d006ab2145eab5ab7be3f74c1c773fbe814efa040a1dbb3ffa6744e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\base_library.zip

Filesize
1.4MB

MD5
74a290251606108527f1cf3c633be9d3

SHA1
f977f854369bc9b526d46b6cdfbb85d6b27e7044

SHA256
2e3953b31a93c37092eef55b41793d5dd37fa44b587cf7ec7155241fc0635f52

SHA512
6c1c88f82a409ec32ae058b7b1cde0677e12356c404c665e6006b201f4c42fb5066fae1f3d6b6c8bea928ecc323f0943cc89950c8f6cc1910df2a54faff09346

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\libcrypto-3.dll

Filesize
1.6MB

MD5
443fd07a22ff1a688a3505d35f3c3dd1

SHA1
ab9f501aa1d3d523b45f8170e53981672cd69131

SHA256
f9c87ec6401039fd03b7c6732c74d1abfdb7c07c8e9803d00effe4c610baa9ee

SHA512
1de390d5d9872c9876662f89c57173391ecd300cabde69c655b2ade7eea56e67376839607cac52572111b88a025797060653dc8bb987c6a165f535b245309844

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\libffi-8.dll

Filesize
29KB

MD5
0d1c6b92d091cef3142e32ac4e0cc12e

SHA1
440dad5af38035cb0984a973e1f266deff2bd7fc

SHA256
11ee9c7fb70c3756c0392843245935517171b95cc5ba0d696b2c1742c8d46fb6

SHA512
5d514ecab93941e83c008f0e9749f99e330949580884bf4850b11cac08fe1ac4ac50033e8888045fe4a9d8b4d2e3ea667b39be18f77266d00f8d7d6797260233

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\libssl-3.dll

Filesize
222KB

MD5
364a71831c9bd0a09eeeceb6980c58c7

SHA1
9d084ccb83e12ddccd17250a009362d720e6271c

SHA256
3b20fb46f41234f8f7bbe342cfebfbbce5708d963cf5c7792d1237a1bc7b2676

SHA512
5abe19130f9306fd6fc3644412ef6c8c5b7da970cfaed69657a6cb62d431abfbba64fefcbfa82910d17d744e299e3ba5036bd490223b2bf28689cf2e70633dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\pyexpat.pyd

Filesize
87KB

MD5
9de8f95d45076b3d3110684f3ceb4877

SHA1
99a1c34570fa93ded22e058c8d2b3bbbe0fb847e

SHA256
e4835a7e4de244565003592894e57e8ce722901edf14abd9876a64fcdccd40f6

SHA512
76b854106519fd6e66f1db140c2d0dcaec5f9159527e22279ee2ed7015df2527197084ef91fd96572e5338c039672f91dd33d70fdbecd7759d0e720d8432bd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\python3.dll

Filesize
65KB

MD5
7e07c63636a01df77cd31cfca9a5c745

SHA1
593765bc1729fdca66dd45bbb6ea9fcd882f42a6

SHA256
db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6

SHA512
8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\python311.dll

Filesize
1.6MB

MD5
0d96f5dfd2dd0f495cad36148493c761

SHA1
928107e88bbee02563594374cd6c6ad19091fe14

SHA256
a238f7fb0043c4b64f76095c1ef950544bb1d0debd0902ea0fa3e8d99e5d4a47

SHA512
693c28c64e974ca1fb754357788a65b3a0271e63395963bb92691a5838e1b665af7aada6be5c5ada8339100eedd64c40ca0556601bec26a0f9e483ea98ab2d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\select.pyd

Filesize
25KB

MD5
c9333b0c4d756597e1c371b2e1569904

SHA1
a534e81dd4ac847ec4fa82f60d9c78aa3341783c

SHA256
5d9078f3caca928e6f608c69b2c571b3ff82a23de7b4576b5d97fde9b597b807

SHA512
fc1f3ad3021da212140d18954684cd612fbd806c33807c48b65c5a169f84d8af5e1a260c02a942fb13b3114437879275d44fee96252911bd62b6a509abf30c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\sqlite3.dll

Filesize
644KB

MD5
de8018abd4a261cbb6be7acae32d3b07

SHA1
312a1de08a8d82ed23a3a1184d155d4bdd51d84a

SHA256
1d3b09affe7c5f6d3a5015aa7cb64d9b5df16b3d4b773ac09a1a1494d7413904

SHA512
9fbf011ee00cd3f1e6f44e540c80ac057f9f5a2759c6921f5827b28246af45e0e7466d2b8340b41552d83809273a505336387530d5bb6336e6b1ddbe586841f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\ucrtbase.dll

Filesize
1.1MB

MD5
b0397bb83c9d579224e464eebf40a090

SHA1
81efdfe57225dfe581aafb930347535f08f2f4ce

SHA256
d2ebd8719455ae4634d00fd0d0eb0c3ad75054fee4ff545346a1524e5d7e3a66

SHA512
e72a4378ed93cfb3da60d69af8103a0dcb9a69a86ee42f004db29771b00a606fbc9cbc37f3daa155d1d5fe85f82c87ca9898a39c7274462fcf5c4420f0581ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54322\unicodedata.pyd

Filesize
295KB

MD5
affa5f396873e571271604ad19f186b1

SHA1
c54dd3b5935a93fbdc68c7ed37af14aba262ec0d

SHA256
0c19d227d0407a58d5d1b75f2e1eeedbb35e9d569f7868ad8c421719431e8c67

SHA512
d6ad17dfd396fab7ccc1499e5b1769caebb98011f7af82f7761a8b9df573effdadf828bf87959bd2e99315d922a81c25901879f142e8476a111d8004e390396d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1fj0kdix.2fl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1220-48-0x0000000000400000-0x000000000105C000-memory.dmp

Filesize
12.4MB

Download
memory/2036-256-0x0000015430910000-0x0000015430932000-memory.dmp

Filesize
136KB

Download
memory/3508-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5328-190-0x00007FFFF29A0000-0x00007FFFF2ABC000-memory.dmp

Filesize
1.1MB

Download
memory/5328-180-0x0000022C46300000-0x0000022C46829000-memory.dmp

Filesize
5.2MB

Download
memory/5328-189-0x00007FFFF2AC0000-0x00007FFFF2AE2000-memory.dmp

Filesize
136KB

Download
memory/5328-193-0x00007FFFF2980000-0x00007FFFF299B000-memory.dmp

Filesize
108KB

Download
memory/5328-192-0x0000022C46300000-0x0000022C46829000-memory.dmp

Filesize
5.2MB

Download
memory/5328-191-0x00007FFFFA7F0000-0x00007FFFFA813000-memory.dmp

Filesize
140KB

Download
memory/5328-194-0x00007FFFF3320000-0x00007FFFF33ED000-memory.dmp

Filesize
820KB

Download
memory/5328-200-0x00007FFFF2700000-0x00007FFFF274D000-memory.dmp

Filesize
308KB

Download
memory/5328-199-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp

Filesize
204KB

Download
memory/5328-198-0x00007FFFF24D0000-0x00007FFFF2502000-memory.dmp

Filesize
200KB

Download
memory/5328-197-0x00007FFFF26E0000-0x00007FFFF26F1000-memory.dmp

Filesize
68KB

Download
memory/5328-196-0x00007FFFF2750000-0x00007FFFF2769000-memory.dmp

Filesize
100KB

Download
memory/5328-195-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp

Filesize
5.2MB

Download
memory/5328-201-0x00007FFFF26C0000-0x00007FFFF26DE000-memory.dmp

Filesize
120KB

Download
memory/5328-202-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp

Filesize
84KB

Download
memory/5328-203-0x00007FFFF1CD0000-0x00007FFFF24CC000-memory.dmp

Filesize
8.0MB

Download
memory/5328-204-0x00007FFFF2680000-0x00007FFFF26B7000-memory.dmp

Filesize
220KB

Download
memory/5328-248-0x00007FF803350000-0x00007FF80335D000-memory.dmp

Filesize
52KB

Download
memory/5328-187-0x00007FFFF2AF0000-0x00007FFFF2B04000-memory.dmp

Filesize
80KB

Download
memory/5328-186-0x00007FFFF4BC0000-0x00007FFFF4BD4000-memory.dmp

Filesize
80KB

Download
memory/5328-265-0x00007FFFF2AC0000-0x00007FFFF2AE2000-memory.dmp

Filesize
136KB

Download
memory/5328-266-0x00007FFFF29A0000-0x00007FFFF2ABC000-memory.dmp

Filesize
1.1MB

Download
memory/5328-267-0x00007FFFF2980000-0x00007FFFF299B000-memory.dmp

Filesize
108KB

Download
memory/5328-296-0x00007FFFF24D0000-0x00007FFFF2502000-memory.dmp

Filesize
200KB

Download
memory/5328-292-0x00007FFFF1CD0000-0x00007FFFF24CC000-memory.dmp

Filesize
8.0MB

Download
memory/5328-291-0x00007FFFF26C0000-0x00007FFFF26DE000-memory.dmp

Filesize
120KB

Download
memory/5328-288-0x00007FFFF2700000-0x00007FFFF274D000-memory.dmp

Filesize
308KB

Download
memory/5328-281-0x00007FFFF5150000-0x00007FFFF5162000-memory.dmp

Filesize
72KB

Download
memory/5328-280-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp

Filesize
84KB

Download
memory/5328-279-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp

Filesize
5.2MB

Download
memory/5328-278-0x00007FFFF3320000-0x00007FFFF33ED000-memory.dmp

Filesize
820KB

Download
memory/5328-277-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp

Filesize
204KB

Download
memory/5328-276-0x00007FFFF33F0000-0x00007FFFF356E000-memory.dmp

Filesize
1.5MB

Download
memory/5328-295-0x00007FFFF2750000-0x00007FFFF2769000-memory.dmp

Filesize
100KB

Download
memory/5328-293-0x00007FFFF2680000-0x00007FFFF26B7000-memory.dmp

Filesize
220KB

Download
memory/5328-268-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp

Filesize
5.9MB

Download
memory/5328-269-0x00007FF803380000-0x00007FF8033A4000-memory.dmp

Filesize
144KB

Download
memory/5328-307-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp

Filesize
5.9MB

Download
memory/5328-326-0x00007FFFF2750000-0x00007FFFF2769000-memory.dmp

Filesize
100KB

Download
memory/5328-319-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp

Filesize
84KB

Download
memory/5328-318-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp

Filesize
5.2MB

Download
memory/5328-316-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp

Filesize
204KB

Download
memory/5328-182-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp

Filesize
204KB

Download
memory/5328-188-0x00007FFFFAE10000-0x00007FFFFAE29000-memory.dmp

Filesize
100KB

Download
memory/5328-179-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp

Filesize
5.2MB

Download
memory/5328-185-0x00007FFFF5150000-0x00007FFFF5162000-memory.dmp

Filesize
72KB

Download
memory/5328-174-0x00007FFFFAE10000-0x00007FFFFAE29000-memory.dmp

Filesize
100KB

Download
memory/5328-175-0x00007FF80C9C0000-0x00007FF80C9CD000-memory.dmp

Filesize
52KB

Download
memory/5328-176-0x00007FFFFA7F0000-0x00007FFFFA813000-memory.dmp

Filesize
140KB

Download
memory/5328-173-0x00007FFFFA820000-0x00007FFFFA84D000-memory.dmp

Filesize
180KB

Download
memory/5328-172-0x00007FF803360000-0x00007FF803379000-memory.dmp

Filesize
100KB

Download
memory/5328-171-0x00007FF80C9D0000-0x00007FF80C9DF000-memory.dmp

Filesize
60KB

Download
memory/5328-124-0x00007FF803380000-0x00007FF8033A4000-memory.dmp

Filesize
144KB

Download
memory/5328-184-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp

Filesize
84KB

Download
memory/5328-183-0x00007FF803380000-0x00007FF8033A4000-memory.dmp

Filesize
144KB

Download
memory/5328-116-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp

Filesize
5.9MB

Download
memory/5328-181-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp

Filesize
5.9MB

Download
memory/5328-178-0x00007FFFF3320000-0x00007FFFF33ED000-memory.dmp

Filesize
820KB

Download
memory/5328-177-0x00007FFFF33F0000-0x00007FFFF356E000-memory.dmp

Filesize
1.5MB

Download
memory/5328-637-0x00007FFFF44A0000-0x00007FFFF4A92000-memory.dmp

Filesize
5.9MB

Download
memory/5328-648-0x00007FFFF2AC0000-0x00007FFFF2AE2000-memory.dmp

Filesize
136KB

Download
memory/5328-658-0x00007FFFF24D0000-0x00007FFFF2502000-memory.dmp

Filesize
200KB

Download
memory/5328-660-0x00007FFFF26C0000-0x00007FFFF26DE000-memory.dmp

Filesize
120KB

Download
memory/5328-663-0x00007FF803350000-0x00007FF80335D000-memory.dmp

Filesize
52KB

Download
memory/5328-662-0x00007FFFF2680000-0x00007FFFF26B7000-memory.dmp

Filesize
220KB

Download
memory/5328-661-0x00007FFFF1CD0000-0x00007FFFF24CC000-memory.dmp

Filesize
8.0MB

Download
memory/5328-659-0x00007FFFF2DF0000-0x00007FFFF3319000-memory.dmp

Filesize
5.2MB

Download
memory/5328-657-0x00007FFFF26E0000-0x00007FFFF26F1000-memory.dmp

Filesize
68KB

Download
memory/5328-656-0x00007FFFF2750000-0x00007FFFF2769000-memory.dmp

Filesize
100KB

Download
memory/5328-655-0x00007FFFF2980000-0x00007FFFF299B000-memory.dmp

Filesize
108KB

Download
memory/5328-654-0x00007FFFF29A0000-0x00007FFFF2ABC000-memory.dmp

Filesize
1.1MB

Download
memory/5328-653-0x00007FFFF2AF0000-0x00007FFFF2B04000-memory.dmp

Filesize
80KB

Download
memory/5328-652-0x00007FFFF4BC0000-0x00007FFFF4BD4000-memory.dmp

Filesize
80KB

Download
memory/5328-651-0x00007FFFF5150000-0x00007FFFF5162000-memory.dmp

Filesize
72KB

Download
memory/5328-650-0x00007FFFF55D0000-0x00007FFFF55E5000-memory.dmp

Filesize
84KB

Download
memory/5328-649-0x00007FFFF33F0000-0x00007FFFF356E000-memory.dmp

Filesize
1.5MB

Download
memory/5328-647-0x00007FFFF2700000-0x00007FFFF274D000-memory.dmp

Filesize
308KB

Download
memory/5328-646-0x00007FFFF3320000-0x00007FFFF33ED000-memory.dmp

Filesize
820KB

Download
memory/5328-645-0x00007FFFF58F0000-0x00007FFFF5923000-memory.dmp

Filesize
204KB

Download
memory/5328-644-0x00007FFFFA7F0000-0x00007FFFFA813000-memory.dmp

Filesize
140KB

Download
memory/5328-643-0x00007FF80C9C0000-0x00007FF80C9CD000-memory.dmp

Filesize
52KB

Download
memory/5328-642-0x00007FFFFAE10000-0x00007FFFFAE29000-memory.dmp

Filesize
100KB

Download
memory/5328-641-0x00007FFFFA820000-0x00007FFFFA84D000-memory.dmp

Filesize
180KB

Download
memory/5328-640-0x00007FF803360000-0x00007FF803379000-memory.dmp

Filesize
100KB

Download
memory/5328-639-0x00007FF80C9D0000-0x00007FF80C9DF000-memory.dmp

Filesize
60KB

Download
memory/5328-638-0x00007FF803380000-0x00007FF8033A4000-memory.dmp

Filesize
144KB

Download