Edit tour

Windows Analysis Report
decrypt.exe

Overview

General Information

Sample name:	decrypt.exe
Analysis ID:	1582909
MD5:	0a08cc3661a39defcdc182acf62e17e5
SHA1:	580ccc43274151726405797779500f4fe9a0069c
SHA256:	db433f673eeacd8e905cca9ef3b283d30c466ab6afde31e53373197ee5d197fd
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found pyInstaller with non standard icon

Hides threads from debuggers

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: PowerShell Script Run in AppData

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

svchost.exe (PID: 3992 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

decrypt.exe (PID: 7008 cmdline: "C:\Users\user\Desktop\decrypt.exe" MD5: 0A08CC3661A39DEFCDC182ACF62E17E5)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7032 cmdline: "C:\Windows\system32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

decrypt.exe (PID: 616 cmdline: decrypt.exe --safetorun -a MD5: 0A08CC3661A39DEFCDC182ACF62E17E5)

cmd.exe (PID: 6984 cmdline: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 3600 cmdline: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

system15627a17808b7546c (PID: 6348 cmdline: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a MD5: BE54E01471656F49A38C5FBB1FD55492)

system15627a17808b7546c (PID: 1000 cmdline: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a MD5: BE54E01471656F49A38C5FBB1FD55492)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , CommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , CommandLine|base64offset|contains: Xx, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , ProcessId: 3600, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a , CommandLine: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a , CommandLine|base64offset|contains: }h, Image: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c, NewProcessName: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c, OriginalFileName: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c, ParentCommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3600, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a , ProcessId: 6348, ProcessName: system15627a17808b7546c

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, CommandLine: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: decrypt.exe --safetorun -a, ParentImage: C:\Users\user\Desktop\decrypt.exe, ParentProcessId: 616, ParentProcessName: decrypt.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, ProcessId: 6984, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , CommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , CommandLine|base64offset|contains: Xx, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , ProcessId: 3600, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3992, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: decrypt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

File created: C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\LICENSE.txt

Source: decrypt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: www.eventuallogic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: decrypt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.evad.winEXE@15/92@1/12

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03

Source: C:\Users\user\Desktop\decrypt.exe

File created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Source: decrypt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\decrypt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe"
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\decrypt.exe decrypt.exe --safetorun -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\decrypt.exe decrypt.exe --safetorun -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a

Source: C:\Users\user\Desktop\decrypt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\decrypt.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\decrypt.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: pywintypes37.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: security.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: kernel.appcore.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: decrypt.exe

Static file information: File size 17126992 > 1048576

Source: decrypt.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1034200

Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: decrypt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: decrypt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Process created: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\pythoncom37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32process.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32security.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingft.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\pywintypes37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingcms.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\_version.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32gui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_webp.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\psutil\_psutil_windows.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\python37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingtk.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_cffi_backend.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\decrypt.exe	File created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\block\_block.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-louserzation-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imaging.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI63482\_hashlib.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\decrypt.exe

File created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

File created: C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\LICENSE.txt

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2038
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3094

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32process.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\pythoncom37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32security.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingft.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingcms.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\_version.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32gui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_webp.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\psutil\_psutil_windows.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\python37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingtk.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_cffi_backend.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\block\_block.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-louserzation-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imaging.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI63482\_hashlib.pyd	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 6532	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\decrypt.exe TID: 552	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep count: 2038 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep count: 3094 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 904	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 640	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\decrypt.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Thread information set: HideFromDebugger

Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\decrypt.exe decrypt.exe --safetorun -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	11 Process Injection	2 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imaging.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingcms.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingft.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingtk.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_webp.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_cffi_backend.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_elementtree.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-louserzation-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\_version.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\block\_block.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\psutil\_psutil_windows.cp37-win32.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\python37.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\pythoncom37.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\pywintypes37.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32com\shell\shell.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32gui.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32process.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32security.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32trace.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI63482\win32wnet.pyd	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.eventuallogic.com	104.21.16.1	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.16.1	www.eventuallogic.com	United States		13335	CLOUDFLARENETUS	false
184.28.90.27	unknown	United States		16625	AKAMAI-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582909
Start date and time:	2024-12-31 20:48:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	decrypt.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@15/92@1/12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: decrypt.exe

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	15736
Entropy (8bit):	5.577334772631306
Encrypted:	false
SSDEEP:
MD5:	91AC2E3EE0149FE0C6F1FC425BA07EFD
SHA1:	166B51B21B3096BE8D5B6A972A0F45A79500FAE0
SHA-256:	0F40FDA67787E147FEB5A6238430F9DD060C27BF8FFB3158B88EFADB7B51A375
SHA-512:	A2206D41F9282CFC7401F2A21AF9FDC12A744E4D023096F7F08E20A16B7E3598632872735EE6225C6B7B2CD0FE71162FCBA046AEDC4CBCE73AAAB6BC1CBE2DF5
Malicious:	false
Reputation:	unknown
Preview:	@...e...........(.........z.?.1...../.c..............@..........H...............o..b~.D.poM...&..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation4...............<."..Ke@...j..........System.Core.0.................Vn.F..kLsw..........System..4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4..................~..2K..}...0........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementD....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imaging.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2082816
Entropy (8bit):	6.567717827073153
Encrypted:	false
SSDEEP:
MD5:	AFE20FC751526737378ED0310AF781B1
SHA1:	8C59B0E292A1BEE61893BD12B119B4401E4EB32B
SHA-256:	6054FB12513A29607FFB0506C89F25B968B67EB76695E388B4497AF46D901931
SHA-512:	4CC4F285D37F91D781C365744723F3EBB9E4B4A6D12A67656CBA5CAB3827DFB4C95973A4367064A1E6BD8E804E719D2F90C15F9053F5D86F6776216B2D589641
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.H.............vZ......r.......r4......r.......r.......r.......P.......v..........\...fr..W...........fr......fr......fr6.....fr......Rich............PE..L.....'d...........!...".............X....... ............................... ...........@.............................\...........p..........................p...........................@.......P...@............ ...............................text............................... ..`.rdata....... ......................@..@.data............p..................@....rsrc........p.......&..............@..@.reloc..p............(..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingcms.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	205824
Entropy (8bit):	6.411279259678849
Encrypted:	false
SSDEEP:
MD5:	7AB5744A4C4F76D09E21F00AEF17D010
SHA1:	076CF87AC3EB0B7D19CA9E7041C6DB5AD56CE9D2
SHA-256:	4D4C6A9FDACA824EF54E012EC5F6002101F8C45D8349F29CBD961DADD1289E02
SHA-512:	F969F871D2F3DDA7CC8E5A5AA70285B745DA15391A5C8E77D5E273EDCFEE2A4FA34D317B4C9B0A42E3A754C7F28F73FEB4496FA6C8A690830423CC6E55CE73D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2D..v%.v%.v%..]_.x%.9Y.t%.9Y.z%.9Y.\|%.9Y.r%..{.t%.=].q%.v%..%..Y.`%..Y.w%..Y3.w%..Y.w%.Richv%.........PE..L.....'d...........!...".t...........P.......................................`............@.........................P...`............0.......................@..........................................@............................................text....r.......t.................. ..`.rdata..F\.......^...x..............@..@.data....8.......6..................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingft.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1506304
Entropy (8bit):	6.951077426563325
Encrypted:	false
SSDEEP:
MD5:	3F3BB3141ABF74A7D003181A838CF4BB
SHA1:	6FA19A3410FDA9233F84FC6EEF6066D4D1C93254
SHA-256:	3944FCA6611A0A81C19028529A2C53A5A544B1F303A02DABCB63AD2501F11865
SHA-512:	567A76861A5C6A376F431F0768E1BF77C5F415FEC6EBEB98351CB7E394274FC03EC1709FAE9457A50B3270EE9CBDA6AFE8FF3D16A376F53A8756C3FFE1E84BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........!...@..@..@..8@.@...<..@...8..@...<..@...<..@...<..@......@..@..&@..k<..@..k<..@..k<..@..k<..@..k<,.@..k<..@..Rich.@..........................PE..L.....'d...........!...".....t.......B.......................................@............@.........................Pt..`....t..................................Lm...Z..............................0Z..@............................................text............................... ..`.rdata..............................@..@.data.... ...........p..............@....rsrc...............................@..@.reloc..Lm.......n..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingtk.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.58620478100912
Encrypted:	false
SSDEEP:
MD5:	BBBF64975FDA7A2C91BD39FF0F3AAA3F
SHA1:	F6FA8AD53FAE178BD51FC31D4B58B24057D431E8
SHA-256:	8B5D6EBA5BD8D43088EE0C768A5A5BF583A8254F2A84F4E0D4B2A8517872574C
SHA-512:	888B5CD50AF5B90E9054A2CC0F2156C73F5748A40EEA9826C58472A5F23B451007C47CDC7BD8A07D7A5651613381D3850EBD92D5E47356AC27EF622D48BAF538
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8...Yk..Yk..Yk..!...Yk.%j..Yk.%n..Yk.%o..Yk.%h..Yk.}.j..Yk.!j..Yk..Yj..Yk..%c..Yk..%k..Yk..%...Yk..%i..Yk.Rich.Yk.........PE..L.....'d...........!...".....................0...............................p............@.........................@5..`....5.......P.......................`..t....1...............................1..@............0...............................text............................... ..`.rdata..4....0......................@..@.data........@.......(..............@....rsrc........P.......,..............@..@.reloc..t....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_webp.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	426496
Entropy (8bit):	6.671010476118301
Encrypted:	false
SSDEEP:
MD5:	6A25D234F9834108276D70E36E6A4BF0
SHA1:	74DF712F21CF1134EC35795D548B3CE0154B5B73
SHA-256:	91ADBA8C77B15BF6BD6BA2A5A2D32F2660FDAF08CBD21234AA8D94EE79588317
SHA-512:	D61A0D4CC4F17233242CCBA67E02ABF5C94C047AD2C68F0F851C89159DA6DDBEFC10BED2F9641B91A601FFB66763067C3B3316190635560B6B22531C6ED3C73D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K..K..K..B.P.A.....I.....I.....G.....A......A.....H..K..............J.....J....<.J......J..RichK..........PE..L.....'d...........!..."..................................................................@......................... T..T...tT..................................$#...O...............................O..@...............8............................text............................... ..`.rdata.............................@..@.data....-...`.......R..............@....rsrc................\..............@..@.reloc..$#.......$...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83768
Entropy (8bit):	6.846131048807189
Encrypted:	false
SSDEEP:
MD5:	AEAB74DB6BC6C914997F1A8A9FF013EC
SHA1:	6B717F23227D158D6AA566498C438B8F305A29B5
SHA-256:	18CCB2DD8AF853F4E6221BB5513E3154EF67AE61CEE6EC319A8A97615987DC4B
SHA-512:	A2832B7720599361E2537F79A2597ACB1A2D5633FDFE20A0D1075E9457683FDB1D5676D121C0BF1A825FF99512DCD924254F1151B50AAE922ACC0CC10F461036
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..'...'...'....Yf.%.....>.,...'...........7.......4.......#.......?.......&.....R.&.......&...Rich'...................PE..L......Z.........."!........."...............................................P............@A........................P................0..................8?...@..p.......8...............................@............................................text...d........................... ..`.data...d...........................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc..p....@......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78352
Entropy (8bit):	6.573806249816513
Encrypted:	false
SSDEEP:
MD5:	1C52BA084A3723940C0778AB5186893A
SHA1:	5150A800F217562490E25DD74D9EEAD992E10B2D
SHA-256:	CB008E0A6C65DDB5F20AB96E65285DEE874468DF203FAEAFCA5E9B4A9F2918DC
SHA-512:	B397508607A1C7CCEF88C6A941398F78BA4F97CF8A32F40764673DB34C20EEA61364148260D87014348613EB07E959A043B505702437E33927249899BF4522B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w.L.w.L.w.L..EL.w.L.).M.w.L"..L.w.L.).M.w.L.).M.w.L.).M.w.L.).M.w.L...M.w.L.w.L.w.L.).M.w.L.).M.w.L.))L.w.L.).M.w.LRich.w.L................PE..L...G.:_...........!.........N......g........................................P......j.....@.............................H............0.......................@..........T...........................H...@...............l............................text...d........................... ..`.rdata..$(.......*..................@..@.data...H...........................@....gfids....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_cffi_backend.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146944
Entropy (8bit):	6.589957123008936
Encrypted:	false
SSDEEP:
MD5:	D27BFA7C8CEC41DB8C3804EEA65EC98C
SHA1:	7A118AD2572694A74F4A251CA13450E03B8C1B71
SHA-256:	0EB9B80039D4A1BC55070D453056E1C894A8A8F5981CE436CFE0B17E388448D0
SHA-512:	30FE05F78B559F27735FAB71D3DE96EB489E74A0D254DA6EE5A1CDB7E907FD63E5470133D2E452E881A22549617A0A0DC3E29171D04C24F57DAEEBFCBBB07F33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..j2..j2..j2......j2...3..j2.d....j2...7..j2...6..j2...1..j2...3..j2.m.3..j2..j3..j2.^.:..j2.^.2..j2.^...j2.^.0..j2.Rich.j2.........PE..L....._...........!.....X...................p............................................@.........................@\|..d....\|.......`.......................p.......x...............................x..@............p...............................text....V.......X.................. ..`.rdata..R$...p...&...\..............@..@.data...P...........................@....rsrc........`......................@..@.reloc.......p... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104976
Entropy (8bit):	6.530545672144021
Encrypted:	false
SSDEEP:
MD5:	10861D3FA19D7DC3B41EB6F837340782
SHA1:	B258D223B444AB994EC2FEC95ACAA9F82DC3938C
SHA-256:	6255BAB0B7F3E2209A9C8B89A3E1EC1BBC7A29849A18E70C0CF582A63C90BED1
SHA-512:	EC83134C9BCE9CEDEEE8EBDB8E382FB7F944A7BC9D3BB47C7E3144EF2EF95114A36AC1CC8C0D52F434EE4C359D938A2D7C035E699C4407DF728E200DE7DA4AF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qf..5...5...5...<.j.3....Y..7....Y..3....Y..?....Y..>...Y..7...no..4...no..2...5.......Y..<...Y..4...Y..4...Y..4...Rich5...........................PE..L...7.:_...........!................................................................}.....@..........................3......t4......................................./..T...........................H0..@...............x............................text...4........................... ..`.rdata..nJ.......L..................@..@.data...p....P.......>..............@....gfids.......p.......X..............@..@.rsrc................Z..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	218640
Entropy (8bit):	6.788259121874902
Encrypted:	false
SSDEEP:
MD5:	5596249B64C074374EAA1D4084E336C3
SHA1:	3748F6FF018C50913379B562E776F739E2A25A1F
SHA-256:	673BD4CACF3B5F8DA67C9C84E03E238961CA98683483DE78D0A6410200F7ABA6
SHA-512:	075438583BE8C186402BBFDC2EBB931F849D774D808ADE6DDEB55E1EA86646824560F1C981E859B55E71192F2D7E349CA967D61DDA0F3BD8081B329D2821C3F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......YU~I.4...4...4...L...4..&j...4..&j...4..&j...4..&j...4...j...4..F\...4...4...4...j...4...j...4...j...4...j...4..Rich.4..........................PE..L...6.:_...........!.....h...........j.......................................p......7[....@.........................@...P............@...............<.......P..H...P...T...............................@............................................text....f.......h.................. ..`.rdata..`8.......:...l..............@..@.data...pj.......h..................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..H....P... ..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_elementtree.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163344
Entropy (8bit):	6.648537488183864
Encrypted:	false
SSDEEP:
MD5:	390552274C5F71C7EBD1F343BB74446C
SHA1:	E6285B1B7BB06126F9E61791175FACCA21C03FEC
SHA-256:	D6C7EA93CDEFE1973239A3DEC0F49A1027E943F1DE07E21FF378978CC6A438BC
SHA-512:	E2135848220F3D9FF36023B2121B6E7B52224FCAFDF260530ADE96A788F2F2A11A7179AE59986EB7F6E850C829CB8CED600E25A788344FA72E07773429FA1B43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s... ... ... ..r ... ...!... ...!... ...!... ...!... ...!... ...!... ... /.. ...!... ...!... ... ... ...!... Rich... ........................PE..L...:.:_...........!................x.....................................................@.........................@'..X....'.......p.. ............d..............P#..T............................#..@...............p............................text............................... ..`.rdata...G.......H..................@..@.data........@.......*..............@....gfids.......`.......8..............@..@.rsrc... ....p.......:..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32272
Entropy (8bit):	6.427179434799816
Encrypted:	false
SSDEEP:
MD5:	4F51ED287BBAE386090A9BCC3531B2B8
SHA1:	26BD991AE8C86B6535BB618C2D20069F6D98E446
SHA-256:	5B6DA4B43C258B459159C4FBC7AD3521B387C377C058FE77AD74BA000606D72E
SHA-512:	2EB2CCD8E9C333B5179CF8F9FD8520CB3D025E23A10DCA3922E28521CFB9A38F9DD95F5D4F2784643EED08925D9008E5238FF9F93BDD39EE55414131186EDFF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.Q./l?./l?./l?.&...-l?..2>.-l?..2<..l?..2:.%l?..2;.$l?.2>.-l?.t.>.-l?..>.,l?./l>.yl?.27..l?.2?..l?.2...l?.2=..l?.Rich/l?.................PE..L...C.:_...........!.....,...8.......,.......@......................................61....@..........................L..P....L..x....................d...............H..T............................I..@............@..l............................text...L*.......,.................. ..`.rdata..<....@.......0..............@..@.data...P....`.......H..............@....gfids.......p.......P..............@..@.rsrc................R..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146960
Entropy (8bit):	6.957798612342108
Encrypted:	false
SSDEEP:
MD5:	F91A9F1F2EFEE2F5DBAE42EA5D5D7153
SHA1:	2575CC77B51CB080FCEED9810A9F4B2903AE1384
SHA-256:	1F82BB06C79B6B392C92CAD87FFA736377FA25CD6D10DA8D61441D42C0D0101E
SHA-512:	DF1DFB8C8CEE3496A60EEEB6F0D3FE48E1DE8AF5D04667F9A3124B769E8EDD886CC46E6E4D4B277EE5D30F9F70F6F8C755097DDD996573A6817A5BB335DE919F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+..E...E...E......E...D...E...F...E...@...E...A...E.1.D...E...D...E...D...E.1.M...E.1.E...E.1.....E.1.G...E.Rich..E.........PE..L...V.:_...........!.....r..........Js.......................................`............@.............................L.......x....@...............$.......P..D.......T...............................@...............d............................text...fq.......r.................. ..`.rdata...}.......~...v..............@..@.data...............................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..D....P......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25616
Entropy (8bit):	6.307253811483999
Encrypted:	false
SSDEEP:
MD5:	05AB494CF791A50E4F8D2FFE1D3E1F3C
SHA1:	BB10CB1547CA996575000424026D88D095CB14B4
SHA-256:	4959342924E22B6A16EBC5C1ED39552E981515401EDA770E4AC87FD12ACF53F8
SHA-512:	0D0608B152482CB6E33C1ECE40AE8F00FF5360750627494AD5268C90C74DA22984B468674D2E959FAE098615761C1BE00E84862EF7B489C276345AA8292F2CA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'S..c2.c2.c2.jJv.a2.Xl.a2.Xl.b2.Xl..h2.Xl.h2..l.a2.8Z.f2.c2.,2..l.a2..l.b2..l..b2..l.b2.Richc2.................PE..L...8.:_...........!.........................0............................................@.........................p9..`....9..x....p..(............J...............5..T............................5..@............0..P............................text...l........................... ..`.rdata.......0....... ..............@..@.data... ....P.......4..............@....gfids.......`.......8..............@..@.rsrc...(....p.......:..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_pytransform.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1370638
Entropy (8bit):	6.906692628236274
Encrypted:	false
SSDEEP:
MD5:	15E7CB63F96E358969B79978F743A644
SHA1:	B7BFB753DE73D1EAE5FDBD62F5CF80B0C90BEF2E
SHA-256:	677F1B68A907B2F1A6B1999D0AB6A4FB8076D230F45FB90ECEEE858191196A37
SHA-512:	4245D9DFE9D0F3E60F4D0BECD9FDDA1EED6E135149CB035E519AC7BE4ACAACD7469B66D8B25D9980CAEC46B5D96CB371DC4446E39380F17552CD5D71735C9C53
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..`...........#................`........ ....th............,............................. ......................P..+....`...................................Q..................................................`b...............................text...D...........................`.P`.data...L.... ......................@.`..rdata....... ......................@.`@/4......<...........................@.0@.bss..................................`..edata..+....P......................@.0@.idata.......`......................@.0..CRT.........p......................@.0..tls.... ...........................@.0..reloc...Q.......R..................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24592
Entropy (8bit):	6.35292645491841
Encrypted:	false
SSDEEP:
MD5:	234F63AE981F5A8E87DBABDA8CEEA32A
SHA1:	528EA2CF3D7622AA9BF9C038C91DF4E369C9924A
SHA-256:	3E1304AFDCD900748F62D15F93005E65457B9466454E322D065852603C510AC8
SHA-512:	A7308FCDAE88EFC2F7BDB9AC98350FC50E63B4807F3B1F98F07B789B22D56EEA7BFBAF7CB43886542D0B3C7DD8882D0107AD40081220765A5003635A4CF3C678
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W...9..9..9....9..8..9..:..9..<..9..=..9...8..9...8..9..8..9...1..9...9..9......9...;..9.Rich..9.................PE..L...;.:_...........!.........,...............0......................................8.....@.........................p6..L....6..d....`...............F.......p.......2..T............................2..@............0...............................text...l........................... ..`.rdata..\|....0......................@..@.data........@.......,..............@....gfids.......P.......4..............@..@.rsrc........`.......6..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66064
Entropy (8bit):	6.549494681327337
Encrypted:	false
SSDEEP:
MD5:	B3AF79BBFD7D5C5285660819792A3A9C
SHA1:	1FA470B280AB5751889EAA7BDB7BA37FF1270A06
SHA-256:	EB6132B253C40D7C3E00B2BBB392A1573075F8BBC0B2D59E2B077D2CFE8B028C
SHA-512:	DAC7DA4CD493C0753D477DA222C9B1E8C2486A4B6587C7CEA45661192F2D51316B6E6F3951FFBBCB83952E51AB61CC79326BEACB3D5E8637D13F2831E093F124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.zX.u...u...u.......u..4+...u..4+...u..4+...u..4+...u...+...u..T....u...u...u...+...u...+...u...+...u...+...u..Rich.u..........................PE..L...D.:_...........!.....j...~......Pl....................................... ............@.............................P...`...x...................................0...T...............................@............................................text....i.......j.................. ..`.rdata...*.......,...n..............@..@.data...x5.......2..................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	6.488208820143906
Encrypted:	false
SSDEEP:
MD5:	218DA11C9B2295D5C645ECB7629CD44D
SHA1:	0E3337A9D9AC67D214F7C2067B21002A8A3D158D
SHA-256:	5987B2FCCA0698710F3572F222A6AEF3EFD9A6A32C002A11DD33C816BD9B58D8
SHA-512:	0FFB6DFA22ACF3E459D47BFD2E0A979D1AF6A577B9AC44E9B81F6E85A01EBE0DD33E436621BD355B145E05FBDEA504F7040D14F539277D8BF2C354968885CD46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.lO..?O..?O..?Fd5?I..?tB.>M..?.a?N..?tB.>M..?tB.>D..?tB.>D..?.B.>J..?.t.>M..?O..?...?.B.>F..?.B.>N..?.BY?N..?.B.>N..?RichO..?........PE..L...Q.:_...........!.....z...l......nz....................................... ......w.....@.............................P..............................................T...............................@...............p............................text....x.......z.................. ..`.rdata...9.......:...~..............@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100880
Entropy (8bit):	6.5665910578271935
Encrypted:	false
SSDEEP:
MD5:	2825BAE93CD459D835B74892C9BD80DB
SHA1:	C7AB0C88489E5EB8E920EBC9871C969768BD4739
SHA-256:	AF4379FDC8BD41F7A8A4B509DE949202CCDB5E4825797D7A5DDDD5E77671382C
SHA-512:	FE5D9C3FF4469647AFD20FFA43EBFDADA0516576117C51D03EB8960A81516425FD110E2F6978CF98D279E3912C2A9C1D42C4C39900E183B1F08C2272ECEB00B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l...l...l.......l...m...l...o...l...i...l...h...l.5.m...l...m...l...m...l...m..l.5.d...l.5.l...l.5....l.5.n...l.Rich..l.........................PE..L...N.:_...........!................................................................2.....@.........................p...d............................p..........P.......T...............................@............................................text.............................. ..`.rdata...p.......r..................@..@.data....;...0...8..................@....gfids.......p.......J..............@..@.rsrc................L..............@..@.reloc..P............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\_win32sysloader.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.443206663079606
Encrypted:	false
SSDEEP:
MD5:	140C1DB69DEC5F00A4D0E907E8F80C15
SHA1:	1A6F616B47E32EF0C232B996FB095A47EB0FBDD4
SHA-256:	B77065DF8C8969EA88DBE97C631478171BC0E0D8289A663E357A2593C6F06A87
SHA-512:	9B97A42DDBBF114F7D943A8C0EF793310C45EC1D4DC2DB24E2622CBE9A68FD7A88C3DA60F4C5A6E0FD1B4CFB9111AC73AF37C897D4D618B9B6F6EEAA437F5B75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................v]..................................................Rich...................PE..L...z..]...........!.........................0....;.......................................@......................... 5..]....5..d....`..l....................p......@1..T............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@....... ..............@....gfids.......P......."..............@..@.rsrc...l....`.......$..............@..@.reloc.......p.......(..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11712
Entropy (8bit):	6.639611685011818
Encrypted:	false
SSDEEP:
MD5:	795CA04BC4F20F95AAD05AB330DC2CE3
SHA1:	5438E697E92B325A48E2A3E4C9F814BD02010C65
SHA-256:	AAB2744EFF9E83ACD48CDBA96CE7CAEB78AF7B13656ABCFAFA9E511AC46EE6AB
SHA-512:	8E69A2836FA389820BCFA4A62D135AD0AB4AA07586CBC231B57F9DFDD6B4DDFA5229F673C7EC7D1086E99EA0AFB4C3550E5057E3C2D124B40BDB50494A40BF22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...@.E............!......................... ...............................@......6l....@.........................`...L............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.747657141195362
Encrypted:	false
SSDEEP:
MD5:	7BBD3E20A9B7512195887E1765601C6D
SHA1:	F6AF00E247C3520E8EDC90C26C5F7D9DED45DDD2
SHA-256:	BCA4926B90C5EC619F268ABB0872DD33796A00F884442E4AF2F83CB51C9A3A72
SHA-512:	9F3F1F1FEACDED3BB6FC18AF483C8500097F8E42DA8647E899A8A621FC4C89DCE1BEA1C9A69F4B43CD6DB2745EBBD15F95D92031BFEF440DE2D67202C650D815
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...X./^...........!......................... ...............................@......d!....@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-louserzation-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14800
Entropy (8bit):	6.540659692736027
Encrypted:	false
SSDEEP:
MD5:	952ABD24420129B6041B4A05907D7D23
SHA1:	9FB7FD928A64B4E2756DEABCC54D591F99AA9FB3
SHA-256:	2B133BFF971893B180DE3E8405BDF86317A890F4BE77C191500E26A1BF547391
SHA-512:	74F7B853356AA380A496B5ADE5942A35F5C48368A39077923D5DDB7BAE807E1853D91DEC846AD443598F79398BE1A7FCCC664E7688694FDF562AB7E22B1EBE75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Tv.,...........!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...'........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.666200722335897
Encrypted:	false
SSDEEP:
MD5:	A0CD566D4FBC43644E840F9F739C02B7
SHA1:	AFCFE88F450A46F799F290FB5861390BA78793B6
SHA-256:	2AE2F4FDEEAE0D2A8FE2633D2FABB8839F2A14BDE7265F6FEE82C8363511E673
SHA-512:	EC3CDD69F0989BF30357B743245BBEDAD9498EA81C1C7219F6828F950ACDD96D6241B488462F955DA71C1494111108BCEFCF118090607E7AE6606B1D3B5D7C38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.../H)............!......................... ...............................@......%.....@.........................`................0...................!..............T............................................................................text...:........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.720689902700417
Encrypted:	false
SSDEEP:
MD5:	D092B16408DA90472C47A33A78445F79
SHA1:	40C7E0FBFC79DC9A9059F1A213BE2508885B788D
SHA-256:	859ED3BD541D304BF67EA511E1D9B5539A75B60EBDF6BABEBA61AF0EE1A59314
SHA-512:	E28FEAF4F4A4B0190A06EE88472157AF3710471F4CD2BCA45F89DB5BC9802612041FCC58F91EE0BC15E74874053D7AB2F09C8176210F545EFBA55C3EC313F816
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....dML...........!......................... ...............................@.......d....@.........................`...v............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.714916839772615
Encrypted:	false
SSDEEP:
MD5:	7992D065117BFDB7CC29703F78A981AA
SHA1:	F046E288BFCBC88BE0649F16041D5EE133E4F697
SHA-256:	4762DFE93CC5F41960090B58E31DED93894F2995189CC38151D4A2F69BF8D039
SHA-512:	DBCE4E52E2BE1886F36793A33228F4755040B4119E8A7B18DE5773718AE45472BBFED550F8FFF2032F243C53BAB026D9DFDA4915E1E5DBFFB34A4E51372D996B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!......................... ...............................@......l.....@.........................`...E............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.711773385437227
Encrypted:	false
SSDEEP:
MD5:	817197F0DFB1BDBD4F3458E68E4E5053
SHA1:	ACFC4BD77F4663AE7111D614E7037677A202FEF0
SHA-256:	12CDD3C701FE41B736449643EC4E4511D4522C73825B38019A1E58E7D0D54181
SHA-512:	2BDE3AB7E7C107B3ACEA53FB66417345D96E459DFFFE8A196767ADBAFAEF40F959B2516AB5BA6E6F4B3E258CAB9CD2B10A9BC045D67C0A26E0310F6AA49E904A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....M...........!......................... ...............................@............@.........................p...e............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16832
Entropy (8bit):	6.373000673408678
Encrypted:	false
SSDEEP:
MD5:	6B7B21610F059F2C68BAE34BDD5F563A
SHA1:	988A21E37C0146EC11B9727E650F399460AFEEEA
SHA-256:	DBC67D9F442328D6C51EB1C4E9B462B2FFC7D5A91AD339865085E15F5C486C85
SHA-512:	1B3E44F961666091A5A51698EDB89A98589C5C3831524BD7410F2598E30EA70BDBC31A07A2F30F9F18009899FC309DC725CAE2F2C2589D4CF8CC8C75C2528828
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!.........................0...............................P...........@.........................p................@............... ...!..............T............................................................................text...5........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18376
Entropy (8bit):	6.284863204565395
Encrypted:	false
SSDEEP:
MD5:	C60AB26638567B7822A443D6F26E2684
SHA1:	928BDB393737EA19E75CA8F8AD5EE1805308C039
SHA-256:	4C1A28D7B1DB81EDEF66411B32FB7A95E875B6B56D91C22B9EFBB79C9C5740A5
SHA-512:	AFF933EE546B5AEF6CEE9C61B483320006C5A5B536C887A9EDE5F5937B3B5B49F73877A6913EF4D24863DD81DA5C0C42CA2916228E0F001B5B49E19CAC478DE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...3............!.........................0...............................P......^X....@.........................p................@...............&...!..............T............................................................................text...O........................... ..`.data...@....0......................@....rsrc........@......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14280
Entropy (8bit):	6.553268737920515
Encrypted:	false
SSDEEP:
MD5:	1DC68969E07D2C6EB70A8727562FD4FC
SHA1:	AEF136D108BBC2D10E71EF32A38A8622125B60FF
SHA-256:	B60A7E496775AA4D68AF0A6665EE9B003D509AA83D6F23AFC5D0965023E09C16
SHA-512:	2487D3A3A305CAE19E8481778D360889ABE183C2A86A8236C3468378C2F69F4CFEC4CCD04457BD6B2F7D2288E625C1F205CF3D4B16F30B89CB612EBFCEFD6061
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...,.zo...........!......................... ...............................@............@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	778249
Entropy (8bit):	5.519194067859355
Encrypted:	false
SSDEEP:
MD5:	28912E44EF0184BDE6985434AEA2EA0F
SHA1:	2983C2676458F1566E40D836EAB93162E59A82DC
SHA-256:	D8007CC9E158CEB6760A6D83016607DBFCBCAA5AB09068B85211C56F04862655
SHA-512:	090718E1A802425FF188426281FCBA1FE8C5D98F3BEB3A1E504A534AF31B7D9BD07F95FC85E3496ED771A92724FA025A780B4EE61A1D49648B9C765CA58186E8
Malicious:	false
Reputation:	unknown
Preview:	PK..........!..v.r............_bootlocale.pycB........"J...Rm.................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJy.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.....)...sys..flags..utf8_mode.._locale.._getdefaultlocale)...do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc................C........d.S.).N..UTF-8r....).r....r....r....r....r...............c................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).N..UTF-8r....).r....r....r......localer....).r....r....r....r....r....r.....................c................C....6...\|.r.t...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).N..UTF-8..darwin)...AssertionErro

C:\Users\user\AppData\Local\Temp\_MEI63482\build.stamp

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.5
Encrypted:	false
SSDEEP:
MD5:	C1701A1EDDCD0169ED0BD726DF2FFD32
SHA1:	39108B7DC37FB6C28041551922A3EEC71FB3D3D1
SHA-256:	31FFECA00DFE6F6F8C520AF8CEDECDD97B4D30CDBB9B7D93C30F96F76C1230A9
SHA-512:	85A51BE66212A604E1E06C2568041F388329BC359D575701B2AE67953DBD00AAF053E9B9400CA584FD5F1D07C0B52FF5B629711D1946CCB5D4B5DFACF7A03119
Malicious:	false
Reputation:	unknown
Preview:	51226108

C:\Users\user\AppData\Local\Temp\_MEI63482\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	281457
Entropy (8bit):	6.052067996006565
Encrypted:	false
SSDEEP:
MD5:	77EEF70800962694031E78C7352738D7
SHA1:	B767D89E989477BEB79BA2D5B340B0B4F7AE2192
SHA-256:	732BEFE49C758070023448F619A3ABB088F44E4F05992BC7478DAE873BE56AD8
SHA-512:	0B3984F7BF9D37648A26EF5D3A93E15D5C2E8A443DF123121BA43CA858939346CCA0D613F04F2D9ABA5420B1291EF429FEA84E60920220086B153AAC61A20F2F
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Reputation:	unknown
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Reputation:	unknown
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Reputation:	unknown
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	5.111666659056883
Encrypted:	false
SSDEEP:
MD5:	07E3EEA441A0E6F99247D353BD664EA1
SHA1:	99C8F9C2DD2D02BE18D50551ED4488325906C769
SHA-256:	04FE672BF2AA70FF8E6B959DEFE7D676DCDFD34EE9062030BA352A40DB5E2D37
SHA-512:	24F458C831F7A459D12E0217F4BD57F82A034FEC9EA154CAC303200E241A52838A1962612C5AAFF5CD837F668FDC810606624DCA901F4274973F84A9ADBA8D66
Malicious:	false
Reputation:	unknown
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 42.0.8..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	CSV text
Category:	dropped
Size (bytes):	15255
Entropy (8bit):	5.563762941994036
Encrypted:	false
SSDEEP:
MD5:	881DBAFC9E69152D93C9B531EC50A258
SHA1:	6D860C4FEF4F14AB09257D7F937F2E9F07B45881
SHA-256:	E7AA6AAF0D96AF668BC94D8C5FBFB8CC3A86B543E5A17061D145BA1C8647BF08
SHA-512:	D3A3C0EDB2F1B999BA3CDE5A729A0A2CF4FBD084CD2778305EF2EAC7D517ECD8C7A88F0DBCBEAA488493ACE6A38E0961B22B7944432606E04FCA87708F1622FF
Malicious:	false
Reputation:	unknown
Preview:	cryptography-42.0.8.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-42.0.8.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-42.0.8.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-42.0.8.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-42.0.8.dist-info/METADATA,sha256=BP5nK_KqcP-Oa5Wd7-fWdtzf007pBiAwujUqQNteLTc,5430..cryptography-42.0.8.dist-info/RECORD,,..cryptography-42.0.8.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-42.0.8.dist-info/WHEEL,sha256=0gG2dsQKvt2gI6DFhDvF0uaFTGq8u3uWxI-mKQFzTEg,96..cryptography-42.0.8.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=ugkzP6GZzVCOhwUvdLskgcf4kS7b7o-gvba32agVp94,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/__

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.9443665431825226
Encrypted:	false
SSDEEP:
MD5:	F4E86E90DC331285AD04689B1E637261
SHA1:	0045BACBA08072DF601198CF66250BF6554A1CC1
SHA-256:	D201B676C40ABEDDA023A0C5843BC5D2E6854C6ABCBB7B96C48FA62901734C48
SHA-512:	210304275EA0C3BB11D6C76FE9B988F42B63D77AA0D45C632F1990F47312C3248D041702CBFA2FA761939489D8BC899BFB8B91293DFC672F9FE502450DE3911D
Malicious:	false
Reputation:	unknown
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp37-abi3-win32..

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography-42.0.8.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Reputation:	unknown
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI63482\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5100032
Entropy (8bit):	6.746317671701728
Encrypted:	false
SSDEEP:
MD5:	2CA7E2B4C97528701818521A38ACC7AB
SHA1:	8A8276CC9D7182026AE13B07B4304383FA9E406C
SHA-256:	0AAF7A579E4FD263AD5F83E934DF6A2D6487DD3CEB5D63DCB99FB96FA3160DC9
SHA-512:	2A41DE9E335AD7484FFB0943C4C46F2D16EF6288582434DA0FAA87DB29AB57F5385E4759BF4B61F373CD37B43A703742FCC1A0BB95F5DFBA4EA109C435DE6FD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....y...y...y....a..y.......y.......y.......y.......y..p....y...y..={.......y......lz...y..y.......y.......y..Rich.y..........................PE..L....o_f.........."!...'.,=...........;......@=...............................N...........@..........................RJ.p...PSJ.\|............................0K.@...0.H.T.....................H.....p.H.@............@=.h............................text....*=......,=................. ..`.rdata...2...@=..4...0=.............@..@.data.........J......dJ.............@....reloc..@....0K.......J.............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\default_s.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	5.739804421948479
Encrypted:	false
SSDEEP:
MD5:	CC6DAA63174C0BA2CCA2B7E220919E6F
SHA1:	F590F9339B581D0D9E4771A4EDA5C2F9C0BA52D0
SHA-256:	308E31D998FBB11232F3E9B9C339CAEB36AA53E5E5590B03C637C001B8956AB8
SHA-512:	39D231EB0D5BD3F2960AF444D592F0884384D6A5E0821A4D740FC5C89B6D1B8608B846445966253280840BDCB561F0D6EF9BDCDDFB22A45932B4F24F7D1AEC32
Malicious:	false
Reputation:	unknown
Preview:	N;.....Z@X^Vi_QUP....ABWQ.Q^YDT.TA[..;.....PCX\\jW^SQB..?....j:.........stsfccuggtb~wru..;.........tspdmgtmyshgwgua..;.........~ppfgdto}mew\|ex.v..8.........ptql`cwmsid}{b{}xntqfpp~s..2.........s`}abujjw{`sw.`..8.........tc.oft`muybwxt.8....h.8.....APAYE..2....ml.2.....^@L\^\A..:....i<.........^WV^\T_VXYFY..<.........STZDV.<....l.8.....AS@B_UJ..8....CH.8.....V]]GRnQH\....YDLEB...FGO.TDWXEEYY]]U_R.[Z\..<.....F]]T^....VPSU......SV..S...U...........US..;.....[Pn@TTET]D\..?....J:.........BX\VYFC..;........I8.............B[UXX^_..8............C?................._WBY_\....ZTWYVH..<.................S]GEmT_]U....QSCDKim......EWJ..;.................[PCFmFPCKB^@V............?.................A[Q_DWZ]mTZPWK.....UUZ@V..PU.k}p....:............O.;.............]FEYW[B..<............jo8........K;....O8K

C:\Users\user\AppData\Local\Temp\_MEI63482\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2228256
Entropy (8bit):	6.104954247326777
Encrypted:	false
SSDEEP:
MD5:	AAD424A6A0AE6D6E7D4C50A1D96A17FC
SHA1:	4336017AE32A48315AFE1B10FF14D6159C7923BC
SHA-256:	3A2DBA6098E77E36A9D20C647349A478CB0149020F909665D209F548DFA71377
SHA-512:	AA4B74B7971CB774E4AE847A226CAE9D125FADC7CDE4F997B7564DFF4D71B590DCBC06A7103451B72B2AFE3517AB46D3BE099C3620C3D591CCBD1839F0E8F94A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g ..#A..#A..#A..*9..7A..q)..!A..q)..)A..q)..)A..q)..)A..x)..(A..#A..A..(..\C..(.."A..(m."A..(.."A..Rich#A..........................PE..L......^...........!.................H.......................................p"......s"...@.........................0]..hg...5!.T....`!.\|.............!. ....p!......A..8............................A..@............0!..............................text.............................. ..`.rdata...$.......&..................@..@.data...4Y.... ....... .............@....idata..h....0!....... .............@..@.00cfg.......P!....... .............@..@.rsrc...\|....`!....... .............@..@.reloc..i....p!....... .............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	537632
Entropy (8bit):	5.756439581249174
Encrypted:	false
SSDEEP:
MD5:	697766ABA55F44BBD896CBD091A72B55
SHA1:	D36492BE46EA63CE784E4C1B0103BA21214A76FB
SHA-256:	44A228B3646EB3575ABD5CBCB079E018DE11CA6B838A29E4391893DE69E0CF4B
SHA-512:	206957347540F1356D805BF4A2D062927E190481AADC105C3012E69623149850A846503FCA30FC38298F74D7F8F69761FDDD0AA7F5E31FEDB1FA5E5C9DE56E9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D1...P.K.P.K.P.K.(uK.P.KR8.J.P.K[8.J.P.KR8.J.P.KR8.J.P.KR8.J.P.K.9.J.P.K.P.K.Q.K.9.J,P.K.9.J.P.K.9.K.P.K.9.J.P.KRich.P.K........................PE..L......^...........!.........................................................`......{.....@..............................N..............s............... .... ...5..@...8...........................x...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;...p...6...Z..............@....idata..3A.......B..................@..@.00cfg..............................@..@.rsrc...s...........................@..@.reloc..)=... ...>..................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\lz4-3.1.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	1495
Entropy (8bit):	5.124333927839823
Encrypted:	false
SSDEEP:
MD5:	6231EFA4DD4811E62407314D90A57573
SHA1:	EC224694848D1D4A6709AC3DC241B1935A4444E3
SHA-256:	E2AC43D6EB80EB4E52141817C812437E0B981B1D7B2DC7CC86C7EF5524044C6F
SHA-512:	F97B282B1F8905A1824BFEDEB4A2A6291ADBE7935ED2E1FA82A8FAC7D2D0AE98B8448802EDE2630119651491A99A58595A9FFE98142C88C9F4CD889D39F0F980
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2012-2013, Steeve Morin.All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,. this list of conditions and the following disclaimer in the documentation. and/or other materials provided with the distribution...3. Neither the name of Steeve Morin nor the names of its contributors may be. used to endorse or promote products derived from this software without. specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS".AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE.IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.ARE DISCLAIMED. IN NO EVENT SHALL TH

C:\Users\user\AppData\Local\Temp\_MEI63482\lz4-3.1.1.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	3653
Entropy (8bit):	5.079568903765231
Encrypted:	false
SSDEEP:
MD5:	D5871E278D68484B7A5AFCE52A898769
SHA1:	966A1DB24839235378C97FA924DEEAC129FA644A
SHA-256:	4E71A6D9F4AF0BA8F4E4576FEAE1643B3EA8CC3AD98803B361E4C49BFE801B88
SHA-512:	F91DB6204817715E90A3A08A1B5B5F9D404442E412920E3574B74E17C97C6C3C4B961D31BD20068959EA14094197F7098EC103DD68A34A75D9D8F8ED02D6F4C9
Malicious:	false
Reputation:	unknown
Preview:	Metadata-Version: 2.1.Name: lz4.Version: 3.1.1.Summary: LZ4 Bindings for Python.Home-page: https://github.com/python-lz4/python-lz4.Author: Jonathan Underwood.Author-email: jonathan.underwood@gmail.com.License: UNKNOWN.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: BSD License.Classifier: Intended Audience :: Developers.Classifier: Programming Language :: C.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Requires-Python: >=3.5.Provides-Extra: docs.Requires-Dist: sphinx (>=1.6.0) ; extra == 'docs'.Requires-Dist: sphinx-bootstrap-theme ; extra == 'docs'.Provides-Extra: flake8.Requires-Dist: flake8 ; extra == 'flake8'.Provides-Extra: tests.Requires-Dist: pytest (!=3.3.0) ; extra == 'tests'.Requires-Dist: psutil ; extra == 'tests'.Re

C:\Users\user\AppData\Local\Temp\_MEI63482\lz4-3.1.1.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	CSV text
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.8928955593750265
Encrypted:	false
SSDEEP:
MD5:	BE1D0B62B412156418235E3DA8924109
SHA1:	5430DCD7CE79E263791751F8525619672D738969
SHA-256:	70E78498DF6F3307C1450C05A954BE35B90478D715AA8D5E58824BA48EFAF15F
SHA-512:	7AD2677E69E7F0E769B3040B3665E3D8F4197D6E4DB3EF8E761C729DAE436132138EE1E21BD0FDEE4E6EBF9EE117CAF17EF84EBD97FACE392A462F4D7AAB6374
Malicious:	false
Reputation:	unknown
Preview:	lz4-3.1.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..lz4-3.1.1.dist-info/LICENSE,sha256=4qxD1uuA605SFBgXyBJDfguYGx17LcfMhsfvVSQETG8,1495..lz4-3.1.1.dist-info/METADATA,sha256=TnGm2fSvC6j05Fdv6uFkOz6ozDrZiAOzYeTEm_6AG4g,3653..lz4-3.1.1.dist-info/RECORD,,..lz4-3.1.1.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..lz4-3.1.1.dist-info/WHEEL,sha256=SYKICiw7EPrpyOeCIuAJswXTZAWXbJBHvAYcpuUpX1M,102..lz4-3.1.1.dist-info/top_level.txt,sha256=cX6_gxFUdNSo40TfxrGpTCgu7epGm3yW3m2k7irTDzI,4..lz4/__init__.py,sha256=etsV-XG9vgCn-EKrFpzWJsGIp-VUtH-tpNrQmMmDECU,627..lz4/__pycache__/__init__.cpython-37.pyc,,..lz4/__pycache__/version.cpython-37.pyc,,..lz4/_version.cp37-win32.pyd,sha256=bnwM8qvRwdekiHz5-Ov6vAPJdTrZu587FqvUO6uVey8,9728..lz4/block/__init__.py,sha256=KsSQGgaPpJtVPJ5QfMadVGFduMy0hSetJHWGNmOvpso,70..lz4/block/__pycache__/__init__.cpython-37.pyc,,..lz4/block/_block.cp37-win32.pyd,sha256=WFGFwN9GvgGlOP1DWgzaZKZEAi3KgrFnP4nUSBbwCZ0,86016..lz4

C:\Users\user\AppData\Local\Temp\_MEI63482\lz4-3.1.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	5.045097529036378
Encrypted:	false
SSDEEP:
MD5:	450D9B4C9318D561EBF9DD24C23E8BE0
SHA1:	07648F2D1F33CFEAF6F9681F76C5B498FC7EA6B7
SHA-256:	4982880A2C3B10FAE9C8E78222E009B305D36405976C9047BC061CA6E5295F53
SHA-512:	7C63ECE85118249B1B153772EB710D86D5ABA09D1DAAFC7AE412A737E12FD9CA31D53EF55E508CA4BFA29467E970670E25A7E36B11DF81E8B25EA83C6DECEA0C
Malicious:	false
Reputation:	unknown
Preview:	Wheel-Version: 1.0..Generator: bdist_wheel (0.35.1)..Root-Is-Purelib: false..Tag: cp37-cp37m-win32....

C:\Users\user\AppData\Local\Temp\_MEI63482\lz4-3.1.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:
MD5:	194B36A8466E4650490040D599B09C0E
SHA1:	4CB4A2C46E9892B8A712716F9B42537D1962BBB4
SHA-256:	717EBF83115474D4A8E344DFC6B1A94C282EEDEA469B7C96DE6DA4EE2AD30F32
SHA-512:	C55B2D3D46EC558533B4019DFFA87B1F93E7866DBCDE8D00243D8C54F1A3094933256BD25EAA0333D6EC4B308F1A4C92630BBEF6E10BE7892774DCCF5556FE77
Malicious:	false
Reputation:	unknown
Preview:	lz4.

C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\_version.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.881064907741125
Encrypted:	false
SSDEEP:
MD5:	8CCCC1274F3C75EA3ADAB44E0D07CE7F
SHA1:	E39ECC4A5148BD6825A030B2AB35252F2A6461AC
SHA-256:	6E7C0CF2ABD1C1D7A4887CF9F8EBFABC03C9753AD9BB9F3B16ABD43BAB957B2F
SHA-512:	0C5CCB409F0D70B33A5B7E921B021628483AB0D0D39BBE569816BFA102D585DF3BE15AB8491A2F45043BFF5EF6BC77C3AAEAC0EEDB029A1E48C70B599BEEEEE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../R..N<..N<..N<..6...N<...=..N<.&=..N<...?..N<...9..N<...8..N<.x'=..N<..N=..N<.^.4..N<.^.<..N<.}....N<.^.>..N<.Rich.N<.........................PE..L....1._...........!......................... ...............................p............@.........................P%..\....%..d....P.......................`..X....".............................. "..@............ ..\|............................text............................... ..`.rdata..8.... ......................@..@.data...x....0......................@....gfids.......@....... ..............@..@.rsrc........P......."..............@..@.reloc..X....`.......$..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\lz4\block\_block.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	6.401737186239046
Encrypted:	false
SSDEEP:
MD5:	E36FE48EA61B8B16527B1C9D03F4D290
SHA1:	0AAC06A317C7037895B7A07116417BF58A2A9577
SHA-256:	585185C0DF46BE01A538FD435A0CDA64A644022DCA82B1673F89D44816F0099D
SHA-512:	3A3D4CCC895036F40A289AEFB73AAD038209778668D71D10EE6A3378148335A501BF0632335DFFDF74B3EDAD662E49756CCFE257510625BD0CCE2AFC1F19EAF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EG.r+..r+..r+......r+..,..r+.....r+..,(..r+..,...r+..,/..r+.:...r+..r..r+..,#..r+..,+..r+.?,...r+..,)..r+.Rich.r+.........................PE..L....1._...........!.....&..................@............................................@.........................PG..X....G..x...............................d....D.............................. D..@............@...............................text....%.......&.................. ..`.rdata.......@.....................@..@.data........P.......8..............@....gfids.......p.......H..............@..@.rsrc................J..............@..@.reloc..d............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\main.exe.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.275985339055138
Encrypted:	false
SSDEEP:
MD5:	CA7F091FB148F315F9BC345B52D213B2
SHA1:	02854D1DB2A237935A483DDB0ACA38E83FFEEFA0
SHA-256:	56149FA3B65314B976DA333FCAB5F6ABCE825D4AD1D6EB63EA477C297C4A143F
SHA-512:	352BEE98987E6F887D937C45E26A23786075597559D1DA89453A707650528B3496503D53589722EFC0A906769A81B7C83474A70D737601FEB7B9F16DEA6D10A7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="main-patched" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="asInvoker" uiAccess="false"/>.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="" name="Microsoft.Windows.Common-Controls" processorArchitecture="" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e

C:\Users\user\AppData\Local\Temp\_MEI63482\mfc140u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4444320
Entropy (8bit):	7.080080542206874
Encrypted:	false
SSDEEP:
MD5:	EC85D7A09109D1F52F165CFBA6DB8B33
SHA1:	BCC0A43BEA8E4D0DB781F417CC2FAEFBB034BD36
SHA-256:	CFBA55B3D6891A0F9E90726094DC4E57553C3443CEF156E5FFCD5965AC4E8E3F
SHA-512:	446B9B56B89730DCB891701C28D8B2C6666A924C0A908FDEA386E139A6392AFD7B69FD4BF5DBC20308BAED7897FDA23777798FDF2B10291F954EED10935CFB8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......A..Q.t...t...t...q..t...n..t...o..t...p..t....-..t..k/...t..k/...t..k/...t..k/...t...#...t...u..t...t...w..k/...u..k/...t..k/A..t..k/...t..Rich.t..................PE..L...$K<V.........."!......)..................`)...............................C.....(.D...@..........................^..L...........0+...............C..>....@.......).T...............................@....................)......................text...M.).......)................. ..`.data.........).......).............@....idata..zS......T.................@..@.tls......... +....................@....rsrc........0+....................@..@.reloc........@.......@.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\AUTHORS.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10082
Entropy (8bit):	5.035968441252304
Encrypted:	false
SSDEEP:
MD5:	D64F57885DBF3BF21AB90B358E2EE333
SHA1:	F1F4843B99FC5B4D6656157F01DEF3C747A28FB8
SHA-256:	3DDFEA62D8E5BAEE160DFB76035EFD74FB48BF061504DB437DC7028AD5513103
SHA-512:	E65A3065FEAA8750676306C873FCCCCD07A57471FCF0BAC7BFB562847743A924878C2ED64AEC8A3B4EDFE739C5BAEEA3845D089CBB28B25290061A74F7B640DF
Malicious:	false
Reputation:	unknown
Preview:	@Switch01.A_Rog.Aakanksha Agrawal.Abhinav Sagar.ABHYUDAY PRATAP SINGH.abs51295.AceGentile.Adam Chainz.Adam Tse.Adam Wentz.admin.Adrien Morison.ahayrapetyan.Ahilya.AinsworthK.Akash Srivastava.Alan Yee.Albert Tugushev.Albert-Guan.albertg.Alberto Sottile.Aleks Bunin.Alethea Flowers.Alex Gaynor.Alex Gr.nholm.Alex Hedges.Alex Loosley.Alex Morega.Alex Stachowiak.Alexander Shtyrov.Alexandre Conrad.Alexey Popravka.Alli.Ami Fischman.Ananya Maiti.Anatoly Techtonik.Anders Kaseorg.Andre Aguiar.Andreas Lutro.Andrei Geacar.Andrew Gaul.Andrew Shymanel.Andrey Bienkowski.Andrey Bulgakov.Andr.s Delfino.Andy Freeland.Andy Kluger.Ani Hayrapetyan.Aniruddha Basak.Anish Tambe.Anrs Hu.Anthony Sottile.Antoine Musso.Anton Ovchinnikov.Anton Patrushev.Antonio Alvarado Hernandez.Antony Lee.Antti Kaihola.Anubhav Patel.Anudit Nagar.Anuj Godase.AQNOUCH Mohammed.AraHaan.Arindam Choudhury.Armin Ronacher.Artem.Arun Babu Neelicattu.Ashley Manton.Ashwin Ramaswami.atse.Atsushi Odagiri.Avinash Karhana.Avner Cohen.Awit (Ah

C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	1093
Entropy (8bit):	5.111273684683205
Encrypted:	false
SSDEEP:
MD5:	63EC52BAF95163B597008BB46DB68030
SHA1:	D1816736D55C943E1ED44A003F72CB7D1AFE0789
SHA-256:	634300A669D49AEAE65B12C6C48C924C51A4CDF3D1FF086DC3456DC8BCAA2104
SHA-512:	C5DC9AFC4851E6FB4596913A4942B9EBCC14BEC1E79782B57C37C2A4567D2891D8DBC0737D44362FC9BEC56C33B02ADA15396F1A1DCB2FC61161A02738397F9C
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2008-present The pip developers (see AUTHORS.txt file)..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING F

C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4239
Entropy (8bit):	5.043918422359081
Encrypted:	false
SSDEEP:
MD5:	42DF78A2F29E52EDEE61236B6C32CD10
SHA1:	D17BAC53DCA8E8CADB0728EC7FBDF716C3CD6B36
SHA-256:	C873CB42FB03D5BE9FFB37424163226D95DBB008ECF3CE893128770B4A314614
SHA-512:	BA4BF132869C8D5F715D0ECDCFFF95D6198F1B56FC702325168C6C0AE1F5AB44376E08FA54665084CE433E1F70A453EFA49DF1AAD34C9A1F4BB41B28F8C40C72
Malicious:	false
Reputation:	unknown
Preview:	Metadata-Version: 2.1..Name: pip..Version: 23.2.1..Summary: The PyPA recommended tool for installing Python packages...Home-page: https://pip.pypa.io/..Author: The pip developers..Author-email: distutils-sig@python.org..License: MIT..Project-URL: Documentation, https://pip.pypa.io..Project-URL: Source, https://github.com/pypa/pip..Project-URL: Changelog, https://pip.pypa.io/en/stable/news/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: MIT License..Classifier: Topic :: Software Development :: Build Tools..Classifier: Programming Language :: Python..Classifier: Programming Language :: Python :: 3..Classifier: Programming Language :: Python :: 3 :: Only..Classifier: Programming Language :: Python :: 3.7..Classifier: Programming Language :: Python :: 3.8..Classifier: Programming Language :: Python :: 3.9..Classifier: Programming Language :: Python :: 3.10..Classifier: Programming Language :: Pyt

C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	CSV text
Category:	dropped
Size (bytes):	76787
Entropy (8bit):	5.5637726789097535
Encrypted:	false
SSDEEP:
MD5:	8C47C55A8B3DA01B6FBB71AFB664F48D
SHA1:	31DB4C8E6CD7208E9D9AA54367A64718A059A3AB
SHA-256:	C7CF93D09C5B6F0B11C515DB877482C643B995E4737CA2AF602B1FBD65B4EE45
SHA-512:	89C962BF7CC169D654915E1CA6B3C80B19CD0090DDFA012EF886DE7160520D6FDD17342F8BF63A42A81BF815E56433252B946CA3FC0382878E751DDF89C77D3B
Malicious:	false
Reputation:	unknown
Preview:	../../Scripts/pip.exe,sha256=ZcmKemq1pUV1_z5rEXvX5tF8xsLZ6dWFf06f7mTVw2k,98141..../../Scripts/pip3.11.exe,sha256=ZcmKemq1pUV1_z5rEXvX5tF8xsLZ6dWFf06f7mTVw2k,98141..../../Scripts/pip3.7.exe,sha256=ZcmKemq1pUV1_z5rEXvX5tF8xsLZ6dWFf06f7mTVw2k,98141..../../Scripts/pip3.exe,sha256=ZcmKemq1pUV1_z5rEXvX5tF8xsLZ6dWFf06f7mTVw2k,98141..pip-23.2.1.dist-info/AUTHORS.txt,sha256=Pd_qYtjluu4WDft2A179dPtIvwYVBNtDfccCitVRMQM,10082..pip-23.2.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pip-23.2.1.dist-info/LICENSE.txt,sha256=Y0MApmnUmurmWxLGxIySTFGkzfPR_whtw0VtyLyqIQQ,1093..pip-23.2.1.dist-info/METADATA,sha256=yHPLQvsD1b6f-zdCQWMibZXbsAjs886JMSh3C0oxRhQ,4239..pip-23.2.1.dist-info/RECORD,,..pip-23.2.1.dist-info/WHEEL,sha256=pkctZYzUS4AYVn6dJ-7367OJZivF2e8RA9b_ZBjif18,92..pip-23.2.1.dist-info/entry_points.txt,sha256=xg35gOct0aY8S3ftLtweJ0uw3KBAIVyW4k-0Jx1rkNE,125..pip-23.2.1.dist-info/top_level.txt,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pip/__init__.py,sha256=

C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.799088463597101
Encrypted:	false
SSDEEP:
MD5:	73C4F1C5F98F6DD6E608649446740E78
SHA1:	658CBB1BF5A5611F84BC0D7512C2A93386288A0F
SHA-256:	A6472D658CD44B8018567E9D27EEF7EBB389662BC5D9EF1103D6FF6418E27F5F
SHA-512:	58AF1C7EB03FEAF157DA8F1D6AA02C01EBA83A3CD72B6F3B12739358F069B7B150ADBAFA6DEFE05218751E5D0E21510514EC5CB4547E641BA9C0015BE94937AB
Malicious:	false
Reputation:	unknown
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.40.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI63482\pip-23.2.1.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	125
Entropy (8bit):	4.076056293998605
Encrypted:	false
SSDEEP:
MD5:	2C4F28524E47E303FA6FE256B00452FB
SHA1:	E24896A4396FE8B9BCDBDBCA060B8834E3A8BCA1
SHA-256:	C60DF980E72DD1A63C4B77ED2EDC1E274BB0DCA040215C96E24FB4271D6B90D1
SHA-512:	C505B26B2B6AF5B124E60593F4B05BEF12D924CF206465BDCE6E0107A757DC0C847F0AD165C215C6A255B11AB23728C3AF1E2A7FA97CA182F9144DBC51D91F79
Malicious:	false
Reputation:	unknown
Preview:	[console_scripts].pip = pip._internal.cli.main:main.pip3 = pip._internal.cli.main:main.pip3.11 = pip._internal.cli.main:main.

C:\Users\user\AppData\Local\Temp\_MEI63482\psutil\_psutil_windows.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	6.398422616773887
Encrypted:	false
SSDEEP:
MD5:	43A66AA75039BFA7AF0D0026A603DDD9
SHA1:	D1DAB6108CFBBAD53E1054144E5C52FC00B508FA
SHA-256:	0F42C8F5EE147C3EE6B2EDCFB91DAF5D6F1209375D97E61C189FC32EAFAC4697
SHA-512:	ADFB1463B2D5A9BF13838B131D0827E17F005533DDA9010EF50874A626D7514C60059A06C01348AD75017E5AB0B5AA955E6A6A2AC4EED0E5422B6F3EB5682D13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........]..]..]..T.3.Q..f..._..f...^..f...V..f...V....._......N..].......Q....\..._.\....\..Rich]..................PE..L....#L^...........!.........^...............................................0............@.........................`...h......h............................ ......................................0...@............................................text............................... ..`.rdata..............................@..@.data....-.......*..................@....gfids..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162320
Entropy (8bit):	6.65421740486783
Encrypted:	false
SSDEEP:
MD5:	187CDD3E6152D56986BB523C3A0F7D3E
SHA1:	ACA59C23E4E4974C37378BC7A2F365467E25C245
SHA-256:	7F22B82BFFB4BD87C8C5DC3357C25B5714264B46CE05F6DC8C1FC4C579DCA5FD
SHA-512:	C0612FB2F5D560055FFB3EC239DD4A8B06EDECE59E1C35AF2DA0E5D142643E6FC22FF4F1255CD620092D59958F758B790331163869480AA416026C374193C952
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P/h.1A;.1A;.1A;.I.;.1A;.o@:.1A;.oB:.1A;.oD:.1A;.oE:.1A;.o@:.1A;.Y@:.1A;.1@;.1A;.oI:.1A;.oA:.1A;.o.;.1A;.oC:.1A;Rich.1A;........PE..L...@.:_...........!................(...............................................Y.....@..........................*..P....+.......p...............`...............&..T...........................8'..@............................................text............................... ..`.rdata...F.......H..................@..@.data........@.......&..............@....gfids.......`.......4..............@..@.rsrc........p.......6..............@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58896
Entropy (8bit):	5.838216038576758
Encrypted:	false
SSDEEP:
MD5:	167EBEFCF1A2CB0CE7F4118FE826F58B
SHA1:	5D532467D78DCC2B63848452C4F600513B4136CF
SHA-256:	112C98099E5E6156A8844C6C39B2136F3146E1F2221C37B9064AB7AF6FDFABB7
SHA-512:	BCD67BF4F7E5ADBD8E06A28FE3F805F79323369FBE3F37D32A513AA0336F6FFD4E1C7D978FA0480742BA1AE5D91CEB2E255E9D7033D00670E738335387F92E22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5H..q)d.q)d.q)d..wl.p)d..wd.p)d..w..p)d..wf.p)d.Richq)d.........PE..L...,.:_...........!......................... ............................................@.........................` ..,............................................ ..T............................................................................text............................... ..`.rdata..T.... ......................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\python37.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3441168
Entropy (8bit):	6.692336437440565
Encrypted:	false
SSDEEP:
MD5:	465089EACED8159EC533E4A37033E227
SHA1:	074596ADAE6F53F33B8297F02E21F6A6F7AC6FF1
SHA-256:	2B29AE140CB9F08AF872ACF9E17F785EF99398EF3367549B55242BC064D6AE40
SHA-512:	55ECA0922074162C22FFF2B4F97BD2972540FA893B9B02B7D9BFA26345186DBBDAF1FBC37A9EBA6366743D0D42FB5BB88E708877DFD57CB02CA4D3A6953CFB81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........->..LP.LP.LP.4..LP..Q.LP.4..LP..S.LP..U.LP..T.LP..$Q.LP.LQ..MP...X.jLP...P.LP.....LP...R.LP.Rich.LP.........PE..L...".:_...........!.........D......-........................................P6.......4...@...........................+......,.\|....`4..............h4......p4.X.....+.T...........................(.+.@............................................text............................... ..`.rdata..<...........................@..@.data...`s....,.......,.............@....gfids.......P4.......2.............@..@.rsrc........`4.......2.............@..@.reloc..X....p4.......2.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\pythoncom37.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	407040
Entropy (8bit):	6.538898063390376
Encrypted:	false
SSDEEP:
MD5:	E7013CC99216383D1722136870282AA0
SHA1:	0596196D7FE24CA6E19D21102275BF6E972DBDEC
SHA-256:	2CFF7BFF664EE5FFD3DD073F08F88FD18C37042B280305465AF8AE6EF2827E76
SHA-512:	2DB3840F5B1D5B3B14D6FAA4B5F4DC7BF8B2B5AD5273C20FD79ABD74FDABDD6A314B84E6EAE8496C38FACF34B13E00C149F0AA05CFC6478D93DE9920B26DC302
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.;u..U&..U&..U&...&..U&g.T'..U&g.V'..U&g.P'..U&g.Q'..U&.].&..U&..T'..U&.].&..U&..T&@.U&..P'X.U&..U'..U&..W'..U&Rich..U&........PE..L......]...........!.....n...........W............ .......................................@.........................@....`..Pl.......`..\....................p..8q.....T...........................(...@...............T............................text...zl.......n.................. ..`.rdata...............r..............@..@.data...0........:..................@....gfids..L....P......................@..@.rsrc...\....`......................@..@.reloc..8q...p...r..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\pywintypes37.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.528675006294188
Encrypted:	false
SSDEEP:
MD5:	FFD5FAC26740C3975AF8112827D724C3
SHA1:	58BDDB3ECD15A04C2B402A7091D9D57325B073F7
SHA-256:	0315EE7826F735A72D2208B46F5CEBB270E5F1FE3104A4B007ACA5C813EEF2A3
SHA-512:	2105388344C8D7B7B48130584186E585E718FE55FEA627C4CD70EAF46D4E8ACF4431F55BF6619F8708589D4D0BA7ECB1B1848AB763C553BADAF33214C12BA73C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%.XyK.XyK.XyK.Q..TyK.6"J.ZyK....YyK.6"H.ZyK.6"N.IyK.6"O.SyK.....YyK.."J.ZyK.....SyK.XyJ..yK.."N.UyK.."K.YyK.."I.YyK.RichXyK.........PE..L...[..]...........!.............................z.......................................@.........................P5...E..dz..........d.......................\....*..T...........................8+..@............................................text...u........................... ..`.rdata..............................@..@.data...............................@....gfids..L...........................@..@.rsrc...d...........................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23568
Entropy (8bit):	6.3163367160293795
Encrypted:	false
SSDEEP:
MD5:	D3BF89184B94A4120F4F19F5BCD128D6
SHA1:	C7F22BB0B957BD7103CF32F8958CFD2145EAA5B8
SHA-256:	568EFDC33F1FCC1AF1D030C75FCCEDC2D9B1FCBF49C239726E2CF49D47ADD902
SHA-512:	1DA8EBF323D170C5E9F6BFBB738E60119CCC690A08234DD23F2D9C1A33519FD4AD154805B012CCA3DC7565BEE672D334CA877AFE2B5211E2122DD6E1CE337971
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'...Fb..Fb..Fb..>...Fb...c..Fb...a..Fb...g..Fb...f..Fb.+.c..Fb...c..Fb..Fc..Fb.+.j..Fb.+.b..Fb.+....Fb.+.`..Fb.Rich.Fb.........PE..L...>.:_...........!...............2........0......................................NL....@..........................5..L....5..x....`...............B.......p..t....1..T...........................(2..@............0...............................text............................... ..`.rdata..8....0......................@..@.data...p....@.....................@....gfids.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc..t....p.......>..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	5.127816565309219
Encrypted:	false
SSDEEP:
MD5:	9A33897F1BCA1160D7AAD3835152E158
SHA1:	A5234543D56E03C950C0080826B53A0CB97671AF
SHA-256:	C32A3AC395AF6321EFD28BE73D06A00F0DB6AB887D1C21D4FEC46128D2056D5A
SHA-512:	0CC71D2F794775FE676B729532C1B5B68777CABC7FB15E0D5F38542A3D4631B211074FF86D69127E2F088CD357161CF0C353F658F640711CDCC821D4D45CB318
Malicious:	false
Reputation:	unknown
Preview:	Copyright (C) 2016 Jason R Coombs <jaraco@jaraco.com>..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	4806
Entropy (8bit):	5.074390567839085
Encrypted:	false
SSDEEP:
MD5:	B1A5FE1EF97DFF973FC6BD12E29CCA96
SHA1:	0ADEAFA53A64DFF6D31A6C4D539547589E5F3025
SHA-256:	86DB60FD0F85E0160DF5E60C21B0296BDD67744EA907B968FE4D38FAFBA20491
SHA-512:	810051E47E41964788C18BE47BBB7970BA5A3E46D4EE9F1B7A5526C50DBC311EFB0D7AEC668C06BE86B542C64DEC5B6CA6C0147CFC20B1962C08F89B6DC8C91E
Malicious:	false
Reputation:	unknown
Preview:	Metadata-Version: 2.1.Name: setuptools.Version: 47.1.0.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.License: UNKNOWN.Project-URL: Documentation, https://setuptools.readthedocs.io/.Keywords: CPAN PyPI distutils eggs package management.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	CSV text
Category:	dropped
Size (bytes):	14567
Entropy (8bit):	5.638860362342843
Encrypted:	false
SSDEEP:
MD5:	E3CBED8C8263F131CC0BB7765E0D1D94
SHA1:	2CB7014FCB28BD192A20BEE48B8AC25D636BB1C8
SHA-256:	D0AB75EBF9D96A6ED61228C9559C4A14D325182D56F5A2CF866BFDE04676E5FA
SHA-512:	52EC7BA87AFA38EF00EF06E04C244CE710CB1ACACD3A2DF692C9340E5132503381E6E82BA671A119B1A9219AC46455E0DD96943D75518BEDF7908CD9ADEA7C26
Malicious:	false
Reputation:	unknown
Preview:	../../Scripts/easy_install-3.7.exe,sha256=Ev_pD0NYe1iWNTc99aqcKwbGWkdiRzIzgOWgohlF9p4,97126..../../Scripts/easy_install.exe,sha256=Ev_pD0NYe1iWNTc99aqcKwbGWkdiRzIzgOWgohlF9p4,97126..__pycache__/easy_install.cpython-37.pyc,,..easy_install.py,sha256=MDC9vt5AxDsXX5qcKlBz2TnW6Tpuv_AobnfhCJ9X3PM,126..pkg_resources/__init__.py,sha256=AiHtsqVRO1T4Sfv_JH2WzHa_EywN1-MaIxEPIe0ky0g,108570..pkg_resources/__pycache__/__init__.cpython-37.pyc,,..pkg_resources/__pycache__/py2_warn.cpython-37.pyc,,..pkg_resources/__pycache__/py31compat.cpython-37.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-37.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-37.pyc,,..pkg_resources/_vendor/__pycache__/pyparsing.cpython-37.pyc,,..pkg_resources/_vendor/__pycache__/six.cpython-37.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/packaging/__about

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.812622295095324
Encrypted:	false
SSDEEP:
MD5:	3662ED125F3B46FE20C083E1CA963F14
SHA1:	CC7241C6AB0641A49B19E711E5E74C86D06A4902
SHA-256:	A78EBFE54873AB3E80CDE4A8B223A7C4AFB39858DAD62DB60AB4028E661EF1E7
SHA-512:	6D47E5E66ECD0FA86089758D6D982697BAF05102E5B9D2538A95EE9576EF3773C5AFEC3EA6DD2378C5FF3B54F945292B6D9362DADE343488DF226049A49450C3
Malicious:	false
Reputation:	unknown
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.33.6).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\dependency_links.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.9593491706048285
Encrypted:	false
SSDEEP:
MD5:	6E8EDE13DB59FBC370572CA72D66E36C
SHA1:	A0BE976BB2269ECB935661972C427CDD70BDCA1E
SHA-256:	1E5902164A0AE536D9E4430B6CB29884B718FC4DF5901583F13A96D848266AD4
SHA-512:	153439FE69A27A5FCEA82162B42FEA5BD88A469B1A853E5FC9DFBF8B6F64CD90B3900DC5683593F1DC97553DAEF4D42857E9437CC4BF05E95C3117619B4BCEB1
Malicious:	false
Reputation:	unknown
Preview:	https://files.pythonhosted.org/packages/source/c/certifi/certifi-2016.9.26.tar.gz#md5=baa81e951a29958563689d868ef1064d.https://files.pythonhosted.org/packages/source/w/wincertstore/wincertstore-0.2.zip#md5=ae728f2f007185648d0c7a8679b361e2.

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	3143
Entropy (8bit):	4.536591833837899
Encrypted:	false
SSDEEP:
MD5:	B7EFFC5DA69B35D6794BA145EC0FE238
SHA1:	BCB0BA6F1E37C84D8616760EA8B555F6DE37CB5B
SHA-256:	D4AE45AF4FB93E1DD945916EC0D6B0F0444688D2D5A87BDD28336DDE85C64BAC
SHA-512:	8DF58FF4BD178241EBFFF00A6135FF1701D85D0FACC18B747E763B9BBE0CCCD2E6D19F067866B2D802693B53DCF9BE9935481E179886D264750FA6693A7C7C66
Malicious:	false
Reputation:	unknown
Preview:	[console_scripts].easy_install = setuptools.command.easy_install:main.easy_install-3.8 = setuptools.command.easy_install:main..[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.bdist_wininst = setuptools.command.bdist_wininst:bdist_wininst.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveop

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.8655768552072494
Encrypted:	false
SSDEEP:
MD5:	C911255B0C11098C6AB7EDF664FDC8B3
SHA1:	C3D3C7436574C24EC30386B6DA3807B01731B671
SHA-256:	D87517555C00E0F7DFD7181316BDC6B135D729A3DA3BABE51BAA0D27FE2EE138
SHA-512:	FEA204772A9F16D91B40A602F0ECA01C75AAC061A7456D94D2E7F6D55F318F2E2FFBB3ABD81D066824E2416E4671AD2A9BADBDB0280C1C9CCEED014B1E05DB30
Malicious:	false
Reputation:	unknown
Preview:	easy_install.pkg_resources.setuptools.

C:\Users\user\AppData\Local\Temp\_MEI63482\setuptools-47.1.0.dist-info\zip-safe

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\_MEI63482\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	985616
Entropy (8bit):	6.750787193290997
Encrypted:	false
SSDEEP:
MD5:	68FCAE2F9BDB38FDFA4E7826A45A494E
SHA1:	8A3C69F5D9140B07A8FCF578CE479CD4B1295003
SHA-256:	9DC0373E28A45187528591A3ED0EABC4C4A2A6D3EEB8E38C3F451FC11D9E5B48
SHA-512:	8E916967FC1995A68DE2CDF878AC4C5A5C16F226D92B78CE1BB30047F9E6834886791CF7B7F03485AEC5AC0D31DBBA28DEEF2354B1B18D58FD798473F12759C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...n...n...n...g.3.b...U..l...U..c...U..e...U..e...5.m...n..........o......o....._.o......o...Richn...........PE..L...L.:_...........!.....0..........o........@............................... ......GM....@......................... M..l ...m..................................P\..@I..T............................I..@............@...............................text............0.................. ..`.rdata..X8...@...:...4..............@..@.data................n..............@....gfids..............................@..@.rsrc...............................@..@.reloc..P\.......^..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1117640
Entropy (8bit):	6.790099637219717
Encrypted:	false
SSDEEP:
MD5:	C61E2D171A51D54A7118745E3689484C
SHA1:	55D47CD4EBEF483C4812B880573362A88857D89D
SHA-256:	903DB0B165960955E9AF1415D1FFF4F395021FA041B49D542491EAA272C94CA6
SHA-512:	DD62D18EC54D67A2E41BD0AD30DB4C4711CD9CF579FB16702300734ED40C7E834EE08E265733159FA42CE9065859B313004B61814E9436B0832120B992A7C02F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0<..t]..t]..t]..}%..G]..t]...].../..u].../..b].../..u].../...].../..*].../..._.../}.u].../..u]..Richt]..........PE..L.....4............!.....,...................@............................... ...........@A.........................^......tb...........................!.........\...T............................"..@............`..p............................text...0+.......,.................. ..`.data...<....@.......0..............@....idata.......`.......@..............@..@.rsrc................V..............@..@.reloc..............\..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063440
Entropy (8bit):	5.335145703200824
Encrypted:	false
SSDEEP:
MD5:	22EE48112415EE74C80B66CC1A8E1CA8
SHA1:	9EB11B06BA0EA22A2F339D0CE300F45F48607D4C
SHA-256:	8F38B8891C74DA4AF150B60D21053CDA95A61881C61B8FFF1C8852885DE8B2AF
SHA-512:	080DA19FCBFCFDD55BCCF231F6F4820204707AE3A08DE7E40CE8E1F87DF1EDD916FD55A37E6560C1E1A6935DDC42D47DCE82AA834A8287B024D907CC9B98B3CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,F..B...B...B......B..C...B..A...B..G...B..F...B.u.C...B...C...B...C...B.u.J...B.u.B...B.u.....B.u.@...B.Rich..B.........PE..L...?.:_...........!.....4...........4.......P...............................`......V.....@..........................Q..X...HR.......@............... .......P.......N..T...........................XN..@............P...............................text...N2.......4.................. ..`.rdata.......P.......8..............@..@.data...(....`.......B..............@....gfids.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32api.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	6.4361136309732165
Encrypted:	false
SSDEEP:
MD5:	86E4FE10195511F403A8C2DE45BB8062
SHA1:	79CD2CC3D5165078145106A284C11B4B85CCB037
SHA-256:	4C28231D0105AF47E3D7C7241B5EC50FCBFB3E8B60D68A0DBE8180BD543B3856
SHA-512:	65A7949EC63D1E1D34093753F05341E51911B74C5C7D4554CF2EE8626333E6460AF0B3A4F5780B7CB3C5E7EDE1410F907F947542383D7660E0AF6AFAB606928C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z.\w..\w..\w..U...Zw..2,..^w..2,.._w..2,..Ww..,..Xw..2,..Nw.....Ww..\w...v..,..^w..,..]w..,..]w..Rich\w..........................PE..L...}..]...........!......................................................................@......................... I.......I..........T...........................pA..T............................@..@...............0....H..@....................text............................... ..`.rdata...~..........................@..@.data........p.......\..............@....gfids..L............n..............@..@.rsrc...T............p..............@..@.reloc........... ...t..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32com\shell\shell.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388096
Entropy (8bit):	6.700427480647071
Encrypted:	false
SSDEEP:
MD5:	88BBC2850F3C74A35DD768605F7BAE02
SHA1:	3C9AE4DFC4C5AE06917B9735BCDE78611FFC04C6
SHA-256:	998E24ED4A8D2840BBEED542B2582CBC7E69996D8A38C7E8DC3FA2A39BDEA2B7
SHA-512:	6CFF11204620A2B09CAC2ACA34B0A37F3CB4BFCAD239727A4E68A2E37C097CDA72F927BA11134F3FC968A8FB218F47618C10FF460CC96E85022B344993D2DBFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.q.!.q.!.q.!..m!.q.!.. .q.!.. .q.!.. .q.!.. .q.!<.0!.q.!3. .q.!<..!.q.!<.5!.q.!.q.!.q.!3. .q.!3. .q.!3. .q.!Rich.q.!........PE..L......]...........!.....$..........C........@...............................`............@.............................I...............D..........................p...T..............................@............@...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...8o...@...8...&..............@....gfids..L............^..............@..@.rsrc...D............`..............@..@.reloc..............d..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32gui.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	173568
Entropy (8bit):	6.42950791869676
Encrypted:	false
SSDEEP:
MD5:	E784B34CA391EE4495DA3CDEB2F97B93
SHA1:	9236ED916AE35D73DD55A074E2DDB1993A5B7A9F
SHA-256:	4E0BF38971FD03795DE66011D6F59D9913817BAF5EA4F386A0187C2633A609AE
SHA-512:	4E1621813C0ABA7188FCFEEF820E2C45A593DD6EE9C99AAEED18EADE4CCCB2E86264338C8831044C5BA7453C0F5588E83D97B2B8202F0B3A9E04BB2E933FCE11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................&............................u......z?~...........u......u......u......Rich............................PE..L......]...........!......................................................................@......................... ..e..............T........................9...!..T...........................X!..@............................................text............................... ..`.rdata.............................@..@.data...( ...`.......H..............@....gfids..L............f..............@..@.rsrc...T............h..............@..@.reloc...9.......:...l..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32process.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	6.286431013062985
Encrypted:	false
SSDEEP:
MD5:	BF174C9368C4FB71BC5741AC6DB9FEAF
SHA1:	DCED12BC182EB8AF95E1ABBFEA04FDACA3091A5D
SHA-256:	A60242ADA93FD9F215B47132C1F05B2666C821114CFBD733EFB2B08CFF27B76D
SHA-512:	B98A84AD170BDDA4B663088C139ACC82E2B19F27FEA760BAF759DDBCD90AF803A535D594C268875BF42C5DF137F61513F83BAF3AAB8F3CD345076EC2643D9997
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~x..............g.......D.......D.......D.......D.......D......................D.......D.......D......Rich............PE..L...p..]...........!.....P...P.......N.......`............................................@.............................W...............d...............................T...........................X...@............`...............................text...PO.......P.................. ..`.rdata...7...`...8...T..............@..@.data...0...........................@....gfids..L...........................@..@.rsrc...d...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32security.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	6.4607057274585875
Encrypted:	false
SSDEEP:
MD5:	0244DA7420CAA3CFB72517D31A3C8396
SHA1:	E4515EFE9DDD49EBC7898B763153A65295F6B5CF
SHA-256:	EEF7C6C4D010C557632C1C6E3E2345BFA53820DBE357AC893235F9DA72C88895
SHA-512:	9A8248C1935B5EEBCC7EF87B16ED7E7A32CFA26B50D9449792E8EBC8A90D31C08682AE5879346BAE54BBB0423D9F4B161A42447F796217D3E331082FEDEE2F2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sqX27.6a7.6a7.6a>h.a1.6aYK7`5.6aYK5`6.6aYK3`9.6aYK2`<.6a.K7`3.6a...a>.6a7.7a..6a.K3`4.6a.K6`6.6a.K4`6.6aRich7.6a........................PE..L...t..]...........!................1.....................................................@..........................}.......~..........d............................r..T...........................(s..@............................................text............................... ..`.rdata..............................@..@.data...............................@....gfids..L...........................@..@.rsrc...d...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32trace.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.767125323911372
Encrypted:	false
SSDEEP:
MD5:	DE4E97F1B623FE3500D184E3255FEEEF
SHA1:	FC4D1EA415326BBA20F731907C71D32503CC3D31
SHA-256:	0DAC5B82544CE0D358CE20599CA2D8159D1BF004DA9224F3788C44EF1A91A3DA
SHA-512:	B34A52FAC8C50D369F4134C2C328A745E7232C6470459C4156F6F6B1EC2476FD53551CD8B02217918396D8413525BE8CB92325BECF829D9CBC0CB4521F8FAE1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............\|X......_......._......._......._......)_......&...............)_......)_......)_......Rich....................PE..L...u..]...........!.....$...$.......$.......@............................................@..........................J..S...DK..........\............................F..T...........................HG..@............@..@............................text...J".......$.................. ..`.rdata.......@.......(..............@..@.data........`.......<..............@....gfids.......p.......@..............@..@.rsrc...\............B..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32ui.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1149952
Entropy (8bit):	5.776088209653105
Encrypted:	false
SSDEEP:
MD5:	E4D758B4BFA5EDAB1DAAB070F79A6233
SHA1:	2BDCA17683F5EF18A5593551CE5A6FDB6A364A23
SHA-256:	DD528DC7146A0CA6C4C210D1F91278926FBEE5EBEDF1144750751FF47CB3188D
SHA-512:	4FA2E552880D217CC24247377DF11B96836F4916200CAC50BD1AEFD2F8F6DF120B6D5E0C1A62CD081D165ED09A035554E6212BA0DA740D4B6734696601DEB459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u8...V...V...V..l...V.>MS...V.....V..OU...V..OR...V..OS...V..OW...V..OW...V...W.6.V..OS...V..OV...V..O....V..OT...V.Rich..V.........................PE..L...T..]...........!................. ............(.......................................@......................... ...2Q..T...h...............................8.......T..........................h...@............................................text............................... ..`.rdata..lI.......J..................@..@.data...d.... ...^..................@....tls.................^..............@....gfids..(............`..............@..@.rsrc................b..............@..@.reloc..8............\|..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI63482\win32wnet.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.152062338900863
Encrypted:	false
SSDEEP:
MD5:	EB7BE654FA6D098BB44D30CEF66915C9
SHA1:	2FA98324E316CC96F1F5DE46372892CD5684CC6A
SHA-256:	6E07E288DFBFEA22B8349B20ED955898B4B1DE9D7EA837985553D813FA13D921
SHA-512:	81CA7F475E3287EE210709527754ACA3AA96B50665C78E4DB1C729E17E9506B0DFDBD16FC31F4A17E8FEF90F929DAB75AAB39AAF8D66786D7941F78AF2DB441C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%T..D:..D:..D:..<...D:...;..D:...9..D:...?..D:...>..D:.d.;..D:.k..D:..D;..D:.d.?..D:.d.:..D:.d.8..D:.Rich.D:.................PE..L...w..]...........!.....6...:.......5.......P............................................@.........................@d..#...di..........T........................... \..T...........................x\..@............P...............................text....5.......6.................. ..`.rdata...%...P...&...:..............@..@.data...0............`..............@....gfids..L............f..............@..@.rsrc...T............h..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4v4wg3ha.yp3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\qtpao_64

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Reputation:	unknown
Preview:	blat

C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Download File

Process:	C:\Users\user\Desktop\decrypt.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16990381
Entropy (8bit):	7.997367905629828
Encrypted:	true
SSDEEP:
MD5:	BE54E01471656F49A38C5FBB1FD55492
SHA1:	1F62AC8D895C136BE12B5FAC3E8E538291E87991
SHA-256:	F7E10A242FB660D948BDF08203194C049B071DCD43C4E66C13F86DBBBCAA4E09
SHA-512:	FF8ED23D9E7DD6661E7383E1BA5C073968F50F4206BD1A4ED9BB3F38B83AD11B2F5DF7D6C5FA18D3F7E2FFBA8B74F96090E7C499828785B2BBE0754C2D5243D6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ..A..A..A....A.....A.....A...8..A.a5...A.a5...A.a5..A....A..A..A.b5...A.b5..A.Rich.A.........................PE..L....%.a.........."..........................0....@.......................... ......ya....@.................................d...<.......X...........................................................8...@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5874e454\gen_py\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.713840781302666
Encrypted:	false
SSDEEP:
MD5:	8C7CA775CF482C6027B4A2D3DB0F6A31
SHA1:	E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
SHA-256:	52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
SHA-512:	19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
Malicious:	false
Reputation:	unknown
Preview:	# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

C:\Users\user\AppData\Local\Temp\tmp5874e454\gen_py\dicts.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	data
Category:	dropped
Size (bytes):	11
Entropy (8bit):	2.9139770731827523
Encrypted:	false
SSDEEP:
MD5:	7D60C03264BFC8080355775EF16397EA
SHA1:	713B57F2F873E930C1FDAF17718749FCDF212961
SHA-256:	48BA2619D546477FD8624E27AFEA42F6CD0A72B1C5435F8B5D40CC082ADBD81C
SHA-512:	00A341DAD0CA02B65B19A9122F242388F6503E382A90651A21B6A16D8867D1D09149C292B0DB8E85A23EB941120749E6853A0392D756DE0141FC4006A847CACB
Malicious:	false
Reputation:	unknown
Preview:	..K....}q..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.999291651537833
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	decrypt.exe
File size:	17'126'992 bytes
MD5:	0a08cc3661a39defcdc182acf62e17e5
SHA1:	580ccc43274151726405797779500f4fe9a0069c
SHA256:	db433f673eeacd8e905cca9ef3b283d30c466ab6afde31e53373197ee5d197fd
SHA512:	f083ccd34621c685bc05094197a8dc2f7d795a124da67eb351c1b89f74848787d9408eca7ed9b0c34f5c0d564bf766842d0cb316bc4b7141a65b397b69a62aca
SSDEEP:	393216:cYvwa/xPKBtFlFk5zb91woDQGQ3bNkpmVqehJGFsxQrnkvDKZwdp5t:H4BNMvbcGAbNZVqnsxQbUDT9
TLSH:	3807335AF5D004F1C5E12C37D935A6C2C437E471EAC44A8F0A1BDF6AA858C578BE9DC2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f..."..."...".......................6.......!..."...~.......7...............1.......#.......#.......#...Rich"..................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401b19
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676C5FDC [Wed Dec 25 19:41:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	eeb9c59be65b5a0861a842d1f49817b3

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	26/04/2024 07:49:24 27/04/2025 07:49:24
Subject Chain	E=huddafoods@gmail.com, CN=HUDDA FOODS (SMC-PRIVATE) LIMITED, O=HUDDA FOODS (SMC-PRIVATE) LIMITED, L=Multan, S=Punjab, C=PK, OID.1.3.6.1.4.1.311.60.2.1.3=PK, SERIALNUMBER=0168969, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	EA00C257C7591CBB2D3B03B8533EF338
Thumbprint SHA-1:	02FED651B2EADA8963E95644141336451C2337A7
Thumbprint SHA-256:	7802DF46CED02B95DE7ED3BCDEDE905DE86063BB916F4CDCDF96B342E45D4050
Serial:	3E47D172255BDBB3E93C5E9D

Entrypoint Preview

Instruction
call 00007FCA49297542h
jmp 00007FCA4929715Dh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FCA492972EBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FCA492972DCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FCA492972DEh
add edx, 28h
cmp edx, esi
jne 00007FCA492972BCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FCA492972CBh
call 00007FCA49297A18h
test eax, eax
jne 00007FCA492972D5h
xor al, al
ret
mov eax, dword ptr fs:[00000018h]
push esi
mov esi, 00420CD8h
mov edx, dword ptr [eax+04h]
jmp 00007FCA492972D6h
cmp edx, eax
je 00007FCA492972E2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FCA492972C2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FCA492972D9h
mov byte ptr [00420CF4h], 00000001h
call 00007FCA4929782Fh
call 00007FCA49297F65h
test al, al
jne 00007FCA492972D6h
xor al, al
pop ebp
ret
call 00007FCA4929CFD2h
test al, al
jne 00007FCA492972DCh
push 00000000h
call 00007FCA49297F76h
pop ecx
jmp 00007FCA492972BBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0Ch
push esi
mov esi, dword ptr [ebp+08h]
test esi, esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f288	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x23000	0x1034188	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1054400	0x1250	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1058000	0x1178	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e730	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1e750	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17530	0x17600	4d5ef9cb5af9d6e8a15704d8b1f84091	False	0.5948466744652406	data	6.649482193956779	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0x69d4	0x6a00	9b93037de380aea158a165def431171c	False	0.4741303066037736	data	5.241989057939991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x1404	0xa00	d601f257916cc483f3395a69ee1bf181	False	0.205078125	data	2.532462717958198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x22000	0xe0	0x200	fbe2a9dec78d8c85aaa8f959b732e981	False	0.248046875	Matlab v4 mat-file (little endian) 4, numeric, rows 13, columns 16, imaginary	1.174631136579321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x23000	0x1034188	0x1034200	50cc8e938460d62201756eaf15239236	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1058000	0x1178	0x1200	e9ffaae3e1492b75c038f6ef4ece8132	False	0.79296875	data	6.466494082879002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CUSTOMDATA	0x23080	0x1034108	data	English	United States	0.962071418762207

Imports

DLL

Import

KERNEL32.dll

Sleep, GetModuleFileNameA, GetModuleHandleA, LoadResource, SizeofResource, FindResourceA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetFileType, CloseHandle, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, MultiByteToWideChar, DeleteFileW, WaitForSingleObject, GetExitCodeProcess, CreateProcessW, GetFileAttributesExW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, CreateFileW, ReadFile, ReadConsoleW, HeapSize, HeapReAlloc, SetEndOfFile, WriteConsoleW, EncodePointer, DecodePointer, RaiseException

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report decrypt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imaging.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingcms.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingft.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_imagingtk.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\PIL\_webp.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_cffi_backend.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_elementtree.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_multiprocessing.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_pytransform.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_sqlite3.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\_win32sysloader.pyd

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-louserzation-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-processthreads-l1-1-1.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-synch-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-core-timezone-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-locale-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-runtime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-string-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\api-ms-win-crt-time-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI63482\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI63482\build.stamp

Windows Analysis Report
decrypt.exe

C:\Users\user\AppData\Local\Temp\tmp5874e454\gen_py\init.py