Malware Analysis Report

2025-03-15 03:46

Sample ID 241119-yl6dvs1lgw
Target Hellion.exe
SHA256 53d4b1bdf55b84b9dc09963fbf8c25d2d8164dba5130d136a96c02dc548eb79f
Tags
exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

53d4b1bdf55b84b9dc09963fbf8c25d2d8164dba5130d136a96c02dc548eb79f

Threat Level: Known bad

The file Hellion.exe was found to be: Known bad.

Malicious Activity Summary

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer

Exelastealer family

Exela Stealer

Grants admin privileges

Modifies Windows Firewall

Clipboard Data

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Network Service Discovery

Hide Artifacts: Hidden Files and Directories

Enumerates processes with tasklist

Launches sc.exe

Browser Information Discovery

Permission Groups Discovery: Local Groups

System Network Configuration Discovery: Wi-Fi Discovery

Unsigned PE

System Network Connections Discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

Collects information from the system

Suspicious use of AdjustPrivilegeToken

Gathers network information

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Runs net.exe

Views/modifies file attributes

Detects videocard installed

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-19 19:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-19 19:53

Reported

2024-11-19 19:53

Platform

win7-20240903-en

Max time kernel

2s

Max time network

2s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\Hellion.exe

"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_2524_133765196188016000\Stub.exe

C:\Users\Admin\AppData\Local\Temp\Hellion.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\onefile_2524_133765196188016000\python311.dll

MD5 5a5dd7cad8028097842b0afef45bfbcf
SHA1 e247a2e460687c607253949c52ae2801ff35dc4a
SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512 e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-19 19:53

Reported

2024-11-19 19:56

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\cmd.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4048 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\Hellion.exe C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe
PID 4048 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\Hellion.exe C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe
PID 1620 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1708 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4732 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 4980 wrote to memory of 4952 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4980 wrote to memory of 4952 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4732 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4732 wrote to memory of 892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1708 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1708 wrote to memory of 4540 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1620 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1128 wrote to memory of 1980 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1128 wrote to memory of 1980 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1620 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 216 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 216 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 216 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2604 wrote to memory of 2172 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2604 wrote to memory of 2172 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1620 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1856 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1856 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1856 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1620 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4192 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 4808 wrote to memory of 400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4808 wrote to memory of 400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 4192 wrote to memory of 3444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4192 wrote to memory of 3444 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1620 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 3684 wrote to memory of 3804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3684 wrote to memory of 3804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 3464 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3464 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3804 wrote to memory of 4144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 3804 wrote to memory of 4144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1864 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1864 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1536 wrote to memory of 3580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1536 wrote to memory of 3580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 5012 wrote to memory of 3876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 5012 wrote to memory of 3876 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1620 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Hellion.exe

"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\Stub.exe

C:\Users\Admin\AppData\Local\Temp\Hellion.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
N/A 127.0.0.1:58032 tcp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 discord.com udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
N/A 127.0.0.1:58038 tcp
US 8.8.8.8:53 232.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
N/A 127.0.0.1:58047 tcp
N/A 127.0.0.1:58052 tcp
N/A 127.0.0.1:58055 tcp
N/A 127.0.0.1:58059 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 162.159.135.232:443 discord.com tcp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\python311.dll

MD5 5a5dd7cad8028097842b0afef45bfbcf
SHA1 e247a2e460687c607253949c52ae2801ff35dc4a
SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512 e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\vcruntime140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 bd36f7d64660d120c6fb98c8f536d369
SHA1 6829c9ce6091cb2b085eb3d5469337ac4782f927
SHA256 ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
SHA512 bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

MD5 3859239ced9a45399b967ebce5a6ba23
SHA1 6f8ff3df90ac833c1eb69208db462cda8ca3f8d6
SHA256 a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
SHA512 030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_lzma.pyd

MD5 e5abc3a72996f8fde0bcf709e6577d9d
SHA1 15770bdcd06e171f0b868c803b8cf33a8581edd3
SHA256 1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
SHA512 b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_sqlite3.pyd

MD5 d7b9ed5f37519b68750ecb5defb8e957
SHA1 661cf73707e02d2837f914adc149b61a120dda7d
SHA256 2ce63e16df518ae178de0940505ff1b11da97a5b175fe2a0d355b2ee351c55fd
SHA512 f04708c28feb54f355d977e462245b183a0b50f4db6926c767e8f1499e83e910b05a3023b84d398fb5dd87743fe6146dbbc3e1caaed5351c27396f16746c6d6b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll

MD5 08d50fd2b635972dc84a6fb6fc581c06
SHA1 4bcfc96a1aad74f7ab11596788acb9a8d1126064
SHA256 bb5ac4945b43611c1821fa575af3152b2937b4bc1a77531136780cc4a28f82e9
SHA512 8ec536e97d7265f007ad0f99fc8b9eecc9355a63f131b96e8a04e4bd38d3c72e3b80e36e4b1923548bd77eb417c5e0ac6a01d09af23311784a328fbed3c41084

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_socket.pyd

MD5 1eea9568d6fdef29b9963783827f5867
SHA1 a17760365094966220661ad87e57efe09cd85b84
SHA256 74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
SHA512 d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll

MD5 25bde25d332383d1228b2e66a4cb9f3e
SHA1 cd5b9c3dd6aab470d445e3956708a324e93a9160
SHA256 c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
SHA512 ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_asyncio.pyd

MD5 79f71c92c850b2d0f5e39128a59054f1
SHA1 a773e62fa5df1373f08feaa1fb8fa1b6d5246252
SHA256 0237739399db629fdd94de209f19ac3c8cd74d48bebe40ad8ea6ac7556a51980
SHA512 3fdef4c04e7d89d923182e3e48d4f3d866204e878abcaacff657256f054aeafafdd352b5a55ea3864a090d01169ec67b52c7f944e02247592417d78532cc5171

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\libcrypto-1_1.dll

MD5 e94733523bcd9a1fb6ac47e10a267287
SHA1 94033b405386d04c75ffe6a424b9814b75c608ac
SHA256 f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44
SHA512 07dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_ssl.pyd

MD5 208b0108172e59542260934a2e7cfa85
SHA1 1d7ffb1b1754b97448eb41e686c0c79194d2ab3a
SHA256 5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
SHA512 41abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

MD5 c97a587e19227d03a85e90a04d7937f6
SHA1 463703cf1cac4e2297b442654fc6169b70cfb9bf
SHA256 c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
SHA512 97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_hashlib.pyd

MD5 4255c44dc64f11f32c961bf275aab3a2
SHA1 c1631b2821a7e8a1783ecfe9a14db453be54c30a
SHA256 e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29
SHA512 7d3a306755a123b246f31994cd812e7922943cdbbc9db5a6e4d3372ea434a635ffd3945b5d2046de669e7983ef2845bd007a441d09cfe05cf346523c12bdad52

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\multidict\_multidict.pyd

MD5 b92f8efb672c383ab60b971b3c6c87de
SHA1 acb671089a01d7f1db235719c52e6265da0f708f
SHA256 b7376b5d729115a06b1cab60b251df3efc3051ebba31524ea82f0b8db5a49a72
SHA512 680663d6c6cd7b9d63160c282f6d38724bd8b8144d15f430b28b417dda0222bfff7afefcb671e863d1b4002b154804b1c8af2d8a28fff11fa94972b207df081b

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_overlapped.pyd

MD5 e5aceaf21e82253e300c0b78793887a8
SHA1 c58f78fbbe8713cb00ccdfeb1d8d7359f58ebfde
SHA256 d950342686c959056ff43c9e5127554760fa20669d97166927dd6aae5494e02a
SHA512 517c29928d6623cf3b2bcdcd68551070d2894874893c0d115a0172d749b6fe102af6261c0fd1b65664f742fa96abbce2f8111a72e1a3c2f574b58b909205937f

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\unicodedata.pyd

MD5 aa13ee6770452af73828b55af5cd1a32
SHA1 c01ece61c7623e36a834d8b3c660e7f28c91177e
SHA256 8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb
SHA512 b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\propcache\_helpers_c.pyd

MD5 04444380b89fb22b57e6a72b3ae42048
SHA1 cfe9c662cb5ca1704e3f0763d02e0d59c5817d77
SHA256 d123d7fefde551c82eb61454d763177322e5ce1eaa65dc489e19de5ab7faf7b4
SHA512 9e7d367bab0f6cc880c5870fdcdb06d9a9e5eb24eba489ca85549947879b0fa3c586779ffcea0fca4c50aa67dad098e7bd9e82c00e2d00412d9441991267d2da

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\yarl\_quoting_c.pyd

MD5 1c6c610e5e2547981a2f14f240accf20
SHA1 4a2438293d2f86761ef84cfdf99a6ca86604d0b8
SHA256 4a982ff53e006b462ddf7090749bc06ebb6e97578be04169489d27e93f1d1804
SHA512 f6ea205a49bf586d7f3537d56b805d34584a4c2c7d75a81c53ce457a4a438590f6dbeded324362bfe18b86ff5696673de5fbe4c9759ad121b5e4c9ae2ef267c0

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_helpers.pyd

MD5 add987aec610b3d921decbef60e0de8d
SHA1 2763d5d3acf58bc751323310f1f46abcbc093c82
SHA256 ad5f49d13ddea57319e9d404e8947b5207239d07d94332dfe601331a70a8d5eb
SHA512 d460aea5256de208cc0d13d59d05e809b3f5fd88c34731c776498113da45b6fd732f00cc1c6e02b2f43992cbcd04598e48aee140ca1c1e7ffdd3e8ff18238020

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_parser.pyd

MD5 57abdbfc3f2020177909e20984032dd5
SHA1 b814a1e284bf330f3387afe0f1dc2ccf2b9b8016
SHA256 3a143c933fadd1a1a60a65bdd37858ea11d47a074f9a7934933b13c01b7c3b8b
SHA512 5ca9b1903e8aa7ea244a6807ac8107ad651aa6b16c444d420e9200d689d2a9fa9daac25bf937deb9214cc0dd550e6f9231b4e8551aa0dc38d265a87b7dae582e

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\aiohttp\_http_writer.pyd

MD5 c5036e8b04879173f5e530f7b11c65ba
SHA1 1f17b7551020575943b92058cc493b0c1a35d32c
SHA256 8d12bdd47dbabc836930a663a5149c4f2d2b9ae082f954ee26fe66d501febfe9
SHA512 07588b3e311ed1aebd5be0d96388fe180fed4629fe08ebca4e86802b8af3daed603eabdb5aa427c2e5e80e384c5b3d859b0ac4438bd2a278e949de6ce2fce44b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_websocket.pyd

MD5 ec9e2d8cc7966cacac49da5409bb72f7
SHA1 eb0f500f21b7134ebc833ced27df1450db9ea241
SHA256 23391519e1bf052d4832ada81bca088c2b8bce582f0eb3535109b524a2891e10
SHA512 faa4a03cf4b0e7eb18412594f5199e57624099d4f53789bcd87cf2572f8f94636fadb8e99e3deabba57b2ab91427cdc7e239cf9d137d4ee3b31f6423e166f65b

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_uuid.pyd

MD5 46e9d7b5d9668c9db5caa48782ca71ba
SHA1 6bbc83a542053991b57f431dd377940418848131
SHA256 f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735
SHA512 c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\frozenlist\_frozenlist.pyd

MD5 7f06b8ac7734c5d932108b260d545a6d
SHA1 63a55be8ebd69918805f0188a3dcae83ed494a54
SHA256 173551fdf4514c7995e32652b637c2b08da7b0e0fd4d17392441f48169475d65
SHA512 9df9058460e50cb8943d1071abc93851d21aa0efad84419fd08ca384301f9bf98871e45962d991cd8f04ecf9b0d74398a5f56779a12be49fce0c8feb59ec2e93

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd

MD5 b3cb55561c716c2e87eb7403e133db11
SHA1 acb76d9271ad7de8b7415a645c0c8d1457eb4233
SHA256 f207aaa9b7e757453ed1f128d26c27061b613901654e5a48eacdbfc1dcc348c0
SHA512 9805e4431481a820db921057d7d876ef30b3abb967d702f8ce6c35ab0c916165f6d0f817aafb4eafc0e1c032537ba67283f9414b975cdfe2115f50e9d807844d

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\_cffi_backend.pyd

MD5 fde9a1d6590026a13e81712cd2f23522
SHA1 ca99a48caea0dbaccf4485afd959581f014277ed
SHA256 16eccc4baf6cf4ab72acd53c72a1f2b04d952e07e385e9050a933e78074a7d5b
SHA512 a522661f5c3eeea89a39df8bbb4d23e6428c337aac1d231d32b39005ea8810fce26af18454586e0e94e51ea4ac0e034c88652c1c09b1ed588aeac461766981f4

C:\Users\Admin\AppData\Local\Temp\onefile_4048_133765196188380970\python3.dll

MD5 b711598fc3ed0fe4cf2c7f3e0877979e
SHA1 299c799e5d697834aa2447d8a313588ab5c5e433
SHA256 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a
SHA512 b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd

MD5 f00133f7758627a15f2d98c034cf1657
SHA1 2f5f54eda4634052f5be24c560154af6647eee05
SHA256 35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
SHA512 1c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cno3awim.r31.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2960-158-0x0000011377A00000-0x0000011377A22000-memory.dmp