exelastealer | 37f387d9d653f5bbb85a74ac4294558b12b4698a5f9925b5e92bbe3af91cd68b

Analysis

max time kernel
150s
max time network
158s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
23/03/2025, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

checker/checker/setup.exe
Size

38.7MB
MD5

649a8a400b04fe09604c899cba87d3bd
SHA1

8904ca358b5e691d621d008da7dc096a60670982
SHA256

fc51275b58e49d509c01a2a8cdb8367494819e5be0b752590361de0a6473a162
SHA512

6c5b4a39a9ea76111ac2086d861bac6b4f9cfda78b84db8bfffc8852d5172b859653e5cf5e1b0d3f06166a4fd9dd302111d7030d2286a6ff577748fc538393af
SSDEEP

786432:1YeImzBvaNZl7XtSscty1JqJGooHvZQaZbRbhC5MnVWyHMOvOT:1YCzBsXEscGJmkHvhZ1b05MnV5bm

Score

10^/10

exelastealer collection defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3004	netsh.exe
2892	netsh.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3832	powershell.exe
2820	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3420	Stub.exe

Loads dropped DLL 32 IoCs

pid	Process
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe
3420	Stub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
64	raw.githubusercontent.com
68	raw.githubusercontent.com
69	raw.githubusercontent.com
70	api.gofile.io
16	discord.com
17	discord.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com
34	discord.com
35	api.gofile.io
36	api.gofile.io
63	discord.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
20	ip-api.com
14	ipinfo.io

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4264	cmd.exe
5048	ARP.EXE

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
4212	tasklist.exe
5316	tasklist.exe
5684	tasklist.exe
5680	tasklist.exe
3348	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3896	cmd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\CbsTemp	TiWorker.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2424	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3652	cmd.exe
1792	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
5904	NETSTAT.EXE

Collects information from the system 1 TTPs 1 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
1728	WMIC.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2408	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5904	NETSTAT.EXE
2188	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5208	systeminfo.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
2408	WMIC.exe
4928	WMIC.exe
4928	WMIC.exe
4928	WMIC.exe
4928	WMIC.exe
2440	WMIC.exe
2440	WMIC.exe
2440	WMIC.exe
2440	WMIC.exe
5836	WMIC.exe
5836	WMIC.exe
5836	WMIC.exe
5836	WMIC.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
1728	WMIC.exe
1728	WMIC.exe
1728	WMIC.exe
1728	WMIC.exe
5628	WMIC.exe
5628	WMIC.exe
5628	WMIC.exe
5628	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
5160	WMIC.exe
5156	WMIC.exe
5156	WMIC.exe
5156	WMIC.exe
5156	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5684	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2408	WMIC.exe
Token: SeSecurityPrivilege	2408	WMIC.exe
Token: SeTakeOwnershipPrivilege	2408	WMIC.exe
Token: SeLoadDriverPrivilege	2408	WMIC.exe
Token: SeSystemProfilePrivilege	2408	WMIC.exe
Token: SeSystemtimePrivilege	2408	WMIC.exe
Token: SeProfSingleProcessPrivilege	2408	WMIC.exe
Token: SeIncBasePriorityPrivilege	2408	WMIC.exe
Token: SeCreatePagefilePrivilege	2408	WMIC.exe
Token: SeBackupPrivilege	2408	WMIC.exe
Token: SeRestorePrivilege	2408	WMIC.exe
Token: SeShutdownPrivilege	2408	WMIC.exe
Token: SeDebugPrivilege	2408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2408	WMIC.exe
Token: SeRemoteShutdownPrivilege	2408	WMIC.exe
Token: SeUndockPrivilege	2408	WMIC.exe
Token: SeManageVolumePrivilege	2408	WMIC.exe
Token: 33	2408	WMIC.exe
Token: 34	2408	WMIC.exe
Token: 35	2408	WMIC.exe
Token: 36	2408	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4928	WMIC.exe
Token: SeSecurityPrivilege	4928	WMIC.exe
Token: SeTakeOwnershipPrivilege	4928	WMIC.exe
Token: SeLoadDriverPrivilege	4928	WMIC.exe
Token: SeSystemProfilePrivilege	4928	WMIC.exe
Token: SeSystemtimePrivilege	4928	WMIC.exe
Token: SeProfSingleProcessPrivilege	4928	WMIC.exe
Token: SeIncBasePriorityPrivilege	4928	WMIC.exe
Token: SeCreatePagefilePrivilege	4928	WMIC.exe
Token: SeBackupPrivilege	4928	WMIC.exe
Token: SeRestorePrivilege	4928	WMIC.exe
Token: SeShutdownPrivilege	4928	WMIC.exe
Token: SeDebugPrivilege	4928	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4928	WMIC.exe
Token: SeRemoteShutdownPrivilege	4928	WMIC.exe
Token: SeUndockPrivilege	4928	WMIC.exe
Token: SeManageVolumePrivilege	4928	WMIC.exe
Token: 33	4928	WMIC.exe
Token: 34	4928	WMIC.exe
Token: 35	4928	WMIC.exe
Token: 36	4928	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2408	WMIC.exe
Token: SeSecurityPrivilege	2408	WMIC.exe
Token: SeTakeOwnershipPrivilege	2408	WMIC.exe
Token: SeLoadDriverPrivilege	2408	WMIC.exe
Token: SeSystemProfilePrivilege	2408	WMIC.exe
Token: SeSystemtimePrivilege	2408	WMIC.exe
Token: SeProfSingleProcessPrivilege	2408	WMIC.exe
Token: SeIncBasePriorityPrivilege	2408	WMIC.exe
Token: SeCreatePagefilePrivilege	2408	WMIC.exe
Token: SeBackupPrivilege	2408	WMIC.exe
Token: SeRestorePrivilege	2408	WMIC.exe
Token: SeShutdownPrivilege	2408	WMIC.exe
Token: SeDebugPrivilege	2408	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2408	WMIC.exe
Token: SeRemoteShutdownPrivilege	2408	WMIC.exe
Token: SeUndockPrivilege	2408	WMIC.exe
Token: SeManageVolumePrivilege	2408	WMIC.exe
Token: 33	2408	WMIC.exe
Token: 34	2408	WMIC.exe
Token: 35	2408	WMIC.exe
Token: 36	2408	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 3420	5344	setup.exe	82
PID 5344 wrote to memory of 3420	5344	setup.exe	82
PID 3420 wrote to memory of 5880	3420	Stub.exe	83
PID 3420 wrote to memory of 5880	3420	Stub.exe	83
PID 3420 wrote to memory of 4864	3420	Stub.exe	89
PID 3420 wrote to memory of 4864	3420	Stub.exe	89
PID 3420 wrote to memory of 5992	3420	Stub.exe	90
PID 3420 wrote to memory of 5992	3420	Stub.exe	90
PID 3420 wrote to memory of 4868	3420	Stub.exe	92
PID 3420 wrote to memory of 4868	3420	Stub.exe	92
PID 3420 wrote to memory of 4976	3420	Stub.exe	93
PID 3420 wrote to memory of 4976	3420	Stub.exe	93
PID 4864 wrote to memory of 2408	4864	cmd.exe	97
PID 4864 wrote to memory of 2408	4864	cmd.exe	97
PID 4976 wrote to memory of 5684	4976	cmd.exe	98
PID 4976 wrote to memory of 5684	4976	cmd.exe	98
PID 5992 wrote to memory of 4928	5992	cmd.exe	99
PID 5992 wrote to memory of 4928	5992	cmd.exe	99
PID 3420 wrote to memory of 3688	3420	Stub.exe	100
PID 3420 wrote to memory of 3688	3420	Stub.exe	100
PID 3688 wrote to memory of 2440	3688	cmd.exe	102
PID 3688 wrote to memory of 2440	3688	cmd.exe	102
PID 3420 wrote to memory of 5668	3420	Stub.exe	103
PID 3420 wrote to memory of 5668	3420	Stub.exe	103
PID 3420 wrote to memory of 4792	3420	Stub.exe	104
PID 3420 wrote to memory of 4792	3420	Stub.exe	104
PID 5668 wrote to memory of 5836	5668	cmd.exe	107
PID 5668 wrote to memory of 5836	5668	cmd.exe	107
PID 4792 wrote to memory of 5680	4792	cmd.exe	108
PID 4792 wrote to memory of 5680	4792	cmd.exe	108
PID 3420 wrote to memory of 3896	3420	Stub.exe	109
PID 3420 wrote to memory of 3896	3420	Stub.exe	109
PID 3896 wrote to memory of 3308	3896	cmd.exe	111
PID 3896 wrote to memory of 3308	3896	cmd.exe	111
PID 3420 wrote to memory of 3968	3420	Stub.exe	112
PID 3420 wrote to memory of 3968	3420	Stub.exe	112
PID 3420 wrote to memory of 4152	3420	Stub.exe	113
PID 3420 wrote to memory of 4152	3420	Stub.exe	113
PID 4152 wrote to memory of 3348	4152	cmd.exe	116
PID 4152 wrote to memory of 3348	4152	cmd.exe	116
PID 3968 wrote to memory of 4292	3968	cmd.exe	117
PID 3968 wrote to memory of 4292	3968	cmd.exe	117
PID 3420 wrote to memory of 5696	3420	Stub.exe	118
PID 3420 wrote to memory of 5696	3420	Stub.exe	118
PID 3420 wrote to memory of 1672	3420	Stub.exe	119
PID 3420 wrote to memory of 1672	3420	Stub.exe	119
PID 3420 wrote to memory of 4564	3420	Stub.exe	120
PID 3420 wrote to memory of 4564	3420	Stub.exe	120
PID 3420 wrote to memory of 2820	3420	Stub.exe	121
PID 3420 wrote to memory of 2820	3420	Stub.exe	121
PID 2820 wrote to memory of 3832	2820	cmd.exe	126
PID 2820 wrote to memory of 3832	2820	cmd.exe	126
PID 4564 wrote to memory of 4212	4564	cmd.exe	127
PID 4564 wrote to memory of 4212	4564	cmd.exe	127
PID 5696 wrote to memory of 1084	5696	cmd.exe	128
PID 5696 wrote to memory of 1084	5696	cmd.exe	128
PID 1084 wrote to memory of 1984	1084	cmd.exe	129
PID 1084 wrote to memory of 1984	1084	cmd.exe	129
PID 1672 wrote to memory of 1944	1672	cmd.exe	130
PID 1672 wrote to memory of 1944	1672	cmd.exe	130
PID 1944 wrote to memory of 2084	1944	cmd.exe	131
PID 1944 wrote to memory of 2084	1944	cmd.exe	131
PID 3420 wrote to memory of 3652	3420	Stub.exe	132
PID 3420 wrote to memory of 3652	3420	Stub.exe	132

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3308	attrib.exe

C:\Users\Admin\AppData\Local\Temp\checker\checker\setup.exe
"C:\Users\Admin\AppData\Local\Temp\checker\checker\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\Stub.exe
  C:\Users\Admin\AppData\Local\Temp\checker\checker\setup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:4868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\HellionUpdate\Hellion.exe"
      4⤵
      Views/modifies file attributes
      PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:2084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3652
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4264
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5208
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:2396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious behavior: EnumeratesProcesses
      PID:1728
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:652
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:5624
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:1604
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:5840
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:5588
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:5128
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:1204
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1912
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:1664
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:5432
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:5396
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:5364
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5628
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5316
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2188
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:4428
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:5048
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:5904
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:2424
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3004
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:1368
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5156

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HellionFILES\Desktop\CheckpointUse.docx

Filesize
13KB

MD5
611253e98775048be4a4ce29536566f0

SHA1
273c7e1c4d12f5950cc33c8e0907c2bf2f2741ef

SHA256
d7d1809b372eee29855da5d3b80ce1adf9f366787a60bdf9401b87420c31785c

SHA512
1bb93154a788cff751f1aa8638a653d57c61c07b2a7d9c4dc8b259d3c2149b581c38ed8febebc223c3115626bd96b99806105d52ba7f299bb0c5907d551d63a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Desktop\ExportNew.xlsx

Filesize
15KB

MD5
30ea70177cc2eb4179ce401014b4d5d4

SHA1
030dc98301b8e7039cc9cf1e95b742442b02f7fd

SHA256
4d9cdb91322acaf722b05402fab48a8ec85b59e7c85492feb6de32853f6aa182

SHA512
b2d5d4977e4eb41e9c76b3f9824aafc88731a57cdf1b41be2e549e8ea2d83e03e2a083dd9d6088d8d578ca4c123845f0ee21ff9a4119d9268050e5902e5d7fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Desktop\InvokeConnect.txt

Filesize
158KB

MD5
3e4d74fcab75344b052d4fb6698e708c

SHA1
7c3549c1b0e4d13bba132ff7a20c4cf6399e8a57

SHA256
efc58ff87398c802beb80afdb437c8c1f1e3d547438f907f01d72d9fb5424703

SHA512
53916f2f1e31163294d5d0ee079c2d27890dd9a0346d15a1151a0702375ec55ef9601abcbb8bc94f149874c39afd9df06956f83478b7c7467758ba0a02c95acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Desktop\StartRead.zip

Filesize
190KB

MD5
2e08282bbc7ca644220c40a949c52ed4

SHA1
99e4cce8650afbb3e484cc71e3ae617d1138e61a

SHA256
4f284b9fb08943140b569c58b76e59fa84d7b355d8af90ebb9327a778de8b2c1

SHA512
9649fc5e45a75a5668baa535e5438afbcd18d715c9c360f80113cf93beae53647b255cb8ab2652d44323da5799fd8781b584321325c77fbac7c5bbe8ac19e71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Desktop\SwitchGet.jpeg

Filesize
243KB

MD5
2af8934b18b531f741840f8c0ec09855

SHA1
9328f4569da038efdd5e76eed6ad337384eb5667

SHA256
5a1bc6c4b1bd20f87d0bc03e8a7c58e98c061b6b015b2fcd1d82d0657a751772

SHA512
f57166fa085da69bc2b5d47333bff6b0c87ebfe1dc34a8a44050af69c060edb396a90fdbe171f92ebdea7b72ef2014000a59c40f15bd377ec4c3b01c61d4d4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\CompleteLimit.xlsx

Filesize
393KB

MD5
d8813136bb5bfa2c900eee4fa2682e89

SHA1
a380a9cf5ba7c82eb41247cca237af924c030b44

SHA256
74d63b01a8b26c52b748ef706fe189864e711eaeb7592c6ca93eda029849e138

SHA512
beaf9e98068c1a7eeaa3debf143aa049e108aecd31f9d3eb9e03773cd7d315c7be3274a8230513a9e9354a07ec78df421b955b5294aa75e2b3758510d14cee15

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\FormatSend.xls

Filesize
575KB

MD5
735dc4cb203b49e086bce3cd0473b3a9

SHA1
287d8075770abd46e2781bf2a1b96f0f93cbffd0

SHA256
4a46fa95c759c3d63962c258a7141b1540bea2aed335fd0357f68ab0c1fa1bd6

SHA512
68596fffe692f7faa04de7f86db8f1ac09d8140a69491b9059ece59d121953b4fc5a22352cb45aaafea4bb5e1ae6105d8391ea60f87caa71f72e39a29dfd69e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\GetStop.docx

Filesize
757KB

MD5
da7d29c03c6b97a60b09970727209c62

SHA1
eb262d0dda1dd980386b3c653e770cbabb96676e

SHA256
bcf3c501b63a46812840c09cece1bc20bc60534da4264ad4ab77cc39e67c42a3

SHA512
0d99ae1b4db553fe797a04cb8603147de2957c95c3fa0dfc5012d378a9b62bbf15e80cb4cf3cd179e78e7ad8f946a26daacb19e8b36f32495c5f1206b4a2c1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\RepairDisable.xlsx

Filesize
10KB

MD5
402ab67215914dbc8b0fe991471d1224

SHA1
24f7bd18fda7f8422da96399c724fd7d94a6f60f

SHA256
b3a54f4ec71cf0906c8cd0241be400d9b2abd633cc6b085a37c474d871b0a077

SHA512
f29ee2db7e764d61fdf65be9b0338bbd2396ce29004ffe4c0a75dbcdc907d20ed0fca83971170064f85f7dba8d3023c7ea3eba663e39ef0cc83e0acd9f87eae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\RepairGrant.xlsx

Filesize
777KB

MD5
9937740402b846108975e31229c246e0

SHA1
812bcf320b09e6cd6fe140ac3781f7068351cfbd

SHA256
74705c7bc6d5e867915ce984186dff99fcb2ef7ec259fe27252173ef88c886e6

SHA512
7ad992b0f8b9cf215496c40aa1faad105c8ce15110155ac08fee91d06684e159235469cce7a5928775cd3678f7f26a157632610760c92477e64632e008cf787e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Documents\TestUnprotect.txt

Filesize
555KB

MD5
130d839b36236752cbc50cbc0b4b0a06

SHA1
327b37cfcf32219c820f9d0fc56f8fd255f9cb34

SHA256
f4d3c76c733ebb379883e551075bcd0bd848d7bc680961379d0a2f54f3ec1655

SHA512
fd4d44ad6ffbc1a463bfda6aefdb88a8e3553d00d1d7ea076e5f0481d7599a141654da9d4969f714b6425e230de3a3cc35deba98c0461e9d5ccf3026ce966ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\ExitRemove.xls

Filesize
338KB

MD5
edd5e3c4b433d769dd37cf0e26094946

SHA1
72da988a3f00fd40912453a605c9d1750fa93c28

SHA256
8fb5fef03a802dd4b0941e1aaf70d9fcaea3931fc07018e9763732cceb821934

SHA512
c7c55a82d8752fb14a09868c8b478bc4ec06137930089d29f04beb3fb0a2e26885e313e09c32c03166aef6155c7d527e0024c8130ba5b72dd2231637b505d793

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\ExportImport.jpg

Filesize
494KB

MD5
37073a2eb99a4217b6f637a43658df31

SHA1
ac0ee0c13afb5308d53560d47e1d144ffe335113

SHA256
7d12ad7f9b4ea149e33e314e41b15983b24debfb4e7da7c0a1619e1c42026b72

SHA512
66d2d190fca79ed7dd4d42b2bbcf301938c7ece4395f5c2c253e28f2b6b73d1986499fd303bca967cca15db609769fb3b4ffa00c44817e7da2ed9b30cf4e4f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\ProtectShow.jpeg

Filesize
208KB

MD5
b706703eb861d975a32723960c06ee4b

SHA1
a4cfbcee7ac8d3fb19e6a5950f54ff5d67d257fe

SHA256
c5e4bf0d86980b5a6bb5f66204af334e1bdcc0adda406b681264cc35fd44ebdc

SHA512
e1e9af208144ade06d84c7f8ac884a87fa430257c1ed12e610513b7b1587e56f64f1e3e2b8709ecfe1bd50a05e1a6b83c497ac4b081eaa2960adff17074e1474

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Downloads\UninstallExpand.txt

Filesize
221KB

MD5
40a90d36dda4b8290511f2617b2102ef

SHA1
1231ce5e67acb2b12548c0f8481052138ac680e0

SHA256
5494ac5f1b0d5474837022328f580e1060356f13db586aad2ab86ec490ecb36d

SHA512
46d39e077f97a373635f0175a1f5930375c85df209fc5edd75a0431e69dae1e25fc4a5567eb0d1b445a8414a6ea3d63d1c025fc727a5cad3c4c9e0393df15dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\CompressDebug.txt

Filesize
691KB

MD5
51a691f549ba08cca83cc9e91357bae3

SHA1
25de14bb945684bfe759f6987330c8b09d2c362d

SHA256
903aeaa32c7965b3dc1e6131e4c2395180bf06f492cfdcef60016ed18e359f30

SHA512
61b4a44287eeb87fcb0da7e16d293d21fd814e77aa0a4a938ffe3be48a2b887ab925d45009036b95d1d5233e4897ed215177139004ade29d3e970a4f198c507c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\ConnectGet.mp4

Filesize
424KB

MD5
bbbf12593822832f92d10800adc8dedf

SHA1
1b4836a85db46a1d5baf1dec6a63ae7f4a29b3ea

SHA256
b84a994c453c6ea55d0bcd5d5984550a7715e5ddf047d34378836bccf21050b5

SHA512
64aa47e7490048c00fefe1d6fa1d34534e78da7addb045ae19ef54bf536ed8c3b571db1badd5e33da606322e19e91a5d5a473b269deec109a60e20a31947e124

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\GetMerge.docx

Filesize
405KB

MD5
f598dad5088c774c51b1ed35e9baaf8e

SHA1
811b7819af5ea1d47f33992c2fb57b689d091213

SHA256
7bf7721c4408fc9a74071f64a1c08c22b71ac8e9197db92fb166116121d05c7a

SHA512
e575ce5ce45caa57f6dc35de73bf8377f09ac7befc81e97b9c20d6add39f9487a766baa5cf93e7ce163cc0e4ab24d5e664b895984b8050b91d7911b68cff6287

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\GetRemove.jpg

Filesize
377KB

MD5
2a550931c273fbd9d8077e5a6a67f71e

SHA1
57a6e0fda88336dba724b01398f7c0c4730eaeed

SHA256
7f8b62cef4c91a8690a94b0da4a1474e9d52b0fb55ca78248e6d52bf73a18d96

SHA512
24062f3bfe4be07a212d85af90422ed2539b0829f35a4c4a7ca339dec24322d1b39dc5cf9f94977c68e21f9743771b309acdd1bf34e9232f3c60757ba9d91e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\GrantEdit.mp4

Filesize
368KB

MD5
daaeeb3a650a7d389efd782eaa15abdc

SHA1
f1ea156d90565e8b4dc4520e6268362856261e52

SHA256
65ee2fc858a16bba852924f9b52a8053567dc2271615c004687b612bf4fb67e8

SHA512
84aa7b56eb4b85e094708a86e6d8139c9ccc5b9329bf1a51afac1071ebbb4cec76a2edba3cfc3ea94faa553a3b4bd1ca6356f539013c96990dbf6e5bbd27a44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\TraceUnpublish.mp3

Filesize
248KB

MD5
53feb2c7223bd8fef863b7921e9c543d

SHA1
b0faa43f17c81df15c64bef03e72f54e9ce4bc7a

SHA256
f5c31ecee6140f162f2d964653e95a0a57e773c6498096bd48755e40228ddc12

SHA512
f8344b9410c76383160ea880f0e6234d47d8a29d163c9278d8719bddbd55939291f70aae89f21e0174e77ee7b67d702460b7db3a539ee3a3897adf457ede3271

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Music\UnregisterRegister.zip

Filesize
507KB

MD5
bad4865c7c5ba297cd3e3adf6b5953dd

SHA1
563068f0bbf82b9af4c0c73d14b52eddfe9e435e

SHA256
2a9c5387735d1d8fc56d3953dc4ebe6d7003262576136dcb61a341e9b591593f

SHA512
12f49edd94123b55ca6880ec817a30356203981767ba04a8f4a159e31777b87cefdfc14b4bcb2207b8b24e11fae1739c714496506aef32ff0b7c38c66d2e529c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\BackupTest.pcx

Filesize
381KB

MD5
d006cba4431ecb8251488dcb1b39a756

SHA1
a443fe119e4e0fac71496c2d23ba31d84af91d65

SHA256
7bd472d675cc818b29f7a8848cd304284c0a4ba027881e44a16553d2bb4007da

SHA512
7af74fe582de594b8ba99f72db51a145a8d988d0a62027ded6db0beec0a7a984654852351876d29816a58c94c1ac959dc162812cc022c5ed74cbb22f879e7d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\ExitRemove.jpeg

Filesize
487KB

MD5
898b58be0368e88a2e55de915bbfacee

SHA1
13b20ad7d3eb5a20d231518d9080ccba2b2b42b3

SHA256
76a509c411ca95e549fd287fdb90afab079f9bd4328035ff6562db223ddb9e55

SHA512
50e4d3110b1be40b10490a20defb479a69958279c555e7f1f3440add50068e9b41ccec5b14879df08e9f26a18ff316483506999023d31c21906ac72e0c9d3c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\FindSubmit.png

Filesize
360KB

MD5
6f59c02a7c0740d8add172a458e8e097

SHA1
ef2c7148ed27354e81cabf924ab32346769960f5

SHA256
b48ed5b10c24c4756a69171e6683e3e13ab8f709a48b3c5f6baa3b0d33381855

SHA512
f32cfa4f50c2fa59c2fc42e6e7af513154804d5b63abc3dcb29c0299ac3e13eb96e20266da40a44b51f1280654e5728182ba06e5ad1a1752ec537d452a6abe0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\HellionFILES\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_cffi_backend.pyd

Filesize
174KB

MD5
2baaa98b744915339ae6c016b17c3763

SHA1
483c11673b73698f20ca2ff0748628c789b4dc68

SHA256
4f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c

SHA512
2ae8df6e764c0813a4c9f7ac5a08e045b44daac551e8ff5f8aa83286be96aa0714d373b8d58e6d3aa4b821786a919505b74f118013d9fcd1ebc5a9e4876c2b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd

Filesize
120KB

MD5
462fd515ca586048459b9d90a660cb93

SHA1
06089f5d5e2a6411a0d7b106d24d5203eb70ec60

SHA256
bf017767ac650420487ca3225b3077445d24260bf1a33e75f7361b0c6d3e96b4

SHA512
67851bdbf9ba007012b89c89b86fd430fce24790466fefbb54431a7c200884fc9eb2f90c36d57acd300018f607630248f1a3addc2aa5f212458eb7a5c27054b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd

Filesize
63KB

MD5
7a74284813386818ada7bf55c8d8acf9

SHA1
380c4184eec7ca266e4c2b96bb92a504dfd8fe5f

SHA256
21a1819013de423bb3b9b682d0b3506c6ef57ee88c61edf4ba12d8d5f589c9c2

SHA512
f8bc4ac57ada754006bbbb0bfa1ccb6c659f9c4d3270970e26219005e872b60afb9242457d8eb3eae0ce1f608f730da3bf16715f04b47bea4c95519dd9994a46

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_overlapped.pyd

Filesize
48KB

MD5
a5bd529290006ef1ebc8d32ffe501ca5

SHA1
c59ef2157358fb8f79b5a37ee9abba802ae915ba

SHA256
eeaa26addf211b37e689d46cfac6b7fad0d5421adc4c0113872dac1347aff130

SHA512
6b026e62b0b37445a480599175161cf6a60284ef881e0f0d1da643ac80013c2005f790f099733d76cfcf855e2ecd3a0e6c8bfc19dbabff67869119676ee03b73

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

Filesize
77KB

MD5
c389430e19f1cd4c2e7b8538e8c52459

SHA1
546ed5a85ad80a7b7db99f80c7080dc972e4f2a2

SHA256
a14efa68d8f7ec018fb867a6ba6c6c290a803b4001fd8c45db7bda66fb700067

SHA512
5bef6c90c65bf1d4be0ce0d0cb3f38fe288f5716c93e444cf12f89f066791850d8316d414f1d795ff148c9e841cda90ef9c35ceb4a499563f28d068a6b427671

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_parser.pyd

Filesize
258KB

MD5
43f3c5b856d5cafde6af3908522dc86a

SHA1
ab79574afe39598b48cad0becb8d8dbe4676c890

SHA256
63cc216fb73fc2e263d2838e2d69ed0708d04de2e61f3a946f9956feb6294dd1

SHA512
850ef61c141b3e29cb4921853ecd90f51b6bed54e30e1281e4537df0aec352a4183c7c08207c7875332e5a6a04d0000fa06789a859fbbdf29b75ea83f630553d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_websocket\reader_c.pyd

Filesize
161KB

MD5
281158e40d2822ec4264fbe8fbfb9141

SHA1
c668b7397999f425413055eb2d447436799fcfbc

SHA256
fb8827e4c04ebb481b1d041a2c745dbcbbba2df25438f852f2d40a04bdfd1a1f

SHA512
d87e8b24c59fdfc1d1d2836d13c442a29203c3ec08f3565cdaed7dd5955ef8c2de32eab5cfb0c8bc467c53cef6459941a2209ebaffb5a6d765a964f045056d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd

Filesize
7.9MB

MD5
3df4a08ed8267c581aa21b1ca5063252

SHA1
6342f76dd0bb939d5cc7ac58e3204bfee407188d

SHA256
f7aba2d452a7a11c8b5e1211acfcd15c137fe41488098f665352ef86955aac28

SHA512
c34f0faba9e3a29839fbb85d80ab3700ac945d23333df824bfbcd96fd54e5c74872ae37460584d3500bc292f5efd696d1cc1e0a29a197c814179879d62df23a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll

Filesize
1.5MB

MD5
fcc7a468d46c90f5a71e3e9c99b1d50e

SHA1
91070cac3cdde28905a7bc695f8c0fd1290fd0d0

SHA256
215c02ac57378e48428d4b013f7bcedd2b58d73e83c54eca17a8c9bd7f3bdf55

SHA512
95bff194696436e590a5df8f18987ce6e5c20b6e50e552e7d049fec8da834c71cdbd87418fc85be73aaea4176aeb672d44e89256cd64bfade5959f3aabb0884d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfy5ud2r.odj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\VCRUNTIME140.dll

Filesize
95KB

MD5
f34eb034aa4a9735218686590cba2e8b

SHA1
2bc20acdcb201676b77a66fa7ec6b53fa2644713

SHA256
9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

SHA512
d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\_asyncio.pyd

Filesize
63KB

MD5
686262283ba69cce7f3eaba7cdeb0372

SHA1
5b771e444ee97b246545affcdc8fa910c8f591ea

SHA256
02ec5cd22543c0ca298c598b7e13949a4e8247cec288d0bca0a1269059b548ef

SHA512
dca7403cfe2bfe14cf51f747a893f49db52d4d43691dbccecaa83796351b6f7e644cf8e455a0b9c38c6c006f481d5c45d32ae789756250a2b29978e9feb839d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\_bz2.pyd

Filesize
81KB

MD5
56203038756826a0a683d5750ee04093

SHA1
93d5a07f49bdcc7eb8fba458b2428fe4afcc20d2

SHA256
31c2f21adf27ca77fa746c0fda9c7d7734587ab123b95f2310725aaf4bf4ff3c

SHA512
3da5ae98511300694c9e91617c152805761d3de567981b5ab3ef7cd3dbba3521aae0d49b1eb42123d241b5ed13e8637d5c5bc1b44b9eaa754657f30662159f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\_lzma.pyd

Filesize
154KB

MD5
14ea9d8ba0c2379fb1a9f6f3e9bbd63b

SHA1
f7d4e7b86acaf796679d173e18f758c1e338de82

SHA256
c414a5a418c41a7a8316687047ed816cad576741bd09a268928e381a03e1eb39

SHA512
64a52fe41007a1cac4afedf2961727b823d7f1c4399d3465d22377b5a4a5935cee2598447aeff62f99c4e98bb3657cfae25b5c27de32107a3a829df5a25ba1ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\_queue.pyd

Filesize
30KB

MD5
60dec90862b996e56aedafb2774c3475

SHA1
ce6ff24b2cc03aff2e825e1cf953cba10c139c9d

SHA256
9568ef8bae36edae7347b6573407c312ce3b19bbd899713551a1819d6632da46

SHA512
c4b2066975f5d204a7659a2c7c6bc6dfc9a2fc83d7614dbbc0396f3dcc8b142df9a803f001768bfd44ca6bfa61622836b20a9d68871954009435449ae6d76720

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\_sqlite3.pyd

Filesize
96KB

MD5
98228631212a443781d0ac72e4656b97

SHA1
7e87e1fb891439cf466648b37abdbd4053a5da66

SHA256
fab3440d88376c9c334333b80b50f20a273a08f1d319bf0a9a6eb8bd04d35250

SHA512
5d41384b0280415f581c13b4b47de3de845fd60fc0373613dc9a73d4e0ecf9e855cb0e4aaa1c88fdc2d98e973ca083a48c129529141a8fd65c74c104ad9015f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\_ssl.pyd

Filesize
156KB

MD5
7c7223f28c0c27c85a979ad222d19288

SHA1
4185e671b1dc56b22134c97cd8a4a67747887b87

SHA256
4ec47beadc4fd0d38fa39092244c108674012874f3190ee0e484aa988b94f986

SHA512
f3e813b954357f1bc323d897edf308a99ed30ff451053b312f81b6baae188cda58d144072627398a19d8d12fe659e4f40636dbbdf22a45770c3ca71746ec2df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\_uuid.pyd

Filesize
24KB

MD5
ecf3d9de103ba77730ed021fe69a2804

SHA1
ce7eae927712fda0c70267f7db6bcb8406d83815

SHA256
7cf37a10023ebf6705963822a46f238395b1fbe8cb898899b3645c92d61b48ea

SHA512
c2bf0e2ba6080e03eca22d74ea7022fb9581036ce46055ea244773d26d8e5b07caf6ed2c44c479fda317000a9fa08ca6913c23fa4f54b08ee6d3427b9603dfba

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\aiohttp\_http_writer.pyd

Filesize
46KB

MD5
cf98d8b77a22708a99ac3848f35a210b

SHA1
9dd719a0d9fe9e7b4fde8a247bc1709691fb15c6

SHA256
a4ff6573750a4f68f3ca221bfabc7756a10bed394606f73489d612cdcc6f670f

SHA512
67245c460289ec15b0230a921548dda64c01814088f8e1bc9b1edb4878f77bfa577fd8b42e86545caee853cc7380e6be5f7ce70b245b923039f84cc028c91a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\aiohttp\_websocket\mask.pyd

Filesize
35KB

MD5
e2f273c2a1e066bc0531724271519724

SHA1
47cddfc0f1b57e180a5fc8ea082f44fad486c067

SHA256
59385161f55b1516410be560b2ee8737d45a7b3ba2c0a4c984555c238a7f963f

SHA512
681b327dde2bbc5bf4329b4b5354fadef2c107f36b8c9ad8233ac339c620acbdcd6b447d6f63f0616df7088672dbad098297fe81f00044a16f39e6b2030d2718

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\frozenlist\_frozenlist.pyd

Filesize
84KB

MD5
911470750962640ceb3fd11e2aeecd14

SHA1
af797451d4028841d92f771885cb9d81afba3f96

SHA256
5c204f6966526af4dc0c0d6d29909b6f088c4fa781464f2948414d833b03094d

SHA512
637043c20dc17fbc472613c0e4f576f0a2211b7916b3488806aec30271cf1bd84bd790518335b88910662fd4844f8ed39fa75aa278577271a966756b8cd793f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\libcrypto-1_1.dll

Filesize
3.3MB

MD5
80b72c24c74d59ae32ba2b0ea5e7dad2

SHA1
75f892e361619e51578b312605201571bfb67ff8

SHA256
eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d

SHA512
08014ee480b5646362c433b82393160edf9602e4654e12cd9b6d3c24e98c56b46add9bf447c2301a2b2e782f49c444cb8e37ee544f38330c944c87397bdd152a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\libssl-1_1.dll

Filesize
686KB

MD5
86f2d9cc8cc54bbb005b15cabf715e5d

SHA1
396833cba6802cb83367f6313c6e3c67521c51ad

SHA256
d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771

SHA512
0013d487173b42e669a13752dc8a85b838c93524f976864d16ec0d9d7070d981d129577eda497d4fcf66fc6087366bd320cff92ead92ab79cfcaa946489ac6cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\multidict\_multidict.pyd

Filesize
46KB

MD5
95463f615865a472f75ddb365644a571

SHA1
91f22ef3f2ffd3e9d6ce6e58beea9a96287b090b

SHA256
9ee77474d244a17337d4ccc5113fe4af7b4d86f9969293a884927718d06e63c8

SHA512
e3cccce9ebf5e7cf33e68046d3e7b59e454ccb791635eb5f405977fd270126ef8b58e6288dbe58c96b681361d81ef28720eba8d0bd389bfb0f4c3114d098a117

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\propcache\_helpers_c.pyd

Filesize
71KB

MD5
666376a78c5fc64d77cc14f14021b073

SHA1
8561262b705be2684f4de7233b86aa25c112482d

SHA256
e2f44ae3695d55958b0d34d6697fb0be6378ae11b29ade94bae7024adcc7eae3

SHA512
519b4af20186ae5388a5adc9ae9ae9a7d90c5c4807b7da936a0dc04a1acd4bf5e4c08498808bd0916bd2d774411ced5aeb98228e72bc229f8a6949557ae14e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\python3.dll

Filesize
64KB

MD5
24f4d5a96cd4110744766ea2da1b8ffa

SHA1
b12a2205d3f70f5c636418811ab2f8431247da15

SHA256
73b0f3952be222ce676672603ae3848ee6e8e479782bd06745116712a4834c53

SHA512
bd2f27441fe5c25c30bab22c967ef32306bcea2f6be6f4a5da8bbb5b54d3d5f59da1ffcb55172d2413fe0235dd7702d734654956e142e9a0810160b8c16225f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\select.pyd

Filesize
29KB

MD5
c6ef07e75eae2c147042d142e23d2173

SHA1
6ef3e912db5faf5a6b4225dbb6e34337a2271a60

SHA256
43ee736c8a93e28b1407bf5e057a7449f16ee665a6e51a0f1bc416e13cee7e78

SHA512
30e915566e7b934bdd49e708151c98f732ff338d7bc3a46797de9cca308621791276ea03372c5e2834b6b55e66e05d58cf1bb4cb9ff31fb0a1c1aca0fcdc0d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\unicodedata.pyd

Filesize
1.1MB

MD5
d4964a28a22078c30064c65e968f9e1f

SHA1
b9b95975bea97a55c888da66148d54bdb38b609b

SHA256
b204718d21952369726472ca12712047839119ccf87e16979af595c0a57b6703

SHA512
bfe200b255ae1ddba53d98d54479e7e1d0932fb27bbfdcb4170d3d4cbbbfc297e3b5fd273b830399b795feb64cd0d9c48d0e1e0eaf72d0e0992261864e2d7296

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_5344_133872270578287289\yarl\_quoting_c.pyd

Filesize
93KB

MD5
9401cdf989b17c78e5d0ea5702380877

SHA1
0f37031def8a227d0b0b09c208494ea5f2324e5b

SHA256
d4ed42ac3f6c002c4e3dbf6fd344d4f3ca5465e0db6e495a920aed7772efb454

SHA512
df4a5404e0aca31c5e4be851a7fced6bb0d1a25b1a5ea4aa66590e7115ffd66324159d5b03811c99dfe2c338867a2d0771afdc0c0888e6f43f2328c19c91a7b5

Download Submit
memory/3420-193-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-191-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-204-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-181-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-197-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-167-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-199-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-183-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-202-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-195-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-179-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-189-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-187-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3420-185-0x00007FF6697B0000-0x00007FF66F1C2000-memory.dmp

Filesize
90.1MB

Download
memory/3832-159-0x000001D685BD0000-0x000001D685BF2000-memory.dmp

Filesize
136KB

Download
memory/5344-166-0x00007FF7B48A0000-0x00007FF7B6F7D000-memory.dmp

Filesize
38.9MB

Download