exelastealer | fd0771a31ff14cf9f027296eaadf08ac75b481befe92ca3174ab5647dbf7539f

Analysis

max time kernel
119s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2025, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
Size

9.7MB
MD5

8d4409d7e41aaec228baa277f857900a
SHA1

ad51aa98df408fb7f06c002c27d4001468aff7fc
SHA256

fd0771a31ff14cf9f027296eaadf08ac75b481befe92ca3174ab5647dbf7539f
SHA512

8a3fa60919a6da797ba85ce908554fa9022fedc3717c40787b215403af46fc67a06ef1d665721446d62d61a48237568a79d63bc9abe44e6d844dd19ba4228994
SSDEEP

196608:u0EiPooj3xjwVmvNm1E8giq1g98eNMHFJMIDJ+gsAGKkRRHPZWbTl:uiP5BwVm1m1Nqq4Fqy+gs1JhIJ

Score

10^/10

exelastealer collection defense_evasion discovery persistence privilege_escalation pyinstaller spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2796	netsh.exe
4732	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5884	powershell.exe
4376	cmd.exe

Loads dropped DLL 27 IoCs

pid	Process
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
32	api.gofile.io
33	api.gofile.io
64	api.gofile.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
5416	cmd.exe
636	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
3328	tasklist.exe
4116	tasklist.exe
3232	tasklist.exe
3016	tasklist.exe
5944	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5496	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000241ae-41.dat	upx
behavioral1/memory/1084-45-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp	upx
behavioral1/files/0x000a000000024164-47.dat	upx
behavioral1/memory/1084-53-0x00007FF91D210000-0x00007FF91D234000-memory.dmp	upx
behavioral1/files/0x00090000000241a0-52.dat	upx
behavioral1/memory/1084-74-0x00007FF921420000-0x00007FF92142F000-memory.dmp	upx
behavioral1/files/0x000a000000024162-75.dat	upx
behavioral1/files/0x000a000000024167-77.dat	upx
behavioral1/files/0x000a00000002416c-83.dat	upx
behavioral1/memory/1084-84-0x00007FF919C90000-0x00007FF919CAF000-memory.dmp	upx
behavioral1/memory/1084-88-0x00007FF919C60000-0x00007FF919C8E000-memory.dmp	upx
behavioral1/files/0x000800000002419b-91.dat	upx
behavioral1/memory/1084-92-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp	upx
behavioral1/memory/1084-96-0x00007FF91D210000-0x00007FF91D234000-memory.dmp	upx
behavioral1/files/0x000a000000024161-97.dat	upx
behavioral1/memory/1084-98-0x00007FF919C40000-0x00007FF919C55000-memory.dmp	upx
behavioral1/memory/1084-95-0x00007FF909E60000-0x00007FF90A1D5000-memory.dmp	upx
behavioral1/files/0x000e0000000241a6-102.dat	upx
behavioral1/files/0x000a000000024166-104.dat	upx
behavioral1/memory/1084-103-0x00007FF919C10000-0x00007FF919C24000-memory.dmp	upx
behavioral1/memory/1084-101-0x00007FF919C30000-0x00007FF919C40000-memory.dmp	upx
behavioral1/files/0x000a000000024169-99.dat	upx
behavioral1/files/0x00080000000241df-110.dat	upx
behavioral1/memory/1084-115-0x00007FF919F00000-0x00007FF919F1B000-memory.dmp	upx
behavioral1/files/0x000a00000002416e-116.dat	upx
behavioral1/files/0x000e000000024192-119.dat	upx
behavioral1/memory/1084-118-0x00007FF919EF0000-0x00007FF919EFA000-memory.dmp	upx
behavioral1/memory/1084-121-0x00007FF919000000-0x00007FF9190B8000-memory.dmp	upx
behavioral1/memory/1084-117-0x00007FF919C60000-0x00007FF919C8E000-memory.dmp	upx
behavioral1/memory/1084-114-0x00007FF90A660000-0x00007FF90A778000-memory.dmp	upx
behavioral1/files/0x00080000000241ab-113.dat	upx
behavioral1/memory/1084-112-0x00007FF919C90000-0x00007FF919CAF000-memory.dmp	upx
behavioral1/memory/1084-109-0x00007FF919F20000-0x00007FF919F42000-memory.dmp	upx
behavioral1/files/0x00080000000241e1-108.dat	upx
behavioral1/memory/1084-107-0x00007FF919B50000-0x00007FF919B64000-memory.dmp	upx
behavioral1/memory/1084-106-0x00007FF919CC0000-0x00007FF919CD9000-memory.dmp	upx
behavioral1/memory/1084-93-0x00007FF919000000-0x00007FF9190B8000-memory.dmp	upx
behavioral1/files/0x00090000000241a1-89.dat	upx
behavioral1/files/0x000a00000002416d-87.dat	upx
behavioral1/memory/1084-86-0x00007FF90A1E0000-0x00007FF90A351000-memory.dmp	upx
behavioral1/memory/1084-82-0x00007FF919CB0000-0x00007FF919CBD000-memory.dmp	upx
behavioral1/files/0x00080000000241dd-81.dat	upx
behavioral1/memory/1084-80-0x00007FF919CC0000-0x00007FF919CD9000-memory.dmp	upx
behavioral1/files/0x000a00000002416b-79.dat	upx
behavioral1/files/0x00080000000241de-85.dat	upx
behavioral1/memory/1084-78-0x00007FF91A7A0000-0x00007FF91A7CD000-memory.dmp	upx
behavioral1/memory/1084-76-0x00007FF91CE40000-0x00007FF91CE59000-memory.dmp	upx
behavioral1/files/0x000a00000002416a-69.dat	upx
behavioral1/files/0x000a000000024168-67.dat	upx
behavioral1/memory/1084-123-0x00007FF909660000-0x00007FF909E5B000-memory.dmp	upx
behavioral1/files/0x000a000000024165-64.dat	upx
behavioral1/files/0x000a000000024163-63.dat	upx
behavioral1/memory/1084-126-0x00007FF918FC0000-0x00007FF918FF7000-memory.dmp	upx
behavioral1/memory/1084-125-0x00007FF909E60000-0x00007FF90A1D5000-memory.dmp	upx
behavioral1/files/0x00080000000241ac-57.dat	upx
behavioral1/memory/1084-129-0x00007FF919C40000-0x00007FF919C55000-memory.dmp	upx
behavioral1/memory/1084-142-0x00007FF919C30000-0x00007FF919C40000-memory.dmp	upx
behavioral1/memory/1084-182-0x00007FF919CF0000-0x00007FF919CFD000-memory.dmp	upx
behavioral1/memory/1084-199-0x00007FF919F20000-0x00007FF919F42000-memory.dmp	upx
behavioral1/memory/1084-233-0x00007FF909660000-0x00007FF909E5B000-memory.dmp	upx
behavioral1/memory/1084-218-0x00007FF90A1E0000-0x00007FF90A351000-memory.dmp	upx
behavioral1/memory/1084-211-0x00007FF91D210000-0x00007FF91D234000-memory.dmp	upx
behavioral1/memory/1084-222-0x00007FF919C40000-0x00007FF919C55000-memory.dmp	upx
behavioral1/memory/1084-217-0x00007FF919C90000-0x00007FF919CAF000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2952	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000c0000000240f8-139.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3332	cmd.exe
5900	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1272	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
516	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4928	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1272	NETSTAT.EXE
3368	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4324	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5884	powershell.exe
5884	powershell.exe
5884	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe
Token: SeSecurityPrivilege	4912	WMIC.exe
Token: SeTakeOwnershipPrivilege	4912	WMIC.exe
Token: SeLoadDriverPrivilege	4912	WMIC.exe
Token: SeSystemProfilePrivilege	4912	WMIC.exe
Token: SeSystemtimePrivilege	4912	WMIC.exe
Token: SeProfSingleProcessPrivilege	4912	WMIC.exe
Token: SeIncBasePriorityPrivilege	4912	WMIC.exe
Token: SeCreatePagefilePrivilege	4912	WMIC.exe
Token: SeBackupPrivilege	4912	WMIC.exe
Token: SeRestorePrivilege	4912	WMIC.exe
Token: SeShutdownPrivilege	4912	WMIC.exe
Token: SeDebugPrivilege	4912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4912	WMIC.exe
Token: SeRemoteShutdownPrivilege	4912	WMIC.exe
Token: SeUndockPrivilege	4912	WMIC.exe
Token: SeManageVolumePrivilege	4912	WMIC.exe
Token: 33	4912	WMIC.exe
Token: 34	4912	WMIC.exe
Token: 35	4912	WMIC.exe
Token: 36	4912	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4928	WMIC.exe
Token: SeSecurityPrivilege	4928	WMIC.exe
Token: SeTakeOwnershipPrivilege	4928	WMIC.exe
Token: SeLoadDriverPrivilege	4928	WMIC.exe
Token: SeSystemProfilePrivilege	4928	WMIC.exe
Token: SeSystemtimePrivilege	4928	WMIC.exe
Token: SeProfSingleProcessPrivilege	4928	WMIC.exe
Token: SeIncBasePriorityPrivilege	4928	WMIC.exe
Token: SeCreatePagefilePrivilege	4928	WMIC.exe
Token: SeBackupPrivilege	4928	WMIC.exe
Token: SeRestorePrivilege	4928	WMIC.exe
Token: SeShutdownPrivilege	4928	WMIC.exe
Token: SeDebugPrivilege	4928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4928	WMIC.exe
Token: SeRemoteShutdownPrivilege	4928	WMIC.exe
Token: SeUndockPrivilege	4928	WMIC.exe
Token: SeManageVolumePrivilege	4928	WMIC.exe
Token: 33	4928	WMIC.exe
Token: 34	4928	WMIC.exe
Token: 35	4928	WMIC.exe
Token: 36	4928	WMIC.exe
Token: SeDebugPrivilege	3016	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe
Token: SeSecurityPrivilege	4912	WMIC.exe
Token: SeTakeOwnershipPrivilege	4912	WMIC.exe
Token: SeLoadDriverPrivilege	4912	WMIC.exe
Token: SeSystemProfilePrivilege	4912	WMIC.exe
Token: SeSystemtimePrivilege	4912	WMIC.exe
Token: SeProfSingleProcessPrivilege	4912	WMIC.exe
Token: SeIncBasePriorityPrivilege	4912	WMIC.exe
Token: SeCreatePagefilePrivilege	4912	WMIC.exe
Token: SeBackupPrivilege	4912	WMIC.exe
Token: SeRestorePrivilege	4912	WMIC.exe
Token: SeShutdownPrivilege	4912	WMIC.exe
Token: SeDebugPrivilege	4912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4912	WMIC.exe
Token: SeRemoteShutdownPrivilege	4912	WMIC.exe
Token: SeUndockPrivilege	4912	WMIC.exe
Token: SeManageVolumePrivilege	4912	WMIC.exe
Token: 33	4912	WMIC.exe
Token: 34	4912	WMIC.exe
Token: 35	4912	WMIC.exe
Token: 36	4912	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 1084	5404	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	85
PID 5404 wrote to memory of 1084	5404	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	85
PID 1084 wrote to memory of 2088	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	89
PID 1084 wrote to memory of 2088	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	89
PID 1084 wrote to memory of 5880	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	90
PID 1084 wrote to memory of 5880	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	90
PID 1084 wrote to memory of 5928	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	91
PID 1084 wrote to memory of 5928	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	91
PID 1084 wrote to memory of 4952	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	95
PID 1084 wrote to memory of 4952	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	95
PID 1084 wrote to memory of 5000	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	96
PID 1084 wrote to memory of 5000	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	96
PID 5880 wrote to memory of 4912	5880	cmd.exe	99
PID 5880 wrote to memory of 4912	5880	cmd.exe	99
PID 2088 wrote to memory of 4928	2088	cmd.exe	100
PID 2088 wrote to memory of 4928	2088	cmd.exe	100
PID 5000 wrote to memory of 3016	5000	cmd.exe	101
PID 5000 wrote to memory of 3016	5000	cmd.exe	101
PID 1084 wrote to memory of 4876	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	103
PID 1084 wrote to memory of 4876	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	103
PID 4876 wrote to memory of 3952	4876	cmd.exe	105
PID 4876 wrote to memory of 3952	4876	cmd.exe	105
PID 1084 wrote to memory of 3992	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	106
PID 1084 wrote to memory of 3992	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	106
PID 1084 wrote to memory of 748	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	107
PID 1084 wrote to memory of 748	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	107
PID 3992 wrote to memory of 316	3992	cmd.exe	110
PID 3992 wrote to memory of 316	3992	cmd.exe	110
PID 748 wrote to memory of 5944	748	cmd.exe	111
PID 748 wrote to memory of 5944	748	cmd.exe	111
PID 1084 wrote to memory of 5496	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	112
PID 1084 wrote to memory of 5496	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	112
PID 5496 wrote to memory of 1428	5496	cmd.exe	114
PID 5496 wrote to memory of 1428	5496	cmd.exe	114
PID 1084 wrote to memory of 4192	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	115
PID 1084 wrote to memory of 4192	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	115
PID 1084 wrote to memory of 4348	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	116
PID 1084 wrote to memory of 4348	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	116
PID 4348 wrote to memory of 3328	4348	cmd.exe	119
PID 4348 wrote to memory of 3328	4348	cmd.exe	119
PID 4192 wrote to memory of 2564	4192	cmd.exe	120
PID 4192 wrote to memory of 2564	4192	cmd.exe	120
PID 1084 wrote to memory of 1760	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	123
PID 1084 wrote to memory of 1760	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	123
PID 1084 wrote to memory of 4740	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	124
PID 1084 wrote to memory of 4740	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	124
PID 1084 wrote to memory of 464	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	125
PID 1084 wrote to memory of 464	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	125
PID 1084 wrote to memory of 4376	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	126
PID 1084 wrote to memory of 4376	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	126
PID 4740 wrote to memory of 4092	4740	cmd.exe	131
PID 4740 wrote to memory of 4092	4740	cmd.exe	131
PID 1760 wrote to memory of 4744	1760	cmd.exe	132
PID 1760 wrote to memory of 4744	1760	cmd.exe	132
PID 464 wrote to memory of 4116	464	cmd.exe	133
PID 464 wrote to memory of 4116	464	cmd.exe	133
PID 4376 wrote to memory of 5884	4376	cmd.exe	134
PID 4376 wrote to memory of 5884	4376	cmd.exe	134
PID 4744 wrote to memory of 3384	4744	cmd.exe	135
PID 4744 wrote to memory of 3384	4744	cmd.exe	135
PID 4092 wrote to memory of 4540	4092	cmd.exe	136
PID 4092 wrote to memory of 4540	4092	cmd.exe	136
PID 1084 wrote to memory of 3332	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	137
PID 1084 wrote to memory of 3332	1084	2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe	137

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1428	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Users\Admin\AppData\Local\Temp\2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-04-14_8d4409d7e41aaec228baa277f857900a_black-basta_cobalt-strike_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:2564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3332
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:5416
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4324
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:2096
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:516
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:5212
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:4492
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:4552
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:3048
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:4592
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:3636
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:2452
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:2292
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:2448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:3112
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:2828
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:640
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:2712
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:3232
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:3368
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2536
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:636
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1272
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:2952
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2796
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe

Filesize
9.7MB

MD5
8d4409d7e41aaec228baa277f857900a

SHA1
ad51aa98df408fb7f06c002c27d4001468aff7fc

SHA256
fd0771a31ff14cf9f027296eaadf08ac75b481befe92ca3174ab5647dbf7539f

SHA512
8a3fa60919a6da797ba85ce908554fa9022fedc3717c40787b215403af46fc67a06ef1d665721446d62d61a48237568a79d63bc9abe44e6d844dd19ba4228994

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\ConnectUninstall.png

Filesize
235KB

MD5
5794881403d01a0a699040b8079c11bd

SHA1
c444fd9e525ba7cfe9f84d5577c35d7e9930aa41

SHA256
9c97c047797b21736fd8d02e2851a9658430e8d78eeb7c0795e7db8ad7e90155

SHA512
cb4544e143362b2b891f08d5fc50860cd2c7f0a412e7e56f1d4d875056fb1e3417ac2a5e2cbe5a8c024a42f4c8343b1e04c541915701458a5a0f73cf62c95417

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\DenySubmit.csv

Filesize
344KB

MD5
253990d2b38521ad7207e281f1736b01

SHA1
7a6b84b336ed9a07f9225ac0750ff17853a94db7

SHA256
dab588a126520c500bb76cae83da8714086db5944d03df11865125843228d502

SHA512
fbab06b5fed9bea72be81f44fa36b14bd0f6a2c1f21c85502623a1a587533ed476365f63e685ce747897af1eaff864574c492bbcf5524e90bd2fdc3b34c7fbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\LimitFind.xlsx

Filesize
13KB

MD5
de2cebffb59cf33524e61dd276db4561

SHA1
b5ab2ad8e0a82276272c9e45b3959f51a8d176f7

SHA256
fa947d2f9ca411729c3b41e0d60dc7bbb271fe872918e357b5150543b11768d3

SHA512
f1a7b945e18f2e3a6d67588bd1464a40c058dd812cf5b6ee778ca75759d343d0e85e6b5caac7afb5a9583c0afff2028a17379f202ee0092ccdab3d1a8248b05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RegisterInvoke.jpg

Filesize
313KB

MD5
6afce5662d7a7c1a9b7e7efdbcb512da

SHA1
333380f8c996a590a3b13e93d0db750f378c0468

SHA256
3324c793572873aba3f4430864b857d522c0b888006e9ab2b92b142c78c3277a

SHA512
246e16ab70886653863c5772014cf3efbdace2b91c54af772c4fbdca9577b99c888e4ab4c83181b8f9424a11984b466aeae9ed2485b13b2735aa5b19c750c1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RemoveWait.docx

Filesize
861KB

MD5
895bc85fa9b9ebcf319e58e97c34c831

SHA1
aa12c380c4c0fc53cac2da088a32be58fc3f7968

SHA256
8f9d00ac7d3682a7bee5ecf4899228e5c192a3cee5b1d8647609abca5a1ad49a

SHA512
ff1571902b58db0d5d613c386c1cc3378fc4cd202f276d2d8ab88b32e779b01002fe34b6dc71fc24980b1c80b1b0ebe7705da4c7a8e9ac7ffc5746ce5fe9e1b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SwitchCompare.mp3

Filesize
548KB

MD5
cf595f3013805cb635894c66a53346ce

SHA1
85e2f03839afb8e674848475b5a341a4cd7d778b

SHA256
55cb48012d626956979d824c258ddf739bce2990205143ad3367bb0eb185fc66

SHA512
964a4f5f3e800b4f25e02a61d2536f81476b013c2c7fe91ae5ea987a422e9cd394ecf2b222ffdb3cc9c98863449f9a708fd25af6a6bfc77f9ebf63c3b2ae9548

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SwitchRead.docx

Filesize
15KB

MD5
ecdb5731fe6c5df2e2bacfe9450e6890

SHA1
f5ea3c1482d0b5ad3de423839f8cf659e1f82b80

SHA256
77f8f54067843eb4938bce7b88c29012c8422f4279daed3cc5dc8e9498ac986e

SHA512
787d1c7b365cdf6291bc10fd7e7c5727b36c3e8353d29a81524f79ae8ba41ab8d70ec2124ec502c513f9a820d6f0fc27722ef2f884c2d1263809b8180a2ec797

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UnlockApprove.docx

Filesize
16KB

MD5
c96f0d4e54fe2813b916c652ee12cb0f

SHA1
7c997a04eaf6746d1e12fc08e494ee2947adec93

SHA256
c9e70b199c6dc43da5421f3e5e09cf9ba351bba395a05d0fb6c7995608d2fee0

SHA512
ab09b80230fcbfcc97562a7c4cda331867ffda48238f9916602b0f2543e4b35236011c8e25940f58cbccb6e8302b6854ca5f03e898e09679f9b5ab58024f9a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\UpdateCheckpoint.mp3

Filesize
407KB

MD5
33316f1ce0345df6138489ddd9df6570

SHA1
ff8f6344299ef519210bf5d036aaa547f92cf86a

SHA256
4bb4763b138992bed5b6e0b648ae026a55769c18d13ed3dd28f1b977c08c3cd2

SHA512
4a3d863d9baa9e1ba01ada1ed0d3162e460ad66f25c38ce3c7fa721a4bcf35ab27d3864ced9a78a063aa53c42137844f6dd228189b094da44fd5cce7ec0f7f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\BackupSubmit.xlt

Filesize
563KB

MD5
d9ea852228608e194676fc14e8d0f7e7

SHA1
45ef506c3c222fdfc03be3ce037c31a5e37e3730

SHA256
dd63126bf6780f32332532c2c82c419ca6e6135befb20aef9b5a9565d828e12f

SHA512
fa08069d3cdd249c35261e0a7da92ec6f148a9db53336ce9e7b1289d2b4f83e09bc362b71ab79adb7405b93be79ac02a2cab3659fdb22e009cd56a7c98ba687f

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ConfirmEdit.docx

Filesize
17KB

MD5
6dcc24b204a0a6b5e6efc397badfc131

SHA1
d8425049a8a912dc64dd8f900aa5a3565293eab6

SHA256
9c621b0ce445a95af602a7329937f8570cb3fce7a1a7927feb0bdf70deab1f88

SHA512
01cb8e12a21e1e1c3385fe38344b8f03b3b41732591b534ccd36d4a4f8f2ab3486ecb6731711ca849eeb57f39a698e9628f388f399e908286b3cb9e2e6b91007

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\JoinBackup.xls

Filesize
1.0MB

MD5
8cebe689fa85a58deb10f6f9cbec9751

SHA1
84d3d9e2769f295020a8b1db8389bf331a8f130a

SHA256
2c81c988b08a0c39baa3c228d646a015f2c7889a3cf13161a6b23a67b3cbbeef

SHA512
a983cbc0755667e0fea658d6bde2af9eb0a6ba6329b375c2dab478f5eef2405644e34e0c3ccb9437b0c5d5871b304cb312a4bdc840f2844b7045e75f22e49684

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\NewMeasure.txt

Filesize
1.2MB

MD5
e90c47f78476d2a1172fb74916194a42

SHA1
d3695cbd07132fdc936d44aecb1ec29907746a9c

SHA256
899d0b916e3e7372bc09a5d5cba33e89405d8cf7c7f87405f8002cf6fd7f01e5

SHA512
60438859b2ded55e9695bbad77c201cb922a54350394a05fcf2578f790aea5cca2fd5d5457cdc6f545f3fe5594e89b215ee8bdb7e0ae90bcf00297a1f6658fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\PushUpdate.pdf

Filesize
619KB

MD5
9e68def0a0f7aa7eba0004d1f455f953

SHA1
2b3f1888e7644faa6a4c5b32f64f275da1ca5215

SHA256
c91b64b837436fe1964225a15605aa50336f6f276b6d725e1f0c216b75cf72e4

SHA512
0bb6198ba2fbdefc526e014d94b3dd1c5da348633f1442754289573adc4da3b7c2d39d3cb9443ffdb78c803b3bbba6ce6a77eb407e8f777717ad3e5523988e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SkipCompress.xlsx

Filesize
13KB

MD5
3341f2e11d948f9ac95a727adf2c31ed

SHA1
6b0f1cdd605df1586bdea6e13f099b9228654246

SHA256
87b0bfd7cfb03d67b91bde02088b965082754177277bd62fe81d2bee4ca3b25c

SHA512
e624f3046a79729f4a4aa1fa0f2fe55ca4a9c9cc4f80d8c0d46341179700c97a84e790353ec8d04450bc91c1c0365247aa2e635670aa8dcaeffd851eb5e8023d

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\ReceiveDeny.mp4

Filesize
255KB

MD5
f79d928903ebab20596264f75086fbd7

SHA1
511317ba139dc9f88486da5e8663a28433e06d39

SHA256
9fce406f5fe307ead383a3a8343175b01c7a46a5cfe143abf9f9f7c61ea0a350

SHA512
24ad04338e1817c7cf2fe28900f9b9502682f4cd46b0b25550ba8c4f31cfb513f42e7e60be177c3ac1cff05e9ca1e03728a54087ec04d516ca765cb5f13b1170

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\EditWrite.xlsx

Filesize
195KB

MD5
6dca47ab44aaf7fabd323aa20d308957

SHA1
f932fb3d23529ca05f347516e6ad11cec3e16fe4

SHA256
5269d660333ae38c6ddba1f7ccb4386c1470da1f9e49ea95398a5b0166f3c509

SHA512
a3df01338d03ff4d897f43023c6c8cc3b2b05f4c9d7eb372177e81bc73dd147726179dc92468ed8c49875e6e182a46bfef9f26312bfee471871d9a707bc5784c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ShowReceive.jpeg

Filesize
135KB

MD5
5f37b07fec1f549ee87371cb8d36619e

SHA1
cc2d004c85fd376309e4ba152be468c08e6f791e

SHA256
26a0663b445a1e770a728cece7b6277af976265d609a4c4b8962c2c3c24e18f5

SHA512
0c51cf2013cf38819aa578c17b5ace2ea1883092ee56d6c4ff6cf6c85692965a2002141f8eff72328e2aa2c7bc7ff91402eddd35a23d02b860a554ebc3998fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CompressClear.png

Filesize
438KB

MD5
7bdd6c2c41b66b42c43442efb6d2641c

SHA1
83f1a70bd1ec64063c918182b79382080d710d9b

SHA256
ed97c7b7df110af2e66b10ff63e08f47c41b3c1c340916802bd3d000fc2bbf1c

SHA512
b91cc949b7834e499574fceb7c4423e147ceec946ec8746c8f6e2604c15f286f8a3aedcc8ffef6fedf683683ba5ee238704ba4fc6aba993ead3a0eb4cdd8d7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\CompressEdit.jpeg

Filesize
475KB

MD5
439fe8509264e4e67241a94408a587da

SHA1
dd1e1f550c472c7460910b6e90cdf7adab455ad3

SHA256
146d3cc7dc2a38b0cd900ac85a1e2689376ed552d31f6be483b0de2a9d1337e5

SHA512
8b554bf6ae187632fc214664680f8006e4d46f1d4a37d60ab9856e61eac795821f55cb3ca860ba3fc82fa019eceab0c59d02b3cf345774ae14ba430ee3d6a875

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConvertSwitch.png

Filesize
548KB

MD5
a9be82c2664dc5497a59cf0b9d0e0d4f

SHA1
26729f4c9c062f16e9ca810a626a7cecf254b4a4

SHA256
b0ee86125141647c30886903ab3036377a5d3436b76b3f142dd0214f95e26201

SHA512
db8dfe3204f9f54eca4e9ba1d8ff7fd80a3e7574bcb58be38041cf021a047594ffa7ec907e46843e25bf05fca64e7a412e21174716e1e99f8f12e084245434e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ProtectConvertFrom.png

Filesize
658KB

MD5
feaedaae609c83a738e68de971fc5b8a

SHA1
7ca71aa1bea1b2b3b1992d217268389598b395b9

SHA256
0fdd459fb6b3987dd25157723823bfbb0a5b6019549974d61d12dc6ba9c5faa3

SHA512
b357e50e87f9c9f8cbe7cda230175edcba56bdf3fbbdcd698aa05b40624073f072568db9ebb71979b214e4ade203cf727d6411eb547fde4bea45796efab56fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\SplitBackup.bmp

Filesize
713KB

MD5
39cf8dff5b685d3e310746e68d119728

SHA1
ce26075e9e62d770b5dcfae141b2c7c53ef09585

SHA256
7949d392dca6d4a1ac42f7d3b0dcd90af6245d7144cbfe3d7203420c2235cbb7

SHA512
786642e6ba1c15e63920d77fd8126a4dcd5d82cf5c3dfad0210388b23b9098d1ff3492a5fa41046e74e82f4d42d6e464f934573f067c2fea1ffef1233ca033d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\WatchAssert.png

Filesize
676KB

MD5
85f1e4daf50a593e37fff72bbf9a7aeb

SHA1
622c868985c9430d5fad41b26398e28f72d3ac51

SHA256
c196634f9c0a658e3841783299089aaac2fb91b51a970cd22a449df4f06e1b55

SHA512
ac6868130dd4adb2b3385f08a7ca7fd75f8932614b04df87161cd9e1b56247d0eff660c2f34804da9346a59504866b1cd7dd7ebfba6c0d54369af9caa82131eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_asyncio.pyd

Filesize
34KB

MD5
7d4f9a2b793e021f7e37b8448751ed4e

SHA1
0ea07b5024501aad5008655cfeae6d96b5da957a

SHA256
2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4

SHA512
af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_bz2.pyd

Filesize
46KB

MD5
6250a28b9d0bfefc1254bd78ece7ae9f

SHA1
4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd

SHA256
7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b

SHA512
6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_cffi_backend.cp310-win_amd64.pyd

Filesize
71KB

MD5
7727212e7bdbf63b1a39fb7faad24265

SHA1
a8fdec19d6690081b2bf55247e8e17657a68ac97

SHA256
b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c

SHA512
2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_ctypes.pyd

Filesize
56KB

MD5
4b90108fabdd64577a84313c765a2946

SHA1
245f4628683a3e18bb6f0d1c88aa26fb959ed258

SHA256
e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1

SHA512
91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_decimal.pyd

Filesize
103KB

MD5
20985dc78dbd1992382354af5ca28988

SHA1
385a3e7a7654e5e4c686399f3a72b235e941e311

SHA256
f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43

SHA512
61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_hashlib.pyd

Filesize
33KB

MD5
3b5530f497ff7c127383d0029e680c35

SHA1
fb5dc554bb9ff49622184cc16883a7567115c7ca

SHA256
5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573

SHA512
12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_lzma.pyd

Filesize
84KB

MD5
8edbeeccb6f3dbb09389d99d45db5542

SHA1
f7e7af2851a5bf22de79a24fe594b5c0435fca8a

SHA256
90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f

SHA512
2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_multiprocessing.pyd

Filesize
25KB

MD5
4fbc5fd5da9da74c04fe0374387b34d3

SHA1
1e9c98db0486f98fb7d8eb9fa57a949494b649b5

SHA256
b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950

SHA512
ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_overlapped.pyd

Filesize
30KB

MD5
5c1441f6ee11632183a83dac2d22853b

SHA1
eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2

SHA256
104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf

SHA512
e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_queue.pyd

Filesize
24KB

MD5
5c4c43763fb1a796134aa5734905c891

SHA1
44a5e1ae4806406a239129d77888bd87d291a410

SHA256
4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c

SHA512
07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_socket.pyd

Filesize
41KB

MD5
53e72716073038c1dd1db65bfdb1254c

SHA1
7bf220a02a3b51aa51300b3a9ea7fa48358ca161

SHA256
e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d

SHA512
c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_sqlite3.pyd

Filesize
48KB

MD5
e7d68df8f65fbb0298a45519e2336f32

SHA1
ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d

SHA256
2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79

SHA512
626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_ssl.pyd

Filesize
60KB

MD5
7e9d95ac47a2284706318656b4f711d3

SHA1
f085104709201c6e64635aeacf1da51599054e55

SHA256
38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9

SHA512
294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\_uuid.pyd

Filesize
21KB

MD5
59cfd9669367517b384922b2485cb6a7

SHA1
1bd44298543204d61d4efd2cd3980ad01071360d

SHA256
e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f

SHA512
d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\attrs-23.1.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\attrs-23.1.0.dist-info\METADATA

Filesize
11KB

MD5
7774d77d730c0c295cb6e3e46817dad6

SHA1
406b5c84945b8dc1035bd53eb33f289b9ae699fc

SHA256
ca0970517928ef943e209e8b98f550e18f7d2894b708f2b4356f28bd7158b038

SHA512
6e991f3144cca536e906a180da7faf3198521c81eff4143fb943ecc6c6faa558d0b1f2aa1379a7294baa039d67202c671027d12c821d95b859ec25e0f78c2c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\attrs-23.1.0.dist-info\RECORD

Filesize
3KB

MD5
a3ad7b8cda8539786366bbbec93d29ad

SHA1
d79fe6c3773c0e56ab64f6288b2cef36bacc10a6

SHA256
0c4d6f02b4fecd5a3a81d45a6d684d38998f2a8dab51490548a27d85a5377299

SHA512
03a7fbf8ae5fb6c4bad790edc6c3479bb604fb7e3f8ccccb96fe7a8ef45dceb1bcf12415d51437c5048aa01183a3cd0e55d5a64fa1e7b22d7dab8031822ed77b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\attrs-23.1.0.dist-info\WHEEL

Filesize
87B

MD5
14ccd3ce79ed5ed7dad2420cd7c0d412

SHA1
388b959646735e0095900e61f3af8a90f594f0a3

SHA256
108d89b06c9dc142f918ff6dea4cd9bfb1b71c33e2ec5b990c37fd227e9a9913

SHA512
6ea1321d7f62e8284c3c5b29a3d7940890a4488503832457bf6580108351c0b2a0ee871928561dff7f71c9ba9d1b89b2d93c1c5839eec4815032e89e670934b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\attrs-23.1.0.dist-info\licenses\LICENSE

Filesize
1KB

MD5
5e55731824cf9205cfabeab9a0600887

SHA1
243e9dd038d3d68c67d42c0c4ba80622c2a56246

SHA256
882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

SHA512
21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\base_library.zip

Filesize
859KB

MD5
594a13edd59f338a9a1f086e3bad7747

SHA1
dd959e42a30ad270fcec7d1cc25785bfd10f2501

SHA256
f4fd58ef0f5e3d2607347a4342b523cff9bdfa6ed2cff4c02b855313718e53aa

SHA512
140fd3b8aa102cf79fd140a197d9325f93e4a2b997ab72483413f0b380a9e41564ae0820308cf5c4958725a70c1ce4549bf624f978152114e1bc6b0f83d31eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.0MB

MD5
606a84af5a9cf8ad3cb0314e77fb7209

SHA1
6de88d8554488ffe3e48c9b14886da16d1703a69

SHA256
0693ffa4990fa8c1664485f3d2a41b581eac0b340d07d62242052a67bf2ed5c3

SHA512
97d451f025aefb487c5cea568eb430356adfe23908321f1c04f8fa4c03df87507eda8d9612c944be4fa733df4cec38a0e37bffd8865088064b749244d4321b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\libffi-7.dll

Filesize
23KB

MD5
d50ebf567149ead9d88933561cb87d09

SHA1
171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

SHA256
6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

SHA512
7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
7f691747ce66d3ed05a7c2c53220c8b5

SHA1
1d3f247042030cf8cf7c859002941beba5d15776

SHA256
7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228

SHA512
b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\propcache\_helpers_c.cp310-win_amd64.pyd

Filesize
32KB

MD5
fd362fc501ddbfa28004e0d5c8df6dd2

SHA1
7ddef836354bee5222c2bf65ed321e4e6254310a

SHA256
cc2d201dfa2dfa430505e88be8d61f69b275cb3eb27e7a32ebf2f95d890709b3

SHA512
a9d87b27454640b8f78e934baf0f8d4781739fc1bb6de2b82b9ad0e11df7aca5d291ea6395289e4313bf5ab89225db5ef3085c945e01dde81bc2a73ce6591761

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\pyexpat.pyd

Filesize
86KB

MD5
46331749084f98bcfe8631d74c5e038f

SHA1
5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347

SHA256
21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df

SHA512
edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\python3.DLL

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\python310.dll

Filesize
1.4MB

MD5
fc7bd515b12e537a39dc93a09b3eaad6

SHA1
96f5d4b0967372553cb106539c5566bc184f6167

SHA256
461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

SHA512
a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\select.pyd

Filesize
24KB

MD5
3797a47a60b606e25348c67043874fe8

SHA1
63a33fedffd52190236a6acd0fc5d9d491e3ac45

SHA256
312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac

SHA512
3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\sqlite3.dll

Filesize
608KB

MD5
6a3a34c9c67efd6c17d44292e8db8fad

SHA1
339b1e514d60d8370eaec1e2f2b71cead999f970

SHA256
7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9

SHA512
6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\unicodedata.pyd

Filesize
287KB

MD5
fed35db31377d515d198e5e446498be2

SHA1
62e388d17e17208ea0e881ccd96c75b7b1fbc5f7

SHA256
af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b

SHA512
0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI54042\yarl\_quoting_c.cp310-win_amd64.pyd

Filesize
41KB

MD5
7147177eb15738516c9a7ab62a8b1d46

SHA1
ea712d9b5c53aba5afea4493d72c075ea43aeccf

SHA256
dc3c23ca363170313ec6bc126a4cdcbe0a61913ff581aac9ce72fe25a77984fc

SHA512
0575c8d4a451f0374c7ebd7d1b183d10c13d0eb754bf6489ea31bf8734be1908943a5907d648fc480ce75b402e70fc2812df773018435987744033e520297c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41nkdedt.yip.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1084-122-0x000002B52D890000-0x000002B52DC05000-memory.dmp

Filesize
3.5MB

Download
memory/1084-117-0x00007FF919C60000-0x00007FF919C8E000-memory.dmp

Filesize
184KB

Download
memory/1084-674-0x00007FF909E60000-0x00007FF90A1D5000-memory.dmp

Filesize
3.5MB

Download
memory/1084-129-0x00007FF919C40000-0x00007FF919C55000-memory.dmp

Filesize
84KB

Download
memory/1084-199-0x00007FF919F20000-0x00007FF919F42000-memory.dmp

Filesize
136KB

Download
memory/1084-125-0x00007FF909E60000-0x00007FF90A1D5000-memory.dmp

Filesize
3.5MB

Download
memory/1084-233-0x00007FF909660000-0x00007FF909E5B000-memory.dmp

Filesize
8.0MB

Download
memory/1084-218-0x00007FF90A1E0000-0x00007FF90A351000-memory.dmp

Filesize
1.4MB

Download
memory/1084-211-0x00007FF91D210000-0x00007FF91D234000-memory.dmp

Filesize
144KB

Download
memory/1084-222-0x00007FF919C40000-0x00007FF919C55000-memory.dmp

Filesize
84KB

Download
memory/1084-217-0x00007FF919C90000-0x00007FF919CAF000-memory.dmp

Filesize
124KB

Download
memory/1084-210-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp

Filesize
4.4MB

Download
memory/1084-126-0x00007FF918FC0000-0x00007FF918FF7000-memory.dmp

Filesize
220KB

Download
memory/1084-123-0x00007FF909660000-0x00007FF909E5B000-memory.dmp

Filesize
8.0MB

Download
memory/1084-76-0x00007FF91CE40000-0x00007FF91CE59000-memory.dmp

Filesize
100KB

Download
memory/1084-78-0x00007FF91A7A0000-0x00007FF91A7CD000-memory.dmp

Filesize
180KB

Download
memory/1084-80-0x00007FF919CC0000-0x00007FF919CD9000-memory.dmp

Filesize
100KB

Download
memory/1084-253-0x00007FF919C40000-0x00007FF919C55000-memory.dmp

Filesize
84KB

Download
memory/1084-241-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp

Filesize
4.4MB

Download
memory/1084-252-0x00007FF909E60000-0x00007FF90A1D5000-memory.dmp

Filesize
3.5MB

Download
memory/1084-251-0x00007FF919000000-0x00007FF9190B8000-memory.dmp

Filesize
736KB

Download
memory/1084-250-0x00007FF919C60000-0x00007FF919C8E000-memory.dmp

Filesize
184KB

Download
memory/1084-264-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp

Filesize
4.4MB

Download
memory/1084-82-0x00007FF919CB0000-0x00007FF919CBD000-memory.dmp

Filesize
52KB

Download
memory/1084-86-0x00007FF90A1E0000-0x00007FF90A351000-memory.dmp

Filesize
1.4MB

Download
memory/1084-93-0x00007FF919000000-0x00007FF9190B8000-memory.dmp

Filesize
736KB

Download
memory/1084-94-0x000002B52D890000-0x000002B52DC05000-memory.dmp

Filesize
3.5MB

Download
memory/1084-106-0x00007FF919CC0000-0x00007FF919CD9000-memory.dmp

Filesize
100KB

Download
memory/1084-107-0x00007FF919B50000-0x00007FF919B64000-memory.dmp

Filesize
80KB

Download
memory/1084-109-0x00007FF919F20000-0x00007FF919F42000-memory.dmp

Filesize
136KB

Download
memory/1084-112-0x00007FF919C90000-0x00007FF919CAF000-memory.dmp

Filesize
124KB

Download
memory/1084-114-0x00007FF90A660000-0x00007FF90A778000-memory.dmp

Filesize
1.1MB

Download
memory/1084-118-0x00007FF919EF0000-0x00007FF919EFA000-memory.dmp

Filesize
40KB

Download
memory/1084-121-0x00007FF919000000-0x00007FF9190B8000-memory.dmp

Filesize
736KB

Download
memory/1084-182-0x00007FF919CF0000-0x00007FF919CFD000-memory.dmp

Filesize
52KB

Download
memory/1084-142-0x00007FF919C30000-0x00007FF919C40000-memory.dmp

Filesize
64KB

Download
memory/1084-693-0x00007FF919EF0000-0x00007FF919EFA000-memory.dmp

Filesize
40KB

Download
memory/1084-101-0x00007FF919C30000-0x00007FF919C40000-memory.dmp

Filesize
64KB

Download
memory/1084-103-0x00007FF919C10000-0x00007FF919C24000-memory.dmp

Filesize
80KB

Download
memory/1084-95-0x00007FF909E60000-0x00007FF90A1D5000-memory.dmp

Filesize
3.5MB

Download
memory/1084-98-0x00007FF919C40000-0x00007FF919C55000-memory.dmp

Filesize
84KB

Download
memory/1084-96-0x00007FF91D210000-0x00007FF91D234000-memory.dmp

Filesize
144KB

Download
memory/1084-92-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp

Filesize
4.4MB

Download
memory/1084-88-0x00007FF919C60000-0x00007FF919C8E000-memory.dmp

Filesize
184KB

Download
memory/1084-84-0x00007FF919C90000-0x00007FF919CAF000-memory.dmp

Filesize
124KB

Download
memory/1084-74-0x00007FF921420000-0x00007FF92142F000-memory.dmp

Filesize
60KB

Download
memory/1084-53-0x00007FF91D210000-0x00007FF91D234000-memory.dmp

Filesize
144KB

Download
memory/1084-45-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp

Filesize
4.4MB

Download
memory/1084-684-0x00007FF919000000-0x00007FF9190B8000-memory.dmp

Filesize
736KB

Download
memory/1084-115-0x00007FF919F00000-0x00007FF919F1B000-memory.dmp

Filesize
108KB

Download
memory/1084-696-0x00007FF919CF0000-0x00007FF919CFD000-memory.dmp

Filesize
52KB

Download
memory/1084-695-0x00007FF918FC0000-0x00007FF918FF7000-memory.dmp

Filesize
220KB

Download
memory/1084-694-0x00007FF909660000-0x00007FF909E5B000-memory.dmp

Filesize
8.0MB

Download
memory/1084-692-0x00007FF90A660000-0x00007FF90A778000-memory.dmp

Filesize
1.1MB

Download
memory/1084-691-0x00007FF919F00000-0x00007FF919F1B000-memory.dmp

Filesize
108KB

Download
memory/1084-690-0x00007FF919F20000-0x00007FF919F42000-memory.dmp

Filesize
136KB

Download
memory/1084-689-0x00007FF919B50000-0x00007FF919B64000-memory.dmp

Filesize
80KB

Download
memory/1084-688-0x00007FF919C10000-0x00007FF919C24000-memory.dmp

Filesize
80KB

Download
memory/1084-687-0x00007FF919C30000-0x00007FF919C40000-memory.dmp

Filesize
64KB

Download
memory/1084-686-0x00007FF919C40000-0x00007FF919C55000-memory.dmp

Filesize
84KB

Download
memory/1084-685-0x00007FF90A780000-0x00007FF90ABEE000-memory.dmp

Filesize
4.4MB

Download
memory/1084-683-0x00007FF919C60000-0x00007FF919C8E000-memory.dmp

Filesize
184KB

Download
memory/1084-682-0x00007FF90A1E0000-0x00007FF90A351000-memory.dmp

Filesize
1.4MB

Download
memory/1084-681-0x00007FF919C90000-0x00007FF919CAF000-memory.dmp

Filesize
124KB

Download
memory/1084-680-0x00007FF919CB0000-0x00007FF919CBD000-memory.dmp

Filesize
52KB

Download
memory/1084-679-0x00007FF919CC0000-0x00007FF919CD9000-memory.dmp

Filesize
100KB

Download
memory/1084-678-0x00007FF91A7A0000-0x00007FF91A7CD000-memory.dmp

Filesize
180KB

Download
memory/1084-677-0x00007FF91CE40000-0x00007FF91CE59000-memory.dmp

Filesize
100KB

Download
memory/1084-676-0x00007FF921420000-0x00007FF92142F000-memory.dmp

Filesize
60KB

Download
memory/1084-675-0x00007FF91D210000-0x00007FF91D234000-memory.dmp

Filesize
144KB

Download
memory/5884-188-0x000001C588FF0000-0x000001C589012000-memory.dmp

Filesize
136KB

Download