Malware Analysis Report

2025-03-15 03:46

Sample ID 241120-s4h4dsycmf
Target Hellion.exe
SHA256 53d4b1bdf55b84b9dc09963fbf8c25d2d8164dba5130d136a96c02dc548eb79f
Tags
exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

53d4b1bdf55b84b9dc09963fbf8c25d2d8164dba5130d136a96c02dc548eb79f

Threat Level: Known bad

The file Hellion.exe was found to be: Known bad.

Malicious Activity Summary

exelastealer collection defense_evasion discovery evasion persistence privilege_escalation spyware stealer

Exelastealer family

Exela Stealer

Grants admin privileges

Modifies Windows Firewall

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Clipboard Data

Looks up external IP address via web service

Network Service Discovery

Legitimate hosting services abused for malware hosting/C2

Hide Artifacts: Hidden Files and Directories

Enumerates processes with tasklist

Launches sc.exe

Browser Information Discovery

Unsigned PE

Enumerates physical storage devices

System Network Configuration Discovery: Wi-Fi Discovery

Event Triggered Execution: Netsh Helper DLL

Permission Groups Discovery: Local Groups

System Network Connections Discovery

Gathers network information

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Collects information from the system

Views/modifies file attributes

Gathers system information

Detects videocard installed

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-20 15:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-20 15:40

Reported

2024-11-20 15:57

Platform

win11-20241007-en

Max time kernel

429s

Max time network

464s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"

Signatures

Exela Stealer

stealer exelastealer

Exelastealer family

exelastealer

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A ip-api.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\ARP.EXE N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Permission Groups Discovery: Local Groups

discovery

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

System Network Connections Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3744 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\Hellion.exe C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe
PID 3744 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\Hellion.exe C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe
PID 4472 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 2516 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2516 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4816 wrote to memory of 3876 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4816 wrote to memory of 3876 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4128 wrote to memory of 4576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4128 wrote to memory of 4576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4472 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4580 wrote to memory of 2384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4580 wrote to memory of 2384 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4472 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4224 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4224 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3300 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3300 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4472 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4000 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4000 wrote to memory of 3136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4472 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 3612 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 3880 wrote to memory of 4100 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3880 wrote to memory of 4100 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mshta.exe
PID 3612 wrote to memory of 4740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3612 wrote to memory of 4740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4472 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 1540 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1540 wrote to memory of 2884 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2884 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2884 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 484 wrote to memory of 420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 484 wrote to memory of 420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 1780 wrote to memory of 3940 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1780 wrote to memory of 3940 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2620 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 420 wrote to memory of 2344 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4472 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe
PID 4472 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe C:\Windows\system32\cmd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Hellion.exe

"C:\Users\Admin\AppData\Local\Temp\Hellion.exe"

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\Stub.exe

C:\Users\Admin\AppData\Local\Temp\Hellion.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "gdb --version"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get Manufacturer

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_ComputerSystem get Manufacturer

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe""

C:\Windows\system32\attrib.exe

attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\mshta.exe

mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

cmd.exe /c chcp

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe Get-Clipboard

C:\Windows\system32\chcp.com

chcp

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 162.159.128.233:443 discord.com tcp
N/A 127.0.0.1:49829 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 127.0.0.1:49835 tcp
US 208.95.112.1:80 ip-api.com tcp
N/A 127.0.0.1:49844 tcp
N/A 127.0.0.1:49849 tcp
N/A 127.0.0.1:49852 tcp
N/A 127.0.0.1:49856 tcp
US 162.159.128.233:443 discord.com tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
US 162.159.128.233:443 discord.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
N/A 127.0.0.1:49926 tcp
N/A 127.0.0.1:49929 tcp
US 162.159.128.233:443 discord.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\python311.dll

MD5 5a5dd7cad8028097842b0afef45bfbcf
SHA1 e247a2e460687c607253949c52ae2801ff35dc4a
SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512 e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\VCRUNTIME140.dll

MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

MD5 bd36f7d64660d120c6fb98c8f536d369
SHA1 6829c9ce6091cb2b085eb3d5469337ac4782f927
SHA256 ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
SHA512 bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

MD5 e5abc3a72996f8fde0bcf709e6577d9d
SHA1 15770bdcd06e171f0b868c803b8cf33a8581edd3
SHA256 1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
SHA512 b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd

MD5 d7b9ed5f37519b68750ecb5defb8e957
SHA1 661cf73707e02d2837f914adc149b61a120dda7d
SHA256 2ce63e16df518ae178de0940505ff1b11da97a5b175fe2a0d355b2ee351c55fd
SHA512 f04708c28feb54f355d977e462245b183a0b50f4db6926c767e8f1499e83e910b05a3023b84d398fb5dd87743fe6146dbbc3e1caaed5351c27396f16746c6d6b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll

MD5 08d50fd2b635972dc84a6fb6fc581c06
SHA1 4bcfc96a1aad74f7ab11596788acb9a8d1126064
SHA256 bb5ac4945b43611c1821fa575af3152b2937b4bc1a77531136780cc4a28f82e9
SHA512 8ec536e97d7265f007ad0f99fc8b9eecc9355a63f131b96e8a04e4bd38d3c72e3b80e36e4b1923548bd77eb417c5e0ac6a01d09af23311784a328fbed3c41084

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

MD5 1eea9568d6fdef29b9963783827f5867
SHA1 a17760365094966220661ad87e57efe09cd85b84
SHA256 74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
SHA512 d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\select.pyd

MD5 c97a587e19227d03a85e90a04d7937f6
SHA1 463703cf1cac4e2297b442654fc6169b70cfb9bf
SHA256 c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
SHA512 97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

MD5 208b0108172e59542260934a2e7cfa85
SHA1 1d7ffb1b1754b97448eb41e686c0c79194d2ab3a
SHA256 5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
SHA512 41abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll

MD5 25bde25d332383d1228b2e66a4cb9f3e
SHA1 cd5b9c3dd6aab470d445e3956708a324e93a9160
SHA256 c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
SHA512 ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\_asyncio.pyd

MD5 79f71c92c850b2d0f5e39128a59054f1
SHA1 a773e62fa5df1373f08feaa1fb8fa1b6d5246252
SHA256 0237739399db629fdd94de209f19ac3c8cd74d48bebe40ad8ea6ac7556a51980
SHA512 3fdef4c04e7d89d923182e3e48d4f3d866204e878abcaacff657256f054aeafafdd352b5a55ea3864a090d01169ec67b52c7f944e02247592417d78532cc5171

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\_hashlib.pyd

MD5 4255c44dc64f11f32c961bf275aab3a2
SHA1 c1631b2821a7e8a1783ecfe9a14db453be54c30a
SHA256 e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29
SHA512 7d3a306755a123b246f31994cd812e7922943cdbbc9db5a6e4d3372ea434a635ffd3945b5d2046de669e7983ef2845bd007a441d09cfe05cf346523c12bdad52

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\multidict\_multidict.pyd

MD5 b92f8efb672c383ab60b971b3c6c87de
SHA1 acb671089a01d7f1db235719c52e6265da0f708f
SHA256 b7376b5d729115a06b1cab60b251df3efc3051ebba31524ea82f0b8db5a49a72
SHA512 680663d6c6cd7b9d63160c282f6d38724bd8b8144d15f430b28b417dda0222bfff7afefcb671e863d1b4002b154804b1c8af2d8a28fff11fa94972b207df081b

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\_overlapped.pyd

MD5 e5aceaf21e82253e300c0b78793887a8
SHA1 c58f78fbbe8713cb00ccdfeb1d8d7359f58ebfde
SHA256 d950342686c959056ff43c9e5127554760fa20669d97166927dd6aae5494e02a
SHA512 517c29928d6623cf3b2bcdcd68551070d2894874893c0d115a0172d749b6fe102af6261c0fd1b65664f742fa96abbce2f8111a72e1a3c2f574b58b909205937f

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\libcrypto-1_1.dll

MD5 e94733523bcd9a1fb6ac47e10a267287
SHA1 94033b405386d04c75ffe6a424b9814b75c608ac
SHA256 f20eb4efd8647b5273fdaafceb8ccb2b8ba5329665878e01986cbfc1e6832c44
SHA512 07dd0eb86498497e693da0f9dd08de5b7b09052a2d6754cfbc2aa260e7f56790e6c0a968875f7803cb735609b1e9b9c91a91b84913059c561bffed5ab2cbb29f

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\yarl\_quoting_c.pyd

MD5 1c6c610e5e2547981a2f14f240accf20
SHA1 4a2438293d2f86761ef84cfdf99a6ca86604d0b8
SHA256 4a982ff53e006b462ddf7090749bc06ebb6e97578be04169489d27e93f1d1804
SHA512 f6ea205a49bf586d7f3537d56b805d34584a4c2c7d75a81c53ce457a4a438590f6dbeded324362bfe18b86ff5696673de5fbe4c9759ad121b5e4c9ae2ef267c0

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd

MD5 aa13ee6770452af73828b55af5cd1a32
SHA1 c01ece61c7623e36a834d8b3c660e7f28c91177e
SHA256 8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb
SHA512 b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\propcache\_helpers_c.pyd

MD5 04444380b89fb22b57e6a72b3ae42048
SHA1 cfe9c662cb5ca1704e3f0763d02e0d59c5817d77
SHA256 d123d7fefde551c82eb61454d763177322e5ce1eaa65dc489e19de5ab7faf7b4
SHA512 9e7d367bab0f6cc880c5870fdcdb06d9a9e5eb24eba489ca85549947879b0fa3c586779ffcea0fca4c50aa67dad098e7bd9e82c00e2d00412d9441991267d2da

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\_bz2.pyd

MD5 3859239ced9a45399b967ebce5a6ba23
SHA1 6f8ff3df90ac833c1eb69208db462cda8ca3f8d6
SHA256 a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
SHA512 030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_helpers.pyd

MD5 add987aec610b3d921decbef60e0de8d
SHA1 2763d5d3acf58bc751323310f1f46abcbc093c82
SHA256 ad5f49d13ddea57319e9d404e8947b5207239d07d94332dfe601331a70a8d5eb
SHA512 d460aea5256de208cc0d13d59d05e809b3f5fd88c34731c776498113da45b6fd732f00cc1c6e02b2f43992cbcd04598e48aee140ca1c1e7ffdd3e8ff18238020

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_writer.pyd

MD5 c5036e8b04879173f5e530f7b11c65ba
SHA1 1f17b7551020575943b92058cc493b0c1a35d32c
SHA256 8d12bdd47dbabc836930a663a5149c4f2d2b9ae082f954ee26fe66d501febfe9
SHA512 07588b3e311ed1aebd5be0d96388fe180fed4629fe08ebca4e86802b8af3daed603eabdb5aa427c2e5e80e384c5b3d859b0ac4438bd2a278e949de6ce2fce44b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_parser.pyd

MD5 57abdbfc3f2020177909e20984032dd5
SHA1 b814a1e284bf330f3387afe0f1dc2ccf2b9b8016
SHA256 3a143c933fadd1a1a60a65bdd37858ea11d47a074f9a7934933b13c01b7c3b8b
SHA512 5ca9b1903e8aa7ea244a6807ac8107ad651aa6b16c444d420e9200d689d2a9fa9daac25bf937deb9214cc0dd550e6f9231b4e8551aa0dc38d265a87b7dae582e

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\_uuid.pyd

MD5 46e9d7b5d9668c9db5caa48782ca71ba
SHA1 6bbc83a542053991b57f431dd377940418848131
SHA256 f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735
SHA512 c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\frozenlist\_frozenlist.pyd

MD5 7f06b8ac7734c5d932108b260d545a6d
SHA1 63a55be8ebd69918805f0188a3dcae83ed494a54
SHA256 173551fdf4514c7995e32652b637c2b08da7b0e0fd4d17392441f48169475d65
SHA512 9df9058460e50cb8943d1071abc93851d21aa0efad84419fd08ca384301f9bf98871e45962d991cd8f04ecf9b0d74398a5f56779a12be49fce0c8feb59ec2e93

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\aiohttp\_websocket.pyd

MD5 ec9e2d8cc7966cacac49da5409bb72f7
SHA1 eb0f500f21b7134ebc833ced27df1450db9ea241
SHA256 23391519e1bf052d4832ada81bca088c2b8bce582f0eb3535109b524a2891e10
SHA512 faa4a03cf4b0e7eb18412594f5199e57624099d4f53789bcd87cf2572f8f94636fadb8e99e3deabba57b2ab91427cdc7e239cf9d137d4ee3b31f6423e166f65b

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd

MD5 b3cb55561c716c2e87eb7403e133db11
SHA1 acb76d9271ad7de8b7415a645c0c8d1457eb4233
SHA256 f207aaa9b7e757453ed1f128d26c27061b613901654e5a48eacdbfc1dcc348c0
SHA512 9805e4431481a820db921057d7d876ef30b3abb967d702f8ce6c35ab0c916165f6d0f817aafb4eafc0e1c032537ba67283f9414b975cdfe2115f50e9d807844d

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\python3.dll

MD5 b711598fc3ed0fe4cf2c7f3e0877979e
SHA1 299c799e5d697834aa2447d8a313588ab5c5e433
SHA256 520169aa6cf49d7ee724d1178de1be0e809e4bdcf671e06f3d422a0dd5fd294a
SHA512 b3d59eff5e38cef651c9603971bde77be7231ea8b7bdb444259390a8a9e452e107a0b6cb9cc93e37fd3b40afb2ba9e67217d648bfca52f7cdc4b60c7493b6b84

C:\Users\Admin\AppData\Local\Temp\onefile_3744_133765912727071187\_cffi_backend.pyd

MD5 fde9a1d6590026a13e81712cd2f23522
SHA1 ca99a48caea0dbaccf4485afd959581f014277ed
SHA256 16eccc4baf6cf4ab72acd53c72a1f2b04d952e07e385e9050a933e78074a7d5b
SHA512 a522661f5c3eeea89a39df8bbb4d23e6428c337aac1d231d32b39005ea8810fce26af18454586e0e94e51ea4ac0e034c88652c1c09b1ed588aeac461766981f4

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd

MD5 f00133f7758627a15f2d98c034cf1657
SHA1 2f5f54eda4634052f5be24c560154af6647eee05
SHA256 35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
SHA512 1c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_izuukuks.kvk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2376-157-0x00000227630B0000-0x00000227630D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Desktop\DebugCompress.mp3

MD5 6484aca954aac0eeabbfe84b089f6862
SHA1 023bcd125c981171a55b422678ad12386104979f
SHA256 c05b1d6726b1c986e7b85a2c13f77fb58a7df0fb2498542fa59d8afc25a5f6d9
SHA512 30923d3ba86c24521cf8bddf8f4846c7fca4c0aa6ec4d17af6652ce55ac048135926c07df6c907aa157606266853df278a437d34470cb015e300b8ad29236596

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\CompareResume.docx

MD5 a29563fa66bec9721e55a082b77ab617
SHA1 fd6fe5c27879a91a9697074690558318ee008f7b
SHA256 ef9eb01abc017a4b4862f77008230861602e377709d632ac006219cbff26d7c2
SHA512 b26feb6fe199bd79d0c3245a6a8ef0e524af3b1f244a9e9c6d9f6f521970a1cad8b3ece64078752968e043413753fb896ece4e004aa1a715921fbefed82b0c99

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\EnterSearch.txt

MD5 ed835b7ac49c0cd5aca30e6941409587
SHA1 7aa41bbcffe1586b33b3399e3e6da19df0d75403
SHA256 eca901bd2f2c1951833363003339f7b46e81e647e184f93eab85dadfcc259a63
SHA512 884c4fd1cc9303afbfde6a11a710f93126ccce27c447a127df0fc12450783c3c17504a5e52083a0592ecaa1b549bcdd27fb1c2befd357ceb04520c82fad4c2d9

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\DismountBackup.vdw

MD5 c92b7e5ca1f8f87f3c3e3255bca60275
SHA1 72527c732c45d22edfbd6f16fa88c76511a77122
SHA256 9ac628180268a5961401e1d8773120d0c5469e6779199e8cd40b88cee0e958ea
SHA512 909617d1fc735d22d628db56f2022e2931a8a90493a209825cc302d04e927d12e0bc425809b0c2f6748ebb2f264561a038b6f6a1238c259f0945663f143edb75

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Desktop\ReadUnpublish.docx

MD5 413c20439ac630be4736b249a40d1ef1
SHA1 5cbf2338d45200501d22208e4c7f6868843cc143
SHA256 8bac684cee4d8d77bea3a98ffca9ecdffc1f972c9f48d4994a18ecd2215bbd3f
SHA512 6ddaa9b4c9a54481bf827771d0c1776def500573ff11a92ab8744fb4c69dfe80e37433e21be299028a44789b6d065c47c4165669b6010e9535a407f6505c16d0

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\FindPing.docx

MD5 f1e42f25b9ce292d4e2d5e3948facb02
SHA1 32138af1a7f15d088e6f3c19709eb0bcdc56a8ae
SHA256 4e303879e165cf6f04df2a378c5349ea0f58fbb16cddd423d293095e46e490bf
SHA512 98b434167ac872d0f14a3819cea0da3fb6dc8ecf730aa01325affc3d38bdf6dc9678460f9a72eb9627fb99f323680f4560e7df4a42ee452fe9a4e4234e14d3cc

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\DisableInstall.mp3

MD5 7fcfa20da46c899a18835187eeca216c
SHA1 30d9200d6312c1d1e7e912ea71884e24271d9ca1
SHA256 bcedeed3727e88caa932c259a2b0c1f1598089d5b6baaaa0c3e1b9a45e410966
SHA512 04f6f70c2dbf2e7311bbeeed7974a8fad4f492f456cd9319f3971e5136b4324ea33a103acf08548dcc220118e934dac185855bf0a4f023ac7d3717608a1872e6

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\RestoreResize.png

MD5 36bd1fb4967f26c6b02d6a295f83cfc5
SHA1 d2facd5cd5f6228e9ab797eb9d80357b4142f051
SHA256 3ce364ae0a713a0ba89e75cc3b4765731c549c1cf8950000301ef81224291be1
SHA512 5e7a7c45d8c27a67c779d361f1299a3c68e107cee523b15c23bfea6c57002583afa4fae483cf097f18d76065a260d4156eb579b519e1cf502f1c881f4e202476

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\BackupHide.ADTS

MD5 a3a1a6202a4c054b4b31bd3a680d2c2e
SHA1 baaa66d11122ced9ced12c202bfc7a716fdf90ce
SHA256 375f9747030dc2766229e5abc67f00ea6238d47124ec2c7db6599a66b75c7133
SHA512 424654a1731b2d4e5ed71a9319945f0e6edc924f7bed670c2c761aef3d0eb8e3ad1cb39ac0afa5687c977ae6e94d8e05a96372e0635ddedbb7873c033da4eb65

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\ResetMount.xlsx

MD5 33ff20671baf71f286ece62ffe17a694
SHA1 74232663ccc53b280ed81177ba0d66fbaa17e2ac
SHA256 98cc15d7ca413b2ad862851e897df1f5ef4b502333f49ba8c32dfd139504377f
SHA512 919ab68311dcf11e85e89af70d36047b51d8ce2de1e2c92f0a53bc70e372e94d480de721d23671db75418fb07307c1e6ae8274a0a97122a49641f29fd749e73f

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\ReceivePush.docx

MD5 f2b7596a9c0fc5633684356da01b9c54
SHA1 44fbbc9233d07467ba9f720d9e5723ac10460592
SHA256 78529c6f0a74104149158e802450dd202512a5831d257f82c64df8f8b4de2d74
SHA512 290800a42c60518024fa9377d3ff51db5586bf21da584783a9eeb0aa74d9b5a02d4badc4242683907832449b7a5f6de66619a23ecfb5782635471ffd67159156

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\StopCheckpoint.zip

MD5 190af0aa78a590bb8aeaa3f25b8e2341
SHA1 ce003817d127d9e1b3ee31041258255c55acf40d
SHA256 e47aa274514c9069a140bdb48d3462a00b15056011e9789c70c23e021c0ccd05
SHA512 746a9bbcdf2cba7f12117ecd153b0650c1ec2740ba4a9e88a23359b0019808148920856efe8bc9ebc6edb7237a3fe9691d330dff345e37398aace531478c7cf0

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\DebugApprove.png

MD5 3457670f4dadb5f0e724ba0f2311c426
SHA1 1f417c329b2975eebf3d196454c18f15ce347156
SHA256 999aa7e0f26808ae71fcf3a73c9967d85c63a7aadcb6b4cd490b5526529c6133
SHA512 a0a4987ccc29649b527548db43d43c494f2a24e4987a8ff238cd5a318b2c485d230e071cc8c1d347bc3a0e6572be9de110a4697909bee275d13efd27c9f5460d

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\DismountAdd.jpeg

MD5 2ac2f9243a19512aa52754c79026a927
SHA1 acb05c801c2cdb481863160c34c9787e9acbaf45
SHA256 7624af27c26fe6c134926fa906b368389a0c414ee84faac24a2345ad1f0c0dd8
SHA512 25f3e89f5f7f98e9bbcb4d543ce8bac701bd4e5f058484c5cd47d94040671b22cea774ffae013c9af50391ba5cf87882c090c47895cbbb557d351163213b7453

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\SplitExport.jpeg

MD5 14e931be19ee80f1efa1b41ab672437f
SHA1 181ae754bc4d4d4515ec5529078cf36a24c81c46
SHA256 a17aab7da31443a27289d698c3f889f101e65169d76cf88401fc1331cfed2232
SHA512 1e79a949b71bbec884b13d4654cdcb670c78f984fdeb52d6e29344a62a507ff2107dc251c0907d0ccc84fe658f969fe592287313fae00b8e6f1eae92131564ef

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\My Wallpaper.jpg

MD5 a51464e41d75b2aa2b00ca31ea2ce7eb
SHA1 5b94362ac6a23c5aba706e8bfd11a5d8bab6097d
SHA256 16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f
SHA512 b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\WaitStart.xlsx

MD5 fc9d22418545b0ae949429451fa83086
SHA1 1aad651b66e8eba97344dfd4aeef0dbab88cae81
SHA256 7e653da9cbf6058b7b6b1bc13378ac4ed30e9e4c3e8dc463b224561667a69ed5
SHA512 5b719b2598cb757f9c4892f4a5f522270dda6db9f413475f8d25dd26fb4424bff6175dfff84a9e8fc7ae4ef36bb3c45a472eaec0209d1ad4fe8a207389ecff5f

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\MountCompress.mp3

MD5 c650b3b7b5af83600951c21179bc5c7b
SHA1 f876f995bfde2d4b02442cad3e606273d76234c8
SHA256 733ad13f53bd8e23f2b2f48ff2d5304d1777bedb2e078f4c9c311ac6a2f76d86
SHA512 3c91e51b3ef0240139a6b732f667128e8bfd8b953953b02fcaf2cc3b5e39c459bf4830e238e60d29c67fbc85fdcf7a52c5c2b8bf2a0473203a5ee5deb8499d3a

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\LimitClose.doc

MD5 85e5e82c2189f56e6f4f60fe0219eb2b
SHA1 43aeec94641ae3ff7ae669a8f4daba8a1e4d1e67
SHA256 4023631bfc8e3d43795ff4b026be4bffece5952908cb86474a19a08c224d5177
SHA512 bdaee5db2073bcb0567898cc32f922c55a50fd35c5732c6b924a7d9d55e8c52ef2e81208d47f2e7bedbcd8a93eefcaf7865ceb927e28ed6fc629e12688d307b6

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\ConvertFromSet.jpg

MD5 042d3273375d6421ffd7ecf4c5cb5230
SHA1 f7acfde2ba600dc72a6eea782d1cd1ba3638aa7b
SHA256 fa0a933b8abbf910472a1eadbc2b12f38ec853c5ee8c55cc076da4855e4761d8
SHA512 79f04e50129cdff271c3132f40d89e484bc2dda65d28b8e63cc0eb4f265b8655ea0989414859d27b9fe10f47b53efbf3f1a3bc0a4dfe3cdee3182eed9cb2c267

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\StepUnblock.mp3

MD5 ad988b006dbc94ceb87c4dcf58090689
SHA1 09b6e8b3d6539b661228cf2bda65a4a5cd2282d1
SHA256 9203da04c7e3356cd4aec6b7f1a0397f4817152e0bd78e629107d3ecd45edaf9
SHA512 972ea7419d8c10c9f5c1c72b7edaa2a79ba5099435e4536d3a451d10bdf14ba6954e95afe68628de75700dae086c24cac9de1d20a9bae2f0a6169d7f129e7fe3