exelastealer | d8ed4a8e561b6ba347b87fba4bd13b4c7801255cb3502ad5af14a04d5c8f6205

Analysis

max time kernel
54s
max time network
59s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
24-12-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OrionCheckerPTOV2.zip
Size

36.2MB
MD5

5efb2675d3b4a4f3b8621c2e7b2b8a98
SHA1

45894c2debc8cc219ebd14616e25f04a256772a1
SHA256

d8ed4a8e561b6ba347b87fba4bd13b4c7801255cb3502ad5af14a04d5c8f6205
SHA512

2b44a6d1f17b2a2917370bdd901ef974be5e21c848c57979c51db3d6852601286d8ed9214c09fb18ad31770a498fd0be59e19a93fb8c9816301b5faae859cc80
SSDEEP

786432:5I85pAdBxH3EYIANEOiGXodHhH7RLmvGzofvRTCGXDS39bZ3Hb/:QL9EY/+Ov4dBHNLmvx5C0S33Hb/

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4668	netsh.exe
5024	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3896	cmd.exe
3952	powershell.exe

Deletes itself 1 IoCs

pid	Process
4440	OrionCheckerPTO.exe

Executes dropped EXE 2 IoCs

pid	Process
528	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe

Loads dropped DLL 33 IoCs

pid	Process
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe
4440	OrionCheckerPTO.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Exela Update Service = "C:\\Users\\Admin\\AppData\\Local\\ExelaUpdateService\\Exela.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
26	discord.com
27	discord.com
33	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	ip-api.com

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4220	cmd.exe
4480	ARP.EXE

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5224	tasklist.exe
5508	tasklist.exe
3168	tasklist.exe
5248	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
476	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00280000000450db-69.dat	upx
behavioral1/memory/4440-73-0x00007FFA70FE0000-0x00007FFA71445000-memory.dmp	upx
behavioral1/files/0x00280000000450a9-75.dat	upx
behavioral1/memory/4440-81-0x00007FFA7EC30000-0x00007FFA7EC54000-memory.dmp	upx
behavioral1/files/0x00280000000450d5-82.dat	upx
behavioral1/files/0x00280000000450b3-102.dat	upx
behavioral1/files/0x00280000000450b2-101.dat	upx
behavioral1/files/0x00280000000450b1-100.dat	upx
behavioral1/files/0x00280000000450b0-99.dat	upx
behavioral1/files/0x00280000000450af-98.dat	upx
behavioral1/files/0x00280000000450ae-97.dat	upx
behavioral1/files/0x00280000000450ad-96.dat	upx
behavioral1/files/0x00280000000450ac-95.dat	upx
behavioral1/files/0x00280000000450ab-94.dat	upx
behavioral1/files/0x00280000000450aa-93.dat	upx
behavioral1/files/0x00280000000450a8-92.dat	upx
behavioral1/files/0x00280000000450a7-91.dat	upx
behavioral1/files/0x00280000000450a6-90.dat	upx
behavioral1/files/0x00280000000450de-89.dat	upx
behavioral1/files/0x00280000000450dd-88.dat	upx
behavioral1/files/0x00280000000450dc-87.dat	upx
behavioral1/files/0x00280000000450d9-86.dat	upx
behavioral1/files/0x00280000000450d6-85.dat	upx
behavioral1/files/0x00280000000450d4-84.dat	upx
behavioral1/memory/4440-83-0x00007FFA88A70000-0x00007FFA88A7F000-memory.dmp	upx
behavioral1/memory/4440-104-0x00007FFA801E0000-0x00007FFA801F9000-memory.dmp	upx
behavioral1/memory/4440-106-0x00007FFA81860000-0x00007FFA8186D000-memory.dmp	upx
behavioral1/memory/4440-108-0x00007FFA7B9B0000-0x00007FFA7B9C9000-memory.dmp	upx
behavioral1/memory/4440-110-0x00007FFA7B980000-0x00007FFA7B9AC000-memory.dmp	upx
behavioral1/memory/4440-112-0x00007FFA77C00000-0x00007FFA77C1E000-memory.dmp	upx
behavioral1/memory/4440-114-0x00007FFA70E70000-0x00007FFA70FDD000-memory.dmp	upx
behavioral1/memory/4440-116-0x00007FFA77BD0000-0x00007FFA77BFE000-memory.dmp	upx
behavioral1/memory/4440-121-0x00007FFA70DB0000-0x00007FFA70E66000-memory.dmp	upx
behavioral1/memory/4440-120-0x00007FFA70FE0000-0x00007FFA71445000-memory.dmp	upx
behavioral1/memory/4440-124-0x00007FFA7EC30000-0x00007FFA7EC54000-memory.dmp	upx
behavioral1/memory/4440-123-0x00007FFA70A30000-0x00007FFA70DA4000-memory.dmp	upx
behavioral1/memory/4440-126-0x00007FFA77BB0000-0x00007FFA77BC4000-memory.dmp	upx
behavioral1/files/0x00280000000450d8-131.dat	upx
behavioral1/memory/4440-136-0x00007FFA72910000-0x00007FFA72925000-memory.dmp	upx
behavioral1/memory/4440-142-0x00007FFA728F0000-0x00007FFA7290C000-memory.dmp	upx
behavioral1/memory/4440-141-0x00007FFA77C00000-0x00007FFA77C1E000-memory.dmp	upx
behavioral1/memory/4440-140-0x00007FFA70910000-0x00007FFA70A28000-memory.dmp	upx
behavioral1/files/0x00280000000450e0-139.dat	upx
behavioral1/memory/4440-135-0x00007FFA7B9B0000-0x00007FFA7B9C9000-memory.dmp	upx
behavioral1/memory/4440-133-0x00007FFA77650000-0x00007FFA77664000-memory.dmp	upx
behavioral1/memory/4440-132-0x00007FFA81860000-0x00007FFA8186D000-memory.dmp	upx
behavioral1/memory/4440-130-0x00007FFA817B0000-0x00007FFA817C0000-memory.dmp	upx
behavioral1/memory/4440-129-0x00007FFA801E0000-0x00007FFA801F9000-memory.dmp	upx
behavioral1/files/0x00280000000450b5-143.dat	upx
behavioral1/memory/4440-150-0x00007FFA708D0000-0x00007FFA708E5000-memory.dmp	upx
behavioral1/memory/4440-149-0x00007FFA77BD0000-0x00007FFA77BFE000-memory.dmp	upx
behavioral1/memory/4440-148-0x00007FFA708F0000-0x00007FFA70903000-memory.dmp	upx
behavioral1/files/0x00280000000450b7-147.dat	upx
behavioral1/files/0x00280000000450b6-151.dat	upx
behavioral1/files/0x004f0000000450b8-154.dat	upx
behavioral1/files/0x00280000000450d3-156.dat	upx
behavioral1/files/0x00280000000450c2-158.dat	upx
behavioral1/memory/4440-164-0x00007FFA70830000-0x00007FFA70854000-memory.dmp	upx
behavioral1/memory/4440-163-0x00007FFA81240000-0x00007FFA8124B000-memory.dmp	upx
behavioral1/memory/4440-162-0x00007FFA70860000-0x00007FFA7087C000-memory.dmp	upx
behavioral1/memory/4440-161-0x00007FFA81370000-0x00007FFA8137A000-memory.dmp	upx
behavioral1/memory/4440-160-0x00007FFA815B0000-0x00007FFA815BE000-memory.dmp	upx
behavioral1/memory/4440-146-0x00007FFA70E70000-0x00007FFA70FDD000-memory.dmp	upx
behavioral1/memory/4440-166-0x00007FFA70880000-0x00007FFA708C1000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4816	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4620	cmd.exe
4168	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1928	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
1628	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3384	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4784	ipconfig.exe
1928	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1156	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3064	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	WMIC.exe
3384	WMIC.exe
3384	WMIC.exe
3384	WMIC.exe
4708	WMIC.exe
4708	WMIC.exe
4708	WMIC.exe
4708	WMIC.exe
592	WMIC.exe
592	WMIC.exe
592	WMIC.exe
592	WMIC.exe
5868	WMIC.exe
5868	WMIC.exe
5868	WMIC.exe
5868	WMIC.exe
3952	powershell.exe
3952	powershell.exe
1628	WMIC.exe
1628	WMIC.exe
1628	WMIC.exe
1628	WMIC.exe
3912	WMIC.exe
3912	WMIC.exe
3912	WMIC.exe
3912	WMIC.exe
5668	WMIC.exe
5668	WMIC.exe
5668	WMIC.exe
5668	WMIC.exe
5704	WMIC.exe
5704	WMIC.exe
5704	WMIC.exe
5704	WMIC.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2480	7zFM.exe
Token: 35	2480	7zFM.exe
Token: SeSecurityPrivilege	2480	7zFM.exe
Token: SeIncreaseQuotaPrivilege	3384	WMIC.exe
Token: SeSecurityPrivilege	3384	WMIC.exe
Token: SeTakeOwnershipPrivilege	3384	WMIC.exe
Token: SeLoadDriverPrivilege	3384	WMIC.exe
Token: SeSystemProfilePrivilege	3384	WMIC.exe
Token: SeSystemtimePrivilege	3384	WMIC.exe
Token: SeProfSingleProcessPrivilege	3384	WMIC.exe
Token: SeIncBasePriorityPrivilege	3384	WMIC.exe
Token: SeCreatePagefilePrivilege	3384	WMIC.exe
Token: SeBackupPrivilege	3384	WMIC.exe
Token: SeRestorePrivilege	3384	WMIC.exe
Token: SeShutdownPrivilege	3384	WMIC.exe
Token: SeDebugPrivilege	3384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3384	WMIC.exe
Token: SeRemoteShutdownPrivilege	3384	WMIC.exe
Token: SeUndockPrivilege	3384	WMIC.exe
Token: SeManageVolumePrivilege	3384	WMIC.exe
Token: 33	3384	WMIC.exe
Token: 34	3384	WMIC.exe
Token: 35	3384	WMIC.exe
Token: 36	3384	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4708	WMIC.exe
Token: SeSecurityPrivilege	4708	WMIC.exe
Token: SeTakeOwnershipPrivilege	4708	WMIC.exe
Token: SeLoadDriverPrivilege	4708	WMIC.exe
Token: SeSystemProfilePrivilege	4708	WMIC.exe
Token: SeSystemtimePrivilege	4708	WMIC.exe
Token: SeProfSingleProcessPrivilege	4708	WMIC.exe
Token: SeIncBasePriorityPrivilege	4708	WMIC.exe
Token: SeCreatePagefilePrivilege	4708	WMIC.exe
Token: SeBackupPrivilege	4708	WMIC.exe
Token: SeRestorePrivilege	4708	WMIC.exe
Token: SeShutdownPrivilege	4708	WMIC.exe
Token: SeDebugPrivilege	4708	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4708	WMIC.exe
Token: SeRemoteShutdownPrivilege	4708	WMIC.exe
Token: SeUndockPrivilege	4708	WMIC.exe
Token: SeManageVolumePrivilege	4708	WMIC.exe
Token: 33	4708	WMIC.exe
Token: 34	4708	WMIC.exe
Token: 35	4708	WMIC.exe
Token: 36	4708	WMIC.exe
Token: SeDebugPrivilege	3168	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4708	WMIC.exe
Token: SeSecurityPrivilege	4708	WMIC.exe
Token: SeTakeOwnershipPrivilege	4708	WMIC.exe
Token: SeLoadDriverPrivilege	4708	WMIC.exe
Token: SeSystemProfilePrivilege	4708	WMIC.exe
Token: SeSystemtimePrivilege	4708	WMIC.exe
Token: SeProfSingleProcessPrivilege	4708	WMIC.exe
Token: SeIncBasePriorityPrivilege	4708	WMIC.exe
Token: SeCreatePagefilePrivilege	4708	WMIC.exe
Token: SeBackupPrivilege	4708	WMIC.exe
Token: SeRestorePrivilege	4708	WMIC.exe
Token: SeShutdownPrivilege	4708	WMIC.exe
Token: SeDebugPrivilege	4708	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4708	WMIC.exe
Token: SeRemoteShutdownPrivilege	4708	WMIC.exe
Token: SeUndockPrivilege	4708	WMIC.exe
Token: SeManageVolumePrivilege	4708	WMIC.exe
Token: 33	4708	WMIC.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2480	7zFM.exe
2480	7zFM.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe
5184	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 4440	528	OrionCheckerPTO.exe	87
PID 528 wrote to memory of 4440	528	OrionCheckerPTO.exe	87
PID 4440 wrote to memory of 5180	4440	OrionCheckerPTO.exe	88
PID 4440 wrote to memory of 5180	4440	OrionCheckerPTO.exe	88
PID 4440 wrote to memory of 5972	4440	OrionCheckerPTO.exe	90
PID 4440 wrote to memory of 5972	4440	OrionCheckerPTO.exe	90
PID 4440 wrote to memory of 3796	4440	OrionCheckerPTO.exe	91
PID 4440 wrote to memory of 3796	4440	OrionCheckerPTO.exe	91
PID 4440 wrote to memory of 4924	4440	OrionCheckerPTO.exe	93
PID 4440 wrote to memory of 4924	4440	OrionCheckerPTO.exe	93
PID 4440 wrote to memory of 4020	4440	OrionCheckerPTO.exe	95
PID 4440 wrote to memory of 4020	4440	OrionCheckerPTO.exe	95
PID 5972 wrote to memory of 3384	5972	cmd.exe	98
PID 5972 wrote to memory of 3384	5972	cmd.exe	98
PID 3796 wrote to memory of 4708	3796	cmd.exe	99
PID 3796 wrote to memory of 4708	3796	cmd.exe	99
PID 4020 wrote to memory of 3168	4020	cmd.exe	100
PID 4020 wrote to memory of 3168	4020	cmd.exe	100
PID 4440 wrote to memory of 4672	4440	OrionCheckerPTO.exe	102
PID 4440 wrote to memory of 4672	4440	OrionCheckerPTO.exe	102
PID 4672 wrote to memory of 592	4672	cmd.exe	104
PID 4672 wrote to memory of 592	4672	cmd.exe	104
PID 4440 wrote to memory of 2392	4440	OrionCheckerPTO.exe	105
PID 4440 wrote to memory of 2392	4440	OrionCheckerPTO.exe	105
PID 4440 wrote to memory of 2948	4440	OrionCheckerPTO.exe	106
PID 4440 wrote to memory of 2948	4440	OrionCheckerPTO.exe	106
PID 2392 wrote to memory of 5868	2392	cmd.exe	109
PID 2392 wrote to memory of 5868	2392	cmd.exe	109
PID 2948 wrote to memory of 5248	2948	cmd.exe	110
PID 2948 wrote to memory of 5248	2948	cmd.exe	110
PID 4440 wrote to memory of 476	4440	OrionCheckerPTO.exe	111
PID 4440 wrote to memory of 476	4440	OrionCheckerPTO.exe	111
PID 476 wrote to memory of 5232	476	cmd.exe	113
PID 476 wrote to memory of 5232	476	cmd.exe	113
PID 4440 wrote to memory of 2548	4440	OrionCheckerPTO.exe	114
PID 4440 wrote to memory of 2548	4440	OrionCheckerPTO.exe	114
PID 2548 wrote to memory of 1600	2548	cmd.exe	116
PID 2548 wrote to memory of 1600	2548	cmd.exe	116
PID 4440 wrote to memory of 3520	4440	OrionCheckerPTO.exe	117
PID 4440 wrote to memory of 3520	4440	OrionCheckerPTO.exe	117
PID 3520 wrote to memory of 3064	3520	cmd.exe	119
PID 3520 wrote to memory of 3064	3520	cmd.exe	119
PID 4440 wrote to memory of 5088	4440	OrionCheckerPTO.exe	120
PID 4440 wrote to memory of 5088	4440	OrionCheckerPTO.exe	120
PID 4440 wrote to memory of 3896	4440	OrionCheckerPTO.exe	121
PID 4440 wrote to memory of 3896	4440	OrionCheckerPTO.exe	121
PID 4440 wrote to memory of 860	4440	OrionCheckerPTO.exe	122
PID 4440 wrote to memory of 860	4440	OrionCheckerPTO.exe	122
PID 4440 wrote to memory of 4624	4440	OrionCheckerPTO.exe	123
PID 4440 wrote to memory of 4624	4440	OrionCheckerPTO.exe	123
PID 5088 wrote to memory of 5224	5088	cmd.exe	128
PID 5088 wrote to memory of 5224	5088	cmd.exe	128
PID 860 wrote to memory of 3028	860	cmd.exe	129
PID 860 wrote to memory of 3028	860	cmd.exe	129
PID 4624 wrote to memory of 4656	4624	cmd.exe	130
PID 4624 wrote to memory of 4656	4624	cmd.exe	130
PID 3896 wrote to memory of 3952	3896	cmd.exe	131
PID 3896 wrote to memory of 3952	3896	cmd.exe	131
PID 4440 wrote to memory of 4620	4440	OrionCheckerPTO.exe	132
PID 4440 wrote to memory of 4620	4440	OrionCheckerPTO.exe	132
PID 4440 wrote to memory of 4220	4440	OrionCheckerPTO.exe	134
PID 4440 wrote to memory of 4220	4440	OrionCheckerPTO.exe	134
PID 4620 wrote to memory of 4168	4620	cmd.exe	136
PID 4620 wrote to memory of 4168	4620	cmd.exe	136

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5232	attrib.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\OrionCheckerPTOV2.zip"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5412

C:\Users\Admin\Desktop\OrionCheckerPTOV2\OrionCheckerPTO.exe
"C:\Users\Admin\Desktop\OrionCheckerPTOV2\OrionCheckerPTO.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\Desktop\OrionCheckerPTOV2\OrionCheckerPTO.exe
  "C:\Users\Admin\Desktop\OrionCheckerPTOV2\OrionCheckerPTO.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:4924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Exela Update Service" /t REG_SZ /d "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe" /f
      4⤵
      Adds Run key to start application
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4220
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1156
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:1320
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious behavior: EnumeratesProcesses
      PID:1628
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:1936
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:1980
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:3856
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:4584
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:1452
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1612
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:2120
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:6012
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:5480
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:4756
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3912
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5508
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4784
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:2280
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:4480
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:1928
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:4816
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4668
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5704

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI5282\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_asyncio.pyd

Filesize
31KB

MD5
1e7d1d597a239a7966991bbb652c7279

SHA1
7e03011a327c51f090295e71f1fc7e9ded6044a7

SHA256
1b1bdefc2b7081badcd475a699505624fab131875f21b324ec328885ef18eac4

SHA512
e7f52aebb2094bc1f25fe2cf27c6b23bce4b49dec5653cf9beca5c39ec3d840bbd2ddb0c8f30954b3890a5846c997347fef8923e18385bddf6d162507c45062a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_bz2.pyd

Filesize
43KB

MD5
72df51b58f400e480d04bee82585d889

SHA1
c751408b95243affd23f19be7f2363730a0ca0f3

SHA256
661e3d8afa17b4400ae4657d3cf4123493afc3c18c485ca53517a3bb5b9236c6

SHA512
bd889cd29591ff7f1274aab138a626173512b7c8244755e70bfdc5c5b624d93bd97efcfb1d3e76e13ffeb111f5fecb5a073c3420285212fef44091bb51c9385e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_cffi_backend.cp310-win_amd64.pyd

Filesize
71KB

MD5
76041575bfb6c23f89168485ba802cd3

SHA1
740dbbbfb5a48985ee866139b2c3edcc33e88587

SHA256
3adf6b1cfcb47d99653c284dc74b13764f960873edf651e99b52a1b6ba1df590

SHA512
800fcac9c2e1312a6f3d46148a9d621ecbde07b473681d88a383d385c30adcc660d763a8babf32b8a4e815b2c2ce4a23d86660403c341f3dbc9ee021df341070

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_ctypes.pyd

Filesize
53KB

MD5
f911615290c2e474593570ff49a0d37c

SHA1
bc274dcc1cbaa11215ceecb893cd0b0fddbcf25a

SHA256
afff032e99ec7dfae085e57d90a34409bea2bcd173fd7688129b76a40bf679d3

SHA512
46b6755d7b9f7e223c757828b2c76519d79cf782c6a61b27a5096913ea8bc717a47ce51f68d5a2e3755c28720226c8281c2d89a29dc800295e157e33300b1959

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_decimal.pyd

Filesize
101KB

MD5
1777f6fca8c9dd7dae318d82e1026e6f

SHA1
80733116d800ad2db672f2b0fa9acfe248610fbd

SHA256
cd656dbca884f4fc0bef601a31bfa3487339698b6a83d542f7766ef1c559cb6c

SHA512
eb2bc1e9a730d945d7be944c3495da6924ffe36072ab73dd4179f7612d5ff1846ae19048f3781b796b520bb02b975ec1aba2aa922c7a06d8ae01dd4ad511a1a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_hashlib.pyd

Filesize
30KB

MD5
62ef0bd76397e6e1597a8fac95417f80

SHA1
7427ec53089a34d2651db6b91eb35d1dd2100851

SHA256
92434b3d6b5b3a1641e918e6c8db103c64fa796f76640b2c06c6fb2546b95add

SHA512
176827453bdead8bce83f039244f9e8c789654d7a1f034baf918c40775c6ea97bce61c6d853ab4905a3143a34691fc2ec04a0f1372dc09290f9c24bd09a89a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_lzma.pyd

Filesize
81KB

MD5
1548750969e9f4f0314df9d6977a8512

SHA1
70db7db19435f2c1bc35f3eec2ba80d4ded0190c

SHA256
e46ce0d226a9f16c7534cdd2dac02f52dac04349fd89f67bf32810753f22c380

SHA512
d832cc07234d8c6237832719afb0b22e9a10c8e6bec7399174bc2132aad1cb878e0bb34d826fb1e522b40c6f2c0ea9e311ef50f97ab2b131b544ad4a1e4d2e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_multiprocessing.pyd

Filesize
22KB

MD5
231d288dea35b78aa2b91b666663b613

SHA1
14e2203aab3c47b2495fcb985f5bc1814a6a5dd0

SHA256
14257ab6b9c2ad214be1511aeb3d195bcc13640b2d4d2e13040133fe4abd06ff

SHA512
53e48facbdf897961aaed423ed0e9dc0ae55989befe77f9b3a0f45727dd1f40f6d98a63c1107919c383cb81fdee2940ba41738bcd406edb522f5b58d961dddd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_overlapped.pyd

Filesize
27KB

MD5
501ae3b1d0ae6a17f713143a8e2ba854

SHA1
50049d7a5b0b8164c6668a2c87bcb1d2f37f75a7

SHA256
53ea9fbdd341e5f46cac4fb6278c7aa9febbab0243b8f6a37133954837a14ca0

SHA512
824d1bce374d2e79ba0e6ce49e022c81052f0dd96bb8a8f3c27ca36e97ae575bb75100106db7949c74732cf855e4778646619e2ab7f1bee18cedd2d30ab4fdfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_queue.pyd

Filesize
21KB

MD5
3b152dfe184f3d1f703e185b8b591567

SHA1
18a0abda2853d2d65f84d453c1fd3d1cd215c412

SHA256
b41abc88a0e5fc43a9506646a185a6874d6cd21366da3cad1b3311ec14c91612

SHA512
566734712d7ce6670985fc8e39af466d2a4f388f193ade99cb6ef7ad02a0f3ea93b27a1e36d4899eaeeccb49e1cf8124ac00487c4a7724527d678e466ffac734

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_socket.pyd

Filesize
38KB

MD5
c69049c7709ba51b9d008f82e6228d69

SHA1
c2763dded2f31ef3bbaccf56271182dfef6ffbb3

SHA256
511d8d612ea3d31b09815bae9c32d765e30e5da880d0a0826aa46b2cefb89b9f

SHA512
848802e3d0d9562fb27e9cbe0e78794593070ac45b83911cd8b1b6297c830fedcdfd433a13861ace229c82a76d9be2871b46bb8f8fe90c1a1088f36b3cc9b2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_sqlite3.pyd

Filesize
45KB

MD5
b5134aa73900fe456b03886a0bdfeefb

SHA1
251d92c9bf6d211ad020149fd84a21fb65513d58

SHA256
93ab57add576c9d78cf763c57d207310d8863b94720ddc49b7274c49a5413e22

SHA512
e065f08a461c6383ff605064985ff44b4d2f895e04b994f2859fcce8759129047e04a8b6908ebfafd9b534acd0a844281070da113685c448bef0caea595d1448

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_ssl.pyd

Filesize
57KB

MD5
d2797b9973de49d2ec21dc92c81fb45d

SHA1
5e1b6624965e2513b08df114fd2b551d783e611d

SHA256
75c787d8012155a4fb3cfac98659dad2ac4ed97f3e8c7f8636f1f26da8447a62

SHA512
f7d453a7d13bb603163dd5a36d7879152cfc175042e6477f7e620f5e5cbeb13bc7194370858c2c46a52deae2bcebc0b1ca4d8333aad93620898d7debef4321df

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\_uuid.pyd

Filesize
18KB

MD5
7c2712f42f11a817aecd7d006e212ffb

SHA1
17552d999e6c5ca6f4f854679be9bb3fb13477f4

SHA256
8be49bd764b8cd77d81107871af096114789c4d6fa802aee128dd5aca75b012b

SHA512
bb9d4d21f6e53194ca3b1d17643170e012740ca1b6a05ad528598e9761496756afaf9ccf057d8f04c638460a92b85e621e4ce05d2cb3d6113f12c0f4ceba0f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\aiohttp\_helpers.cp310-win_amd64.pyd

Filesize
20KB

MD5
93a6adceae46dff859edf2a15ec5b5fc

SHA1
9bbde4df6c86aafad1e1a692b27586f55b537471

SHA256
8e17df90e1b21272db89614fa24ec56cd142ab14fa9846277f93d1269467f16f

SHA512
b18f7fb61f27e59cd5f3dcfae72f5d24d5e5008cca66b0f2245948c39a68d3632bc8f081fdb1343941e7c602e331167b1b684ed3dc205fcf0c82c11ca2c4bf93

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\aiohttp\_http_parser.cp310-win_amd64.pyd

Filesize
67KB

MD5
0e6c721409b0b6c4ccce18fb20bed2cb

SHA1
593bbed2a2449d0c7c1cc110ab3a483dc00d1356

SHA256
bc6a45b06436a8c95d0011482d64a534c0200680019f77f0a00226c42fb2203a

SHA512
2c486474d7effdea9d31e7f6cf4fbe09966d87e674f448efa8b73c93b254367c0c919b8822f1205e94f85a22bb4b16b8d5c8de5b97fab917c93aa793442f9799

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\aiohttp\_http_writer.cp310-win_amd64.pyd

Filesize
19KB

MD5
cb207bcd2588f1337fff703f044964fe

SHA1
f596b06d603dad27ed67e1ca74e7243daf5c3933

SHA256
c437e0d8a3f2b9a1010064da3c6d829cd2df960660ee34219015975120a68b09

SHA512
e9ba8ae0f1db1fba81d3bf52e0d6aa254afb402fc75dd548b2af788b28909d5b45a5a6f28a83ae22ee5201ba1b2797cbc25e3495b488541501ccf39ab97aa662

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\aiohttp\_websocket.cp310-win_amd64.pyd

Filesize
14KB

MD5
4fbe42921abd7841f67adeafcfc1dda9

SHA1
6c44793e94ad1ba9bde0961f9740ca6b86598c5b

SHA256
3056ec50c1988b64e1665ff4fad7e86f72991f5496ef978795702cc0fe877777

SHA512
8df260e77b4152c7dc48f9dda647daefb3967bbf2e8ea77436b2ea237cf55eea1e991779289a46b9c643a76823f0553c9dcbf4b99be77955dd40082f73ff3821

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\base_library.zip

Filesize
858KB

MD5
1ebb920a2696a11237f3e8e4af10d802

SHA1
f86a052e2dfa2df8884ebf80832814f920a820e6

SHA256
d0e26325e67b3db749a83698413c4c270d8b26cd7dbc607006bc526ee784d6df

SHA512
2cfa6746dcdf575f26267b359a8820a6f29d81967c62131463802b30db2e17c8f159a2cbc652f25bdfdfd7c5942d26a26f9e1df984f8560696153a3427e4fb47

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\charset_normalizer\md.cp310-win_amd64.pyd

Filesize
9KB

MD5
fd7838887746ab6ebdde4427c124f2a2

SHA1
839f9f982c3816bff698dcb5a4109f6d8da11592

SHA256
65b4faca21226d8436bee163d809700ca3c74d0ac2124043b846f43d9863f4df

SHA512
bf61d29f57b0c5a0ac9e2d8102bca3da0951e784a13ef36d1f7ea26b82b841c062a1b53d16dbc8f2f0f484508b39e3aef84f9f2d15a2e779da135bfd895675fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\frozenlist\_frozenlist.cp310-win_amd64.pyd

Filesize
33KB

MD5
1635bb8db9b20a6a827193446594f072

SHA1
0c153c9fd440a523881d53dcd7b3c0e7bf9ccf61

SHA256
b43385c41cb76d9f49afbe9e4959bdf4c1651fbb58154ef475258db6dd1851e0

SHA512
45d7a7a6fa60f2a2a58ddff5ed2d1e5c0fe2361a1f2f821fc7142a9fa4fc65ab924bfc2dab08bd32f8de339b31286114c8efa3a5cdeedb2468f835eb3eb6f2b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\libcrypto-1_1.dll

Filesize
1.1MB

MD5
4dc7da1ac1c40196ef9cf2081ebcaaf4

SHA1
1dd5ffb0de01c759f84a3a4f185bf99539b8d68e

SHA256
84ce58b5132ee40cef1eefb03848fc5700ab0451614700f57f9f10b7607b75ee

SHA512
59b7f4b1a479a03aee0701856069734cc2299dbf5ad77c18ee5fa30fe7da0c01946337c463dd22ea487ce89128a46989b056ab146465e2e46a06cd160e5fc65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\libffi-7.dll

Filesize
23KB

MD5
6f818913fafe8e4df7fedc46131f201f

SHA1
bbb7ba3edbd4783f7f973d97b0b568cc69cadac5

SHA256
3f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56

SHA512
5473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\libssl-1_1.dll

Filesize
198KB

MD5
345387a8d1af7d80459060c5666d1ec2

SHA1
d53697afa4df9569ff5f8ddc52652a976ccb39f9

SHA256
5127c01aa1f7b6144498de56ec9ad4f4652a7825dae0958a80ca9ebfe46af3c4

SHA512
b0a8c1c9720bc4a13b888eb787a3ea4185452aaf3b283fec9185fa4992370bfb2d725bb5dae9eb170aa9fe52295a1f6e745cbe562f8fcb3cb067eda3ee39b746

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
a4c04491e870a9d12b4181212fe18cd8

SHA1
0455c303a56da3713b9e21b0ac939b5af26d0d62

SHA256
0deb43d8c8a028cf82341d465d18175cf26555e3fda7f012f998466688bd053d

SHA512
65b032a0b621a271470a7d7c57db102d49790cca0e39b21790e0a46301d849fa33f3cfb90abfe75cd3009af3894ccaaddc7beeda28d67750b83a77dabb29b9d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\pyexpat.pyd

Filesize
81KB

MD5
c1871b8e66709a23c24a4cd2d0a64ece

SHA1
563b1d4012dd656af56bb7715981c967cbbc993e

SHA256
1c8dba692e748c2d2617ef8ddbeacda2d6a6e5f1755d5e5932dec950e353da27

SHA512
73286eba464f85ccf694cc03d2502b28b89f4833211874feace17b729321f0c6fcde9b7e682d4f27d4bca0ca36c64d5099ad16aef070dd499de9b9291af6fe8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\python3.DLL

Filesize
60KB

MD5
a5471f05fd616b0f8e582211ea470a15

SHA1
cb5f8bf048dc4fc58f80bdfd2e04570dbef4730e

SHA256
8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790

SHA512
e87d06778201615b129dcf4e8b4059399128276eb87102b5c3a64b6e92714f6b0d5bde5df4413cc1b66d33a77d7a3912eaa1035f73565dbfd62280d09d46abff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\python310.dll

Filesize
1.4MB

MD5
37bca234095b34b410f9c76e8aabc048

SHA1
cee23e641535fe5724f5af0e68df2b2c98fe5b0b

SHA256
a7c9926a4a279d2fa2a0b4b8adcececc4e1009b0b08d2e689168068d08457cbe

SHA512
9a89c50c54d5ff92bd36dd37d0d5b6a8320dc9702259fbb5d0ef1296396a9cf20e84b4dad86ea627b257682da2346b44aeabc4074d231f50705f3533126f4bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\select.pyd

Filesize
21KB

MD5
5ea4ded3b551945f889f8344a29cb8d6

SHA1
dcc7eda3457b3bf98f67bfab9f042c07bb35b89d

SHA256
9ec5e5c46d2a154c4853a89f6330be252d7f5a42fbdde27f079c3dd59328a036

SHA512
85371819f44656a3add6623a81ef3cb7b7d11c6c3a9561c2acd5c008f42a7a9f3c2bbee67693d9d43fb9607e47331fe0ed3df8ade22cc8c59a6af701bd0d6679

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\sqlite3.dll

Filesize
605KB

MD5
270939e2db0ac4c562398b31d67df675

SHA1
b787bd6b802ff8a43cfc4161d090baef2bba34f4

SHA256
430813405678c04691c74da56462be90a3439c1442a18873ceb719405914ba5c

SHA512
e43c26004f790937717ede200a5e5d71f6e4ba94985848ddf748912531296c0c373992a6bb951c6eabb787a70652e7aef3c227044b7d677674d46a0b09fd93ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\unicodedata.pyd

Filesize
285KB

MD5
f354238d8a4e2d3f1d532975c4cae405

SHA1
4230069d43349f0aa725833a7998d516820490b9

SHA256
4eb6ffca76135df20ed52a90626fd717d9cfbff16bfc62fd97f212a91d89e552

SHA512
7f859e21f33c430e8f1b46ceecf44b92c847c93dbc35919deaff1433a56ff6e707ae1e88a7b9ebdd0fff1783ef1140a88e723eb0042d728b29333e0b4584ee7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI5282\yarl\_quoting_c.cp310-win_amd64.pyd

Filesize
31KB

MD5
5acd770aa04123fe51791d955bb31d23

SHA1
4df0f7d30d459d7d5077e02217c0718a795758fe

SHA256
c4b59ba6890446205f4a877298eed2180e8526defb1a62f33097753ac2e7ef37

SHA512
a341fc417a8fb798b8541820e0689a264c2ab7653292e09e38c83c7ac9d8755e10c5baf8720820bd5d55507f153e8fb95c941a03c0047ec4439b3fd6ce0a8ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqe42meq.sxg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3952-232-0x000001C16EE00000-0x000001C16EE15000-memory.dmp

Filesize
84KB

Download
memory/3952-229-0x000001C170C90000-0x000001C170CB2000-memory.dmp

Filesize
136KB

Download
memory/4440-129-0x00007FFA801E0000-0x00007FFA801F9000-memory.dmp

Filesize
100KB

Download
memory/4440-167-0x00007FFA70A30000-0x00007FFA70DA4000-memory.dmp

Filesize
3.5MB

Download
memory/4440-124-0x00007FFA7EC30000-0x00007FFA7EC54000-memory.dmp

Filesize
144KB

Download
memory/4440-123-0x00007FFA70A30000-0x00007FFA70DA4000-memory.dmp

Filesize
3.5MB

Download
memory/4440-126-0x00007FFA77BB0000-0x00007FFA77BC4000-memory.dmp

Filesize
80KB

Download
memory/4440-120-0x00007FFA70FE0000-0x00007FFA71445000-memory.dmp

Filesize
4.4MB

Download
memory/4440-136-0x00007FFA72910000-0x00007FFA72925000-memory.dmp

Filesize
84KB

Download
memory/4440-142-0x00007FFA728F0000-0x00007FFA7290C000-memory.dmp

Filesize
112KB

Download
memory/4440-141-0x00007FFA77C00000-0x00007FFA77C1E000-memory.dmp

Filesize
120KB

Download
memory/4440-140-0x00007FFA70910000-0x00007FFA70A28000-memory.dmp

Filesize
1.1MB

Download
memory/4440-121-0x00007FFA70DB0000-0x00007FFA70E66000-memory.dmp

Filesize
728KB

Download
memory/4440-135-0x00007FFA7B9B0000-0x00007FFA7B9C9000-memory.dmp

Filesize
100KB

Download
memory/4440-133-0x00007FFA77650000-0x00007FFA77664000-memory.dmp

Filesize
80KB

Download
memory/4440-132-0x00007FFA81860000-0x00007FFA8186D000-memory.dmp

Filesize
52KB

Download
memory/4440-130-0x00007FFA817B0000-0x00007FFA817C0000-memory.dmp

Filesize
64KB

Download
memory/4440-116-0x00007FFA77BD0000-0x00007FFA77BFE000-memory.dmp

Filesize
184KB

Download
memory/4440-114-0x00007FFA70E70000-0x00007FFA70FDD000-memory.dmp

Filesize
1.4MB

Download
memory/4440-150-0x00007FFA708D0000-0x00007FFA708E5000-memory.dmp

Filesize
84KB

Download
memory/4440-149-0x00007FFA77BD0000-0x00007FFA77BFE000-memory.dmp

Filesize
184KB

Download
memory/4440-148-0x00007FFA708F0000-0x00007FFA70903000-memory.dmp

Filesize
76KB

Download
memory/4440-112-0x00007FFA77C00000-0x00007FFA77C1E000-memory.dmp

Filesize
120KB

Download
memory/4440-110-0x00007FFA7B980000-0x00007FFA7B9AC000-memory.dmp

Filesize
176KB

Download
memory/4440-108-0x00007FFA7B9B0000-0x00007FFA7B9C9000-memory.dmp

Filesize
100KB

Download
memory/4440-106-0x00007FFA81860000-0x00007FFA8186D000-memory.dmp

Filesize
52KB

Download
memory/4440-159-0x0000024445950000-0x0000024445CC4000-memory.dmp

Filesize
3.5MB

Download
memory/4440-104-0x00007FFA801E0000-0x00007FFA801F9000-memory.dmp

Filesize
100KB

Download
memory/4440-164-0x00007FFA70830000-0x00007FFA70854000-memory.dmp

Filesize
144KB

Download
memory/4440-163-0x00007FFA81240000-0x00007FFA8124B000-memory.dmp

Filesize
44KB

Download
memory/4440-162-0x00007FFA70860000-0x00007FFA7087C000-memory.dmp

Filesize
112KB

Download
memory/4440-161-0x00007FFA81370000-0x00007FFA8137A000-memory.dmp

Filesize
40KB

Download
memory/4440-160-0x00007FFA815B0000-0x00007FFA815BE000-memory.dmp

Filesize
56KB

Download
memory/4440-146-0x00007FFA70E70000-0x00007FFA70FDD000-memory.dmp

Filesize
1.4MB

Download
memory/4440-166-0x00007FFA70880000-0x00007FFA708C1000-memory.dmp

Filesize
260KB

Download
memory/4440-165-0x00007FFA70DB0000-0x00007FFA70E66000-memory.dmp

Filesize
728KB

Download
memory/4440-168-0x00007FFA701C0000-0x00007FFA70828000-memory.dmp

Filesize
6.4MB

Download
memory/4440-122-0x0000024445950000-0x0000024445CC4000-memory.dmp

Filesize
3.5MB

Download
memory/4440-170-0x00007FFA7C160000-0x00007FFA7C198000-memory.dmp

Filesize
224KB

Download
memory/4440-169-0x00007FFA77BB0000-0x00007FFA77BC4000-memory.dmp

Filesize
80KB

Download
memory/4440-217-0x00007FFA80E20000-0x00007FFA80E2D000-memory.dmp

Filesize
52KB

Download
memory/4440-83-0x00007FFA88A70000-0x00007FFA88A7F000-memory.dmp

Filesize
60KB

Download
memory/4440-81-0x00007FFA7EC30000-0x00007FFA7EC54000-memory.dmp

Filesize
144KB

Download
memory/4440-73-0x00007FFA70FE0000-0x00007FFA71445000-memory.dmp

Filesize
4.4MB

Download
memory/4440-235-0x00007FFA728F0000-0x00007FFA7290C000-memory.dmp

Filesize
112KB

Download
memory/4440-236-0x00007FFA708F0000-0x00007FFA70903000-memory.dmp

Filesize
76KB

Download
memory/4440-237-0x00007FFA708D0000-0x00007FFA708E5000-memory.dmp

Filesize
84KB

Download
memory/4440-271-0x00007FFA7C160000-0x00007FFA7C198000-memory.dmp

Filesize
224KB

Download
memory/4440-273-0x00007FFA70880000-0x00007FFA708C1000-memory.dmp

Filesize
260KB

Download
memory/4440-272-0x00007FFA80E20000-0x00007FFA80E2D000-memory.dmp

Filesize
52KB

Download
memory/4440-270-0x00007FFA701C0000-0x00007FFA70828000-memory.dmp

Filesize
6.4MB

Download
memory/4440-261-0x00007FFA728F0000-0x00007FFA7290C000-memory.dmp

Filesize
112KB

Download
memory/4440-257-0x00007FFA817B0000-0x00007FFA817C0000-memory.dmp

Filesize
64KB

Download
memory/4440-256-0x00007FFA77BB0000-0x00007FFA77BC4000-memory.dmp

Filesize
80KB

Download
memory/4440-255-0x00007FFA70A30000-0x00007FFA70DA4000-memory.dmp

Filesize
3.5MB

Download
memory/4440-254-0x00007FFA70DB0000-0x00007FFA70E66000-memory.dmp

Filesize
728KB

Download
memory/4440-251-0x00007FFA77C00000-0x00007FFA77C1E000-memory.dmp

Filesize
120KB

Download
memory/4440-244-0x00007FFA70FE0000-0x00007FFA71445000-memory.dmp

Filesize
4.4MB

Download
memory/4440-252-0x00007FFA70E70000-0x00007FFA70FDD000-memory.dmp

Filesize
1.4MB

Download
memory/4440-245-0x00007FFA7EC30000-0x00007FFA7EC54000-memory.dmp

Filesize
144KB

Download
memory/4440-287-0x00007FFA70FE0000-0x00007FFA71445000-memory.dmp

Filesize
4.4MB

Download
memory/4440-296-0x00007FFA77BD0000-0x00007FFA77BFE000-memory.dmp

Filesize
184KB

Download
memory/4440-299-0x00007FFA77BB0000-0x00007FFA77BC4000-memory.dmp

Filesize
80KB

Download
memory/5184-286-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-285-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-284-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-283-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-282-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-281-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-280-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-275-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-276-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download
memory/5184-274-0x0000020344000000-0x0000020344001000-memory.dmp

Filesize
4KB

Download