Edit tour

Windows Analysis Report
decrypt.exe

Overview

General Information

Sample name:	decrypt.exe
Analysis ID:	1582916
MD5:	0a08cc3661a39defcdc182acf62e17e5
SHA1:	580ccc43274151726405797779500f4fe9a0069c
SHA256:	db433f673eeacd8e905cca9ef3b283d30c466ab6afde31e53373197ee5d197fd
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found pyInstaller with non standard icon

Hides threads from debuggers

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: PowerShell Script Run in AppData

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

svchost.exe (PID: 6252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

decrypt.exe (PID: 6940 cmdline: "C:\Users\user\Desktop\decrypt.exe" MD5: 0A08CC3661A39DEFCDC182ACF62E17E5)

conhost.exe (PID: 7012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4360 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

decrypt.exe (PID: 1288 cmdline: "C:\Users\user\Desktop\decrypt.exe" --safetorun -a MD5: 0A08CC3661A39DEFCDC182ACF62E17E5)

cmd.exe (PID: 2756 cmdline: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 4020 cmdline: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

system15627a17808b7546c (PID: 4680 cmdline: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a MD5: 6FCA51D1E24BDCB68A20F6D9A445E96E)

system15627a17808b7546c (PID: 6720 cmdline: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a MD5: 6FCA51D1E24BDCB68A20F6D9A445E96E)

decrypt.exe (PID: 6264 cmdline: "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a MD5: 0A08CC3661A39DEFCDC182ACF62E17E5)

WerFault.exe (PID: 6476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 228 MD5: C31336C1EFC2CCB44B4326EA793040F2)

decrypt.exe (PID: 1172 cmdline: "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a MD5: 0A08CC3661A39DEFCDC182ACF62E17E5)

cmd.exe (PID: 1344 cmdline: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' | Wait-Process" 2>nul MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 2664 cmdline: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' | Wait-Process" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

system15627a17808b7546c (PID: 2504 cmdline: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a MD5: B323B7703CDDDF298773DFA36C9FB533)

system15627a17808b7546c (PID: 3632 cmdline: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a MD5: B323B7703CDDDF298773DFA36C9FB533)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , CommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , CommandLine|base64offset|contains: Xx, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2756, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , ProcessId: 4020, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a , CommandLine: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a , CommandLine|base64offset|contains: }h, Image: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c, NewProcessName: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c, OriginalFileName: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c, ParentCommandLine: powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" , ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4020, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a , ProcessId: 4680, ProcessName: system15627a17808b7546c

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, CommandLine: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\decrypt.exe" --safetorun -a, ParentImage: C:\Users\user\Desktop\decrypt.exe, ParentProcessId: 1288, ParentProcessName: decrypt.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' | Wait-Process" 2>nul, ProcessId: 2756, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" , ProcessId: 4360, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6252, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: decrypt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\pip-23.2.1.dist-info\LICENSE.txt
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI25042\pip-23.2.1.dist-info\LICENSE.txt

Source: decrypt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: www.eventuallogic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\decrypt.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 228

Source: decrypt.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.evad.winEXE@28/70@1/35

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6264
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_762381681
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7012:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ncchiimh.c4p.ps1

Source: decrypt.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\decrypt.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe"
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 228
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process"
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a

Source: C:\Users\user\Desktop\decrypt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\decrypt.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\decrypt.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: pywintypes37.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: security.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\decrypt.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: pywintypes37.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: security.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: ntdsapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Section loaded: kernel.appcore.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: decrypt.exe

Static file information: File size 17126992 > 1048576

Source: decrypt.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1034200

Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: decrypt.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: decrypt.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: decrypt.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: decrypt.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process"

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imaging.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingft.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingtk.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32gui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32security.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\psutil\_psutil_windows.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_webp.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\pythoncom37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32process.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\python37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block\_block.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\decrypt.exe	File created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_cffi_backend.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\_version.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingcms.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\pywintypes37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-louserzation-l1-2-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\decrypt.exe

File created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI46802\pip-23.2.1.dist-info\LICENSE.txt
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	File created: C:\Users\user\AppData\Local\Temp\_MEI25042\pip-23.2.1.dist-info\LICENSE.txt

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1507
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8331
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1128
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2795
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1708
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3108

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imaging.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32trace.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingft.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingtk.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\mfc140u.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32gui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32security.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\psutil\_psutil_windows.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_webp.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\pythoncom37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_elementtree.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32process.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32wnet.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\python37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32com\shell\shell.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block\_block.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_cffi_backend.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\_version.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingcms.cp37-win32.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\pywintypes37.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\win32ui.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-louserzation-l1-2-0.dll	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 6908	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep count: 1507 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep count: 8331 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7076	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\Desktop\decrypt.exe TID: 1284	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2216	Thread sleep count: 1128 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2216	Thread sleep count: 2795 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1228	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\decrypt.exe TID: 3920	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1952	Thread sleep count: 1708 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5208	Thread sleep count: 3108 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2044	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\decrypt.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\decrypt.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Thread information set: HideFromDebugger

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -a
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\Desktop\decrypt.exe "C:\Users\user\Desktop\decrypt.exe" --safetorun -x --channel=1 -a
Source: C:\Users\user\Desktop\decrypt.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process" 2>nul
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe "Start-Process -FilePath \"C:\Users\user\AppData\Local\Temp\system15627a17808b7546c\" -NoNewWindow -ArgumentList '--safetorun','-x','--channel=1','-a' \| Wait-Process"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Process created: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c "C:\Users\user\AppData\Local\Temp\system15627a17808b7546c" --safetorun -x --channel=1 -a

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4-3.1.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4-3.1.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\ucrtbase.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\pyexpat.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_hashlib.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\win32api.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\pythoncom37.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\win32com VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\win32com VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\win32com VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\ugx49rj2 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp07v8c5ym VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\Desktop VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\psutil VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\psutil VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\psutil VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\psutil\_psutil_windows.cp37-win32.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\win32gui.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\win32process.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp07v8c5ym VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp07v8c5ym\gen_py\__init__.py VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp07v8c5ym\gen_py\dicts.dat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\win32security.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_queue.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\unicodedata.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imaging.cp37-win32.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_sqlite3.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\_version.cp37-win32.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block\_block.cp37-win32.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\default_s.json VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\default_s.json VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\build.stamp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\build.stamp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\build.stamp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\default_s.json VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\certifi\cacert.pem VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI46802\certifi\cacert.pem VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\tmp07v8c5ym VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\PIL VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\lz4 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\cryptography-42.0.8.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\lz4-3.1.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\lz4-3.1.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\pip-23.2.1.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\setuptools-47.1.0.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\ucrtbase.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI25042 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c	Queries volume information: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	11 Process Injection	21 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	132 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	132 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imaging.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingcms.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingft.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingtk.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_webp.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_cffi_backend.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_elementtree.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\_win32sysloader.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-louserzation-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\_version.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block\_block.cp37-win32.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\mfc140u.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\psutil\_psutil_windows.cp37-win32.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\python37.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\pythoncom37.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\pywintypes37.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32api.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32com\shell\shell.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32gui.pyd	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32process.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32security.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32trace.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32ui.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI46802\win32wnet.pyd	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
p-9999.p-msedge.net	150.171.85.254	true	false	unknown
t-9999.t-msedge.net	13.107.246.254	true	false	unknown
www.eventuallogic.com	104.21.16.1	true	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	www.eventuallogic.com	United States	13335	CLOUDFLARENETUS	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
52.182.143.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582916
Start date and time:	2024-12-31 21:25:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	decrypt.exe
Detection:	MAL
Classification:	mal56.evad.winEXE@28/70@1/35
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: decrypt.exe

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_decrypt.exe_1c69db41e74d944dfe4996f39dffe8a77355566_011ae4ae_91deea0b-35bc-4e95-82fc-dce9287c4a64\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6258162055453143
Encrypted:	false
SSDEEP:
MD5:	812242E7446C30AE147934544356772A
SHA1:	4F9E0E57A23E315360F0A94DC67A0D60F8B0719D
SHA-256:	889B758F393AE4C0CB117D6F9B7C3155DA9C9F742F8EA50DF1A2A9D2D96A5651
SHA-512:	45AD775D060C4296E3B6C5DCF3EC8F31B79FCBD39319E32E10628E5B1DC0C44D5FCD0EE4EBD80A99056FE26E8A64080B388DD6BB6D1EF97D03AE989A4E6F5F34
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.1.5.0.4.2.7.0.1.1.9.9.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.1.5.0.4.2.7.3.4.7.9.9.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.d.e.e.a.0.b.-.3.5.b.c.-.4.e.9.5.-.8.2.f.c.-.d.c.e.9.2.8.7.c.4.a.6.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.9.7.f.9.2.9.6.-.d.4.6.4.-.4.9.9.b.-.b.4.1.1.-.a.2.2.c.5.d.f.f.6.7.3.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.e.c.r.y.p.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.7.8.-.0.0.0.1.-.0.0.1.6.-.9.3.8.5.-.e.6.5.b.c.2.5.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.6.9.8.9.9.b.a.7.b.0.d.5.b.5.8.d.0.d.5.8.5.d.a.a.7.8.9.f.4.a.b.0.0.0.0.f.f.f.f.!.0.0.0.0.5.8.0.c.c.c.4.3.2.7.4.1.5.1.7.2.6.4.0.5.7.9.7.7.7.9.5.0.0.f.4.f.e.9.a.0.0.6.9.c.!.d.e.c.r.y.p.t...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78A5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 31 20:27:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42670
Entropy (8bit):	0.9887665097540442
Encrypted:	false
SSDEEP:
MD5:	44AC5BC0F4D114D6FED4E16478E2B8F4
SHA1:	69BE97D394E6F00551843E0332B8827E36F28E2D
SHA-256:	3DDA8F83B156E3C37DF45FC96E04CA57A729A9A901079750517CB465C0723D3A
SHA-512:	FAA3CEAC2A1510E555E9C2E2E147B8B2FDF6CA10B1E839BE177E7DD7682309D16DC8765F43635C2A99682C57C9515B9BA7DAA8BD155FC1CDF1C8D238A5A12431
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ........Stg............4........... ...<.......T...............T.......8...........T...........8...v...........\...........H...............................................................................eJ..............GenuineIntel............T.......x....Stg............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78F4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8354
Entropy (8bit):	3.689974316139615
Encrypted:	false
SSDEEP:
MD5:	4359CA1E9429A2433B3D4F4C0FD01DB0
SHA1:	25A2C5912BA0CB4E05ACFFE73040EB570F161AB8
SHA-256:	D938E143E4D1E239547DDD1468D61C2F9A4B67B1C4B8CDC9C390A6C58798766B
SHA-512:	CB0FA6AD2F3FC31AC2EB750FD227A102F803BCF6950DA64BA6A961B6EFA912A47B114710E7FC477A65D283BF7393D4E9EF5C76BCE43B13B083406050C17B7964
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.2.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7924.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4665
Entropy (8bit):	4.429126624543386
Encrypted:	false
SSDEEP:
MD5:	B79DF6B1077E6E130824CB7C8E5AEC24
SHA1:	808A854049EDB0B7C829FA27A517CC49F8B75A17
SHA-256:	9C9F76718D19462E45AD29FE38E34C905C37B4BE8B2FD737CF0F627390711FA0
SHA-512:	DC9D669AB46F19BA8A28FE88A19E2053EB3310AC25AF7564E2463491B064CBBC995872CD31E9599825F581608F895C62176C874450BD6EDAAAB53801F5C454E7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="655889" />.. <arg nm="osinsty" val="2" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11887
Entropy (8bit):	4.901437212034066
Encrypted:	false
SSDEEP:
MD5:	ED30A738A05A68D6AB27771BD846A7AA
SHA1:	6AFCE0F6E39A9A59FF54956E1461F09747B57B44
SHA-256:	17D48B622292E016CFDF0550340FF6ED54693521D4D457B88BB23BD1AE076A31
SHA-512:	183E9ECAF5C467D7DA83F44FE990569215AFDB40B79BCA5C0D2C021228C7B85DF4793E2952130B772EC0896FBFBCF452078878ADF3A380A6D0A6BD00EA6663F2
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14480
Entropy (8bit):	5.574321126357558
Encrypted:	false
SSDEEP:
MD5:	045897EFA7D675294BD96982DEDE988C
SHA1:	F1DEF4DBB8475916AA1D5BDE2B218F6DE3F68966
SHA-256:	DF37FB4E1F03EF81EBA97FB655E9E0BBDBC0F6633354A3FCB3DB343D88B27B52
SHA-512:	B3D32479F70F80686F9C6A0218CF150FA194911D07B9975664A4C14B9F72FA2CBCBF732664E40D0BADE6B20F5058EF72407F28E3426966861583988102F8DEC0
Malicious:	false
Reputation:	unknown
Preview:	@...e.....................}.B.5.......y.........................H...............o..b~.D.poM...&..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation4...............<."..Ke@...j..........System.Core.0.................Vn.F..kLsw..........System..4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4..................~..2K..}...0........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementD....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imaging.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2082816
Entropy (8bit):	6.567717827073153
Encrypted:	false
SSDEEP:
MD5:	AFE20FC751526737378ED0310AF781B1
SHA1:	8C59B0E292A1BEE61893BD12B119B4401E4EB32B
SHA-256:	6054FB12513A29607FFB0506C89F25B968B67EB76695E388B4497AF46D901931
SHA-512:	4CC4F285D37F91D781C365744723F3EBB9E4B4A6D12A67656CBA5CAB3827DFB4C95973A4367064A1E6BD8E804E719D2F90C15F9053F5D86F6776216B2D589641
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.H.............vZ......r.......r4......r.......r.......r.......P.......v..........\...fr..W...........fr......fr......fr6.....fr......Rich............PE..L.....'d...........!...".............X....... ............................... ...........@.............................\...........p..........................p...........................@.......P...@............ ...............................text............................... ..`.rdata....... ......................@..@.data............p..................@....rsrc........p.......&..............@..@.reloc..p............(..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingcms.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	205824
Entropy (8bit):	6.411279259678849
Encrypted:	false
SSDEEP:
MD5:	7AB5744A4C4F76D09E21F00AEF17D010
SHA1:	076CF87AC3EB0B7D19CA9E7041C6DB5AD56CE9D2
SHA-256:	4D4C6A9FDACA824EF54E012EC5F6002101F8C45D8349F29CBD961DADD1289E02
SHA-512:	F969F871D2F3DDA7CC8E5A5AA70285B745DA15391A5C8E77D5E273EDCFEE2A4FA34D317B4C9B0A42E3A754C7F28F73FEB4496FA6C8A690830423CC6E55CE73D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2D..v%.v%.v%..]_.x%.9Y.t%.9Y.z%.9Y.\|%.9Y.r%..{.t%.=].q%.v%..%..Y.`%..Y.w%..Y3.w%..Y.w%.Richv%.........PE..L.....'d...........!...".t...........P.......................................`............@.........................P...`............0.......................@..........................................@............................................text....r.......t.................. ..`.rdata..F\.......^...x..............@..@.data....8.......6..................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingft.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1506304
Entropy (8bit):	6.951077426563325
Encrypted:	false
SSDEEP:
MD5:	3F3BB3141ABF74A7D003181A838CF4BB
SHA1:	6FA19A3410FDA9233F84FC6EEF6066D4D1C93254
SHA-256:	3944FCA6611A0A81C19028529A2C53A5A544B1F303A02DABCB63AD2501F11865
SHA-512:	567A76861A5C6A376F431F0768E1BF77C5F415FEC6EBEB98351CB7E394274FC03EC1709FAE9457A50B3270EE9CBDA6AFE8FF3D16A376F53A8756C3FFE1E84BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........!...@..@..@..8@.@...<..@...8..@...<..@...<..@...<..@......@..@..&@..k<..@..k<..@..k<..@..k<..@..k<,.@..k<..@..Rich.@..........................PE..L.....'d...........!...".....t.......B.......................................@............@.........................Pt..`....t..................................Lm...Z..............................0Z..@............................................text............................... ..`.rdata..............................@..@.data.... ...........p..............@....rsrc...............................@..@.reloc..Lm.......n..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingtk.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.58620478100912
Encrypted:	false
SSDEEP:
MD5:	BBBF64975FDA7A2C91BD39FF0F3AAA3F
SHA1:	F6FA8AD53FAE178BD51FC31D4B58B24057D431E8
SHA-256:	8B5D6EBA5BD8D43088EE0C768A5A5BF583A8254F2A84F4E0D4B2A8517872574C
SHA-512:	888B5CD50AF5B90E9054A2CC0F2156C73F5748A40EEA9826C58472A5F23B451007C47CDC7BD8A07D7A5651613381D3850EBD92D5E47356AC27EF622D48BAF538
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8...Yk..Yk..Yk..!...Yk.%j..Yk.%n..Yk.%o..Yk.%h..Yk.}.j..Yk.!j..Yk..Yj..Yk..%c..Yk..%k..Yk..%...Yk..%i..Yk.Rich.Yk.........PE..L.....'d...........!...".....................0...............................p............@.........................@5..`....5.......P.......................`..t....1...............................1..@............0...............................text............................... ..`.rdata..4....0......................@..@.data........@.......(..............@....rsrc........P.......,..............@..@.reloc..t....`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_webp.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	426496
Entropy (8bit):	6.671010476118301
Encrypted:	false
SSDEEP:
MD5:	6A25D234F9834108276D70E36E6A4BF0
SHA1:	74DF712F21CF1134EC35795D548B3CE0154B5B73
SHA-256:	91ADBA8C77B15BF6BD6BA2A5A2D32F2660FDAF08CBD21234AA8D94EE79588317
SHA-512:	D61A0D4CC4F17233242CCBA67E02ABF5C94C047AD2C68F0F851C89159DA6DDBEFC10BED2F9641B91A601FFB66763067C3B3316190635560B6B22531C6ED3C73D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K..K..K..B.P.A.....I.....I.....G.....A......A.....H..K..............J.....J....<.J......J..RichK..........PE..L.....'d...........!..."..................................................................@......................... T..T...tT..................................$#...O...............................O..@...............8............................text............................... ..`.rdata.............................@..@.data....-...`.......R..............@....rsrc................\..............@..@.reloc..$#.......$...^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83768
Entropy (8bit):	6.846131048807189
Encrypted:	false
SSDEEP:
MD5:	AEAB74DB6BC6C914997F1A8A9FF013EC
SHA1:	6B717F23227D158D6AA566498C438B8F305A29B5
SHA-256:	18CCB2DD8AF853F4E6221BB5513E3154EF67AE61CEE6EC319A8A97615987DC4B
SHA-512:	A2832B7720599361E2537F79A2597ACB1A2D5633FDFE20A0D1075E9457683FDB1D5676D121C0BF1A825FF99512DCD924254F1151B50AAE922ACC0CC10F461036
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..'...'...'....Yf.%.....>.,...'...........7.......4.......#.......?.......&.....R.&.......&...Rich'...................PE..L......Z.........."!........."...............................................P............@A........................P................0..................8?...@..p.......8...............................@............................................text...d........................... ..`.data...d...........................@....idata..............................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc..p....@......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78352
Entropy (8bit):	6.573806249816513
Encrypted:	false
SSDEEP:
MD5:	1C52BA084A3723940C0778AB5186893A
SHA1:	5150A800F217562490E25DD74D9EEAD992E10B2D
SHA-256:	CB008E0A6C65DDB5F20AB96E65285DEE874468DF203FAEAFCA5E9B4A9F2918DC
SHA-512:	B397508607A1C7CCEF88C6A941398F78BA4F97CF8A32F40764673DB34C20EEA61364148260D87014348613EB07E959A043B505702437E33927249899BF4522B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w.L.w.L.w.L..EL.w.L.).M.w.L"..L.w.L.).M.w.L.).M.w.L.).M.w.L.).M.w.L...M.w.L.w.L.w.L.).M.w.L.).M.w.L.))L.w.L.).M.w.LRich.w.L................PE..L...G.:_...........!.........N......g........................................P......j.....@.............................H............0.......................@..........T...........................H...@...............l............................text...d........................... ..`.rdata..$(.......*..................@..@.data...H...........................@....gfids....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_cffi_backend.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146944
Entropy (8bit):	6.589957123008936
Encrypted:	false
SSDEEP:
MD5:	D27BFA7C8CEC41DB8C3804EEA65EC98C
SHA1:	7A118AD2572694A74F4A251CA13450E03B8C1B71
SHA-256:	0EB9B80039D4A1BC55070D453056E1C894A8A8F5981CE436CFE0B17E388448D0
SHA-512:	30FE05F78B559F27735FAB71D3DE96EB489E74A0D254DA6EE5A1CDB7E907FD63E5470133D2E452E881A22549617A0A0DC3E29171D04C24F57DAEEBFCBBB07F33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..j2..j2..j2......j2...3..j2.d....j2...7..j2...6..j2...1..j2...3..j2.m.3..j2..j3..j2.^.:..j2.^.2..j2.^...j2.^.0..j2.Rich.j2.........PE..L....._...........!.....X...................p............................................@.........................@\|..d....\|.......`.......................p.......x...............................x..@............p...............................text....V.......X.................. ..`.rdata..R$...p...&...\..............@..@.data...P...........................@....rsrc........`......................@..@.reloc.......p... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	104976
Entropy (8bit):	6.530545672144021
Encrypted:	false
SSDEEP:
MD5:	10861D3FA19D7DC3B41EB6F837340782
SHA1:	B258D223B444AB994EC2FEC95ACAA9F82DC3938C
SHA-256:	6255BAB0B7F3E2209A9C8B89A3E1EC1BBC7A29849A18E70C0CF582A63C90BED1
SHA-512:	EC83134C9BCE9CEDEEE8EBDB8E382FB7F944A7BC9D3BB47C7E3144EF2EF95114A36AC1CC8C0D52F434EE4C359D938A2D7C035E699C4407DF728E200DE7DA4AF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qf..5...5...5...<.j.3....Y..7....Y..3....Y..?....Y..>...Y..7...no..4...no..2...5.......Y..<...Y..4...Y..4...Y..4...Rich5...........................PE..L...7.:_...........!................................................................}.....@..........................3......t4......................................./..T...........................H0..@...............x............................text...4........................... ..`.rdata..nJ.......L..................@..@.data...p....P.......>..............@....gfids.......p.......X..............@..@.rsrc................Z..............@..@.reloc...............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	218640
Entropy (8bit):	6.788259121874902
Encrypted:	false
SSDEEP:
MD5:	5596249B64C074374EAA1D4084E336C3
SHA1:	3748F6FF018C50913379B562E776F739E2A25A1F
SHA-256:	673BD4CACF3B5F8DA67C9C84E03E238961CA98683483DE78D0A6410200F7ABA6
SHA-512:	075438583BE8C186402BBFDC2EBB931F849D774D808ADE6DDEB55E1EA86646824560F1C981E859B55E71192F2D7E349CA967D61DDA0F3BD8081B329D2821C3F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......YU~I.4...4...4...L...4..&j...4..&j...4..&j...4..&j...4...j...4..F\...4...4...4...j...4...j...4...j...4...j...4..Rich.4..........................PE..L...6.:_...........!.....h...........j.......................................p......7[....@.........................@...P............@...............<.......P..H...P...T...............................@............................................text....f.......h.................. ..`.rdata..`8.......:...l..............@..@.data...pj.......h..................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..H....P... ..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_elementtree.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163344
Entropy (8bit):	6.648537488183864
Encrypted:	false
SSDEEP:
MD5:	390552274C5F71C7EBD1F343BB74446C
SHA1:	E6285B1B7BB06126F9E61791175FACCA21C03FEC
SHA-256:	D6C7EA93CDEFE1973239A3DEC0F49A1027E943F1DE07E21FF378978CC6A438BC
SHA-512:	E2135848220F3D9FF36023B2121B6E7B52224FCAFDF260530ADE96A788F2F2A11A7179AE59986EB7F6E850C829CB8CED600E25A788344FA72E07773429FA1B43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s... ... ... ..r ... ...!... ...!... ...!... ...!... ...!... ...!... ... /.. ...!... ...!... ... ... ...!... Rich... ........................PE..L...:.:_...........!................x.....................................................@.........................@'..X....'.......p.. ............d..............P#..T............................#..@...............p............................text............................... ..`.rdata...G.......H..................@..@.data........@.......*..............@....gfids.......`.......8..............@..@.rsrc... ....p.......:..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32272
Entropy (8bit):	6.427179434799816
Encrypted:	false
SSDEEP:
MD5:	4F51ED287BBAE386090A9BCC3531B2B8
SHA1:	26BD991AE8C86B6535BB618C2D20069F6D98E446
SHA-256:	5B6DA4B43C258B459159C4FBC7AD3521B387C377C058FE77AD74BA000606D72E
SHA-512:	2EB2CCD8E9C333B5179CF8F9FD8520CB3D025E23A10DCA3922E28521CFB9A38F9DD95F5D4F2784643EED08925D9008E5238FF9F93BDD39EE55414131186EDFF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.Q./l?./l?./l?.&...-l?..2>.-l?..2<..l?..2:.%l?..2;.$l?.2>.-l?.t.>.-l?..>.,l?./l>.yl?.27..l?.2?..l?.2...l?.2=..l?.Rich/l?.................PE..L...C.:_...........!.....,...8.......,.......@......................................61....@..........................L..P....L..x....................d...............H..T............................I..@............@..l............................text...L*.......,.................. ..`.rdata..<....@.......0..............@..@.data...P....`.......H..............@....gfids.......p.......P..............@..@.rsrc................R..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	146960
Entropy (8bit):	6.957798612342108
Encrypted:	false
SSDEEP:
MD5:	F91A9F1F2EFEE2F5DBAE42EA5D5D7153
SHA1:	2575CC77B51CB080FCEED9810A9F4B2903AE1384
SHA-256:	1F82BB06C79B6B392C92CAD87FFA736377FA25CD6D10DA8D61441D42C0D0101E
SHA-512:	DF1DFB8C8CEE3496A60EEEB6F0D3FE48E1DE8AF5D04667F9A3124B769E8EDD886CC46E6E4D4B277EE5D30F9F70F6F8C755097DDD996573A6817A5BB335DE919F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+..E...E...E......E...D...E...F...E...@...E...A...E.1.D...E...D...E...D...E.1.M...E.1.E...E.1.....E.1.G...E.Rich..E.........PE..L...V.:_...........!.....r..........Js.......................................`............@.............................L.......x....@...............$.......P..D.......T...............................@...............d............................text...fq.......r.................. ..`.rdata...}.......~...v..............@..@.data...............................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..D....P......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25616
Entropy (8bit):	6.307253811483999
Encrypted:	false
SSDEEP:
MD5:	05AB494CF791A50E4F8D2FFE1D3E1F3C
SHA1:	BB10CB1547CA996575000424026D88D095CB14B4
SHA-256:	4959342924E22B6A16EBC5C1ED39552E981515401EDA770E4AC87FD12ACF53F8
SHA-512:	0D0608B152482CB6E33C1ECE40AE8F00FF5360750627494AD5268C90C74DA22984B468674D2E959FAE098615761C1BE00E84862EF7B489C276345AA8292F2CA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'S..c2.c2.c2.jJv.a2.Xl.a2.Xl.b2.Xl..h2.Xl.h2..l.a2.8Z.f2.c2.,2..l.a2..l.b2..l..b2..l.b2.Richc2.................PE..L...8.:_...........!.........................0............................................@.........................p9..`....9..x....p..(............J...............5..T............................5..@............0..P............................text...l........................... ..`.rdata.......0....... ..............@..@.data... ....P.......4..............@....gfids.......`.......8..............@..@.rsrc...(....p.......:..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1370638
Entropy (8bit):	6.906692628236274
Encrypted:	false
SSDEEP:
MD5:	15E7CB63F96E358969B79978F743A644
SHA1:	B7BFB753DE73D1EAE5FDBD62F5CF80B0C90BEF2E
SHA-256:	677F1B68A907B2F1A6B1999D0AB6A4FB8076D230F45FB90ECEEE858191196A37
SHA-512:	4245D9DFE9D0F3E60F4D0BECD9FDDA1EED6E135149CB035E519AC7BE4ACAACD7469B66D8B25D9980CAEC46B5D96CB371DC4446E39380F17552CD5D71735C9C53
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@..`...........#................`........ ....th............,............................. ......................P..+....`...................................Q..................................................`b...............................text...D...........................`.P`.data...L.... ......................@.`..rdata....... ......................@.`@/4......<...........................@.0@.bss..................................`..edata..+....P......................@.0@.idata.......`......................@.0..CRT.........p......................@.0..tls.... ...........................@.0..reloc...Q.......R..................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24592
Entropy (8bit):	6.35292645491841
Encrypted:	false
SSDEEP:
MD5:	234F63AE981F5A8E87DBABDA8CEEA32A
SHA1:	528EA2CF3D7622AA9BF9C038C91DF4E369C9924A
SHA-256:	3E1304AFDCD900748F62D15F93005E65457B9466454E322D065852603C510AC8
SHA-512:	A7308FCDAE88EFC2F7BDB9AC98350FC50E63B4807F3B1F98F07B789B22D56EEA7BFBAF7CB43886542D0B3C7DD8882D0107AD40081220765A5003635A4CF3C678
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W...9..9..9....9..8..9..:..9..<..9..=..9...8..9...8..9..8..9...1..9...9..9......9...;..9.Rich..9.................PE..L...;.:_...........!.........,...............0......................................8.....@.........................p6..L....6..d....`...............F.......p.......2..T............................2..@............0...............................text...l........................... ..`.rdata..\|....0......................@..@.data........@.......,..............@....gfids.......P.......4..............@..@.rsrc........`.......6..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66064
Entropy (8bit):	6.549494681327337
Encrypted:	false
SSDEEP:
MD5:	B3AF79BBFD7D5C5285660819792A3A9C
SHA1:	1FA470B280AB5751889EAA7BDB7BA37FF1270A06
SHA-256:	EB6132B253C40D7C3E00B2BBB392A1573075F8BBC0B2D59E2B077D2CFE8B028C
SHA-512:	DAC7DA4CD493C0753D477DA222C9B1E8C2486A4B6587C7CEA45661192F2D51316B6E6F3951FFBBCB83952E51AB61CC79326BEACB3D5E8637D13F2831E093F124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.zX.u...u...u.......u..4+...u..4+...u..4+...u..4+...u...+...u..T....u...u...u...+...u...+...u...+...u...+...u..Rich.u..........................PE..L...D.:_...........!.....j...~......Pl....................................... ............@.............................P...`...x...................................0...T...............................@............................................text....i.......j.................. ..`.rdata...*.......,...n..............@..@.data...x5.......2..................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65552
Entropy (8bit):	6.488208820143906
Encrypted:	false
SSDEEP:
MD5:	218DA11C9B2295D5C645ECB7629CD44D
SHA1:	0E3337A9D9AC67D214F7C2067B21002A8A3D158D
SHA-256:	5987B2FCCA0698710F3572F222A6AEF3EFD9A6A32C002A11DD33C816BD9B58D8
SHA-512:	0FFB6DFA22ACF3E459D47BFD2E0A979D1AF6A577B9AC44E9B81F6E85A01EBE0DD33E436621BD355B145E05FBDEA504F7040D14F539277D8BF2C354968885CD46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.lO..?O..?O..?Fd5?I..?tB.>M..?.a?N..?tB.>M..?tB.>D..?tB.>D..?.B.>J..?.t.>M..?O..?...?.B.>F..?.B.>N..?.BY?N..?.B.>N..?RichO..?........PE..L...Q.:_...........!.....z...l......nz....................................... ......w.....@.............................P..............................................T...............................@...............p............................text....x.......z.................. ..`.rdata...9.......:...~..............@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	100880
Entropy (8bit):	6.5665910578271935
Encrypted:	false
SSDEEP:
MD5:	2825BAE93CD459D835B74892C9BD80DB
SHA1:	C7AB0C88489E5EB8E920EBC9871C969768BD4739
SHA-256:	AF4379FDC8BD41F7A8A4B509DE949202CCDB5E4825797D7A5DDDD5E77671382C
SHA-512:	FE5D9C3FF4469647AFD20FFA43EBFDADA0516576117C51D03EB8960A81516425FD110E2F6978CF98D279E3912C2A9C1D42C4C39900E183B1F08C2272ECEB00B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l...l...l.......l...m...l...o...l...i...l...h...l.5.m...l...m...l...m...l...m..l.5.d...l.5.l...l.5....l.5.n...l.Rich..l.........................PE..L...N.:_...........!................................................................2.....@.........................p...d............................p..........P.......T...............................@............................................text.............................. ..`.rdata...p.......r..................@..@.data....;...0...8..................@....gfids.......p.......J..............@..@.rsrc................L..............@..@.reloc..P............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\_win32sysloader.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.443206663079606
Encrypted:	false
SSDEEP:
MD5:	140C1DB69DEC5F00A4D0E907E8F80C15
SHA1:	1A6F616B47E32EF0C232B996FB095A47EB0FBDD4
SHA-256:	B77065DF8C8969EA88DBE97C631478171BC0E0D8289A663E357A2593C6F06A87
SHA-512:	9B97A42DDBBF114F7D943A8C0EF793310C45EC1D4DC2DB24E2622CBE9A68FD7A88C3DA60F4C5A6E0FD1B4CFB9111AC73AF37C897D4D618B9B6F6EEAA437F5B75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................v]..................................................Rich...................PE..L...z..]...........!.........................0....;.......................................@......................... 5..]....5..d....`..l....................p......@1..T............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@....... ..............@....gfids.......P......."..............@..@.rsrc...l....`.......$..............@..@.reloc.......p.......(..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11712
Entropy (8bit):	6.639611685011818
Encrypted:	false
SSDEEP:
MD5:	795CA04BC4F20F95AAD05AB330DC2CE3
SHA1:	5438E697E92B325A48E2A3E4C9F814BD02010C65
SHA-256:	AAB2744EFF9E83ACD48CDBA96CE7CAEB78AF7B13656ABCFAFA9E511AC46EE6AB
SHA-512:	8E69A2836FA389820BCFA4A62D135AD0AB4AA07586CBC231B57F9DFDD6B4DDFA5229F673C7EC7D1086E99EA0AFB4C3550E5057E3C2D124B40BDB50494A40BF22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...@.E............!......................... ...............................@......6l....@.........................`...L............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	6.747657141195362
Encrypted:	false
SSDEEP:
MD5:	7BBD3E20A9B7512195887E1765601C6D
SHA1:	F6AF00E247C3520E8EDC90C26C5F7D9DED45DDD2
SHA-256:	BCA4926B90C5EC619F268ABB0872DD33796A00F884442E4AF2F83CB51C9A3A72
SHA-512:	9F3F1F1FEACDED3BB6FC18AF483C8500097F8E42DA8647E899A8A621FC4C89DCE1BEA1C9A69F4B43CD6DB2745EBBD15F95D92031BFEF440DE2D67202C650D815
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...X./^...........!......................... ...............................@......d!....@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-louserzation-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14800
Entropy (8bit):	6.540659692736027
Encrypted:	false
SSDEEP:
MD5:	952ABD24420129B6041B4A05907D7D23
SHA1:	9FB7FD928A64B4E2756DEABCC54D591F99AA9FB3
SHA-256:	2B133BFF971893B180DE3E8405BDF86317A890F4BE77C191500E26A1BF547391
SHA-512:	74F7B853356AA380A496B5ADE5942A35F5C48368A39077923D5DDB7BAE807E1853D91DEC846AD443598F79398BE1A7FCCC664E7688694FDF562AB7E22B1EBE75
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...Tv.,...........!......................... ...............................@............@.........................`................0...................!..............T............................................................................text...'........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.666200722335897
Encrypted:	false
SSDEEP:
MD5:	A0CD566D4FBC43644E840F9F739C02B7
SHA1:	AFCFE88F450A46F799F290FB5861390BA78793B6
SHA-256:	2AE2F4FDEEAE0D2A8FE2633D2FABB8839F2A14BDE7265F6FEE82C8363511E673
SHA-512:	EC3CDD69F0989BF30357B743245BBEDAD9498EA81C1C7219F6828F950ACDD96D6241B488462F955DA71C1494111108BCEFCF118090607E7AE6606B1D3B5D7C38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.../H)............!......................... ...............................@......%.....@.........................`................0...................!..............T............................................................................text...:........................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12240
Entropy (8bit):	6.720689902700417
Encrypted:	false
SSDEEP:
MD5:	D092B16408DA90472C47A33A78445F79
SHA1:	40C7E0FBFC79DC9A9059F1A213BE2508885B788D
SHA-256:	859ED3BD541D304BF67EA511E1D9B5539A75B60EBDF6BABEBA61AF0EE1A59314
SHA-512:	E28FEAF4F4A4B0190A06EE88472157AF3710471F4CD2BCA45F89DB5BC9802612041FCC58F91EE0BC15E74874053D7AB2F09C8176210F545EFBA55C3EC313F816
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L....dML...........!......................... ...............................@.......d....@.........................`...v............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12224
Entropy (8bit):	6.714916839772615
Encrypted:	false
SSDEEP:
MD5:	7992D065117BFDB7CC29703F78A981AA
SHA1:	F046E288BFCBC88BE0649F16041D5EE133E4F697
SHA-256:	4762DFE93CC5F41960090B58E31DED93894F2995189CC38151D4A2F69BF8D039
SHA-512:	DBCE4E52E2BE1886F36793A33228F4755040B4119E8A7B18DE5773718AE45472BBFED550F8FFF2032F243C53BAB026D9DFDA4915E1E5DBFFB34A4E51372D996B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!......................... ...............................@......l.....@.........................`...E............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12232
Entropy (8bit):	6.711773385437227
Encrypted:	false
SSDEEP:
MD5:	817197F0DFB1BDBD4F3458E68E4E5053
SHA1:	ACFC4BD77F4663AE7111D614E7037677A202FEF0
SHA-256:	12CDD3C701FE41B736449643EC4E4511D4522C73825B38019A1E58E7D0D54181
SHA-512:	2BDE3AB7E7C107B3ACEA53FB66417345D96E459DFFFE8A196767ADBAFAEF40F959B2516AB5BA6E6F4B3E258CAB9CD2B10A9BC045D67C0A26E0310F6AA49E904A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L.....M...........!......................... ...............................@............@.........................p...e............0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16832
Entropy (8bit):	6.373000673408678
Encrypted:	false
SSDEEP:
MD5:	6B7B21610F059F2C68BAE34BDD5F563A
SHA1:	988A21E37C0146EC11B9727E650F399460AFEEEA
SHA-256:	DBC67D9F442328D6C51EB1C4E9B462B2FFC7D5A91AD339865085E15F5C486C85
SHA-512:	1B3E44F961666091A5A51698EDB89A98589C5C3831524BD7410F2598E30EA70BDBC31A07A2F30F9F18009899FC309DC725CAE2F2C2589D4CF8CC8C75C2528828
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L..................!.........................0...............................P...........@.........................p................@............... ...!..............T............................................................................text...5........................... ..`.data...@....0......................@....rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18376
Entropy (8bit):	6.284863204565395
Encrypted:	false
SSDEEP:
MD5:	C60AB26638567B7822A443D6F26E2684
SHA1:	928BDB393737EA19E75CA8F8AD5EE1805308C039
SHA-256:	4C1A28D7B1DB81EDEF66411B32FB7A95E875B6B56D91C22B9EFBB79C9C5740A5
SHA-512:	AFF933EE546B5AEF6CEE9C61B483320006C5A5B536C887A9EDE5F5937B3B5B49F73877A6913EF4D24863DD81DA5C0C42CA2916228E0F001B5B49E19CAC478DE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...3............!.........................0...............................P......^X....@.........................p................@...............&...!..............T............................................................................text...O........................... ..`.data...@....0......................@....rsrc........@......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14280
Entropy (8bit):	6.553268737920515
Encrypted:	false
SSDEEP:
MD5:	1DC68969E07D2C6EB70A8727562FD4FC
SHA1:	AEF136D108BBC2D10E71EF32A38A8622125B60FF
SHA-256:	B60A7E496775AA4D68AF0A6665EE9B003D509AA83D6F23AFC5D0965023E09C16
SHA-512:	2487D3A3A305CAE19E8481778D360889ABE183C2A86A8236C3468378C2F69F4CFEC4CCD04457BD6B2F7D2288E625C1F205CF3D4B16F30B89CB612EBFCEFD6061
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..L...,.zo...........!......................... ...............................@............@.........................`................0...................!..............T............................................................................text............................... ..`.data...@.... ......................@....rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5100032
Entropy (8bit):	6.746317671701728
Encrypted:	false
SSDEEP:
MD5:	2CA7E2B4C97528701818521A38ACC7AB
SHA1:	8A8276CC9D7182026AE13B07B4304383FA9E406C
SHA-256:	0AAF7A579E4FD263AD5F83E934DF6A2D6487DD3CEB5D63DCB99FB96FA3160DC9
SHA-512:	2A41DE9E335AD7484FFB0943C4C46F2D16EF6288582434DA0FAA87DB29AB57F5385E4759BF4B61F373CD37B43A703742FCC1A0BB95F5DFBA4EA109C435DE6FD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[....y...y...y....a..y.......y.......y.......y.......y..p....y...y..={.......y......lz...y..y.......y.......y..Rich.y..........................PE..L....o_f.........."!...'.,=...........;......@=...............................N...........@..........................RJ.p...PSJ.\|............................0K.@...0.H.T.....................H.....p.H.@............@=.h............................text....*=......,=................. ..`.rdata...2...@=..4...0=.............@..@.data.........J......dJ.............@....reloc..@....0K.......J.............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2228256
Entropy (8bit):	6.104954247326777
Encrypted:	false
SSDEEP:
MD5:	AAD424A6A0AE6D6E7D4C50A1D96A17FC
SHA1:	4336017AE32A48315AFE1B10FF14D6159C7923BC
SHA-256:	3A2DBA6098E77E36A9D20C647349A478CB0149020F909665D209F548DFA71377
SHA-512:	AA4B74B7971CB774E4AE847A226CAE9D125FADC7CDE4F997B7564DFF4D71B590DCBC06A7103451B72B2AFE3517AB46D3BE099C3620C3D591CCBD1839F0E8F94A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g ..#A..#A..#A..*9..7A..q)..!A..q)..)A..q)..)A..q)..)A..x)..(A..#A..A..(..\C..(.."A..(m."A..(.."A..Rich#A..........................PE..L......^...........!.................H.......................................p"......s"...@.........................0]..hg...5!.T....`!.\|.............!. ....p!......A..8............................A..@............0!..............................text.............................. ..`.rdata...$.......&..................@..@.data...4Y.... ....... .............@....idata..h....0!....... .............@..@.00cfg.......P!....... .............@..@.rsrc...\|....`!....... .............@..@.reloc..i....p!....... .............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	537632
Entropy (8bit):	5.756439581249174
Encrypted:	false
SSDEEP:
MD5:	697766ABA55F44BBD896CBD091A72B55
SHA1:	D36492BE46EA63CE784E4C1B0103BA21214A76FB
SHA-256:	44A228B3646EB3575ABD5CBCB079E018DE11CA6B838A29E4391893DE69E0CF4B
SHA-512:	206957347540F1356D805BF4A2D062927E190481AADC105C3012E69623149850A846503FCA30FC38298F74D7F8F69761FDDD0AA7F5E31FEDB1FA5E5C9DE56E9D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D1...P.K.P.K.P.K.(uK.P.KR8.J.P.K[8.J.P.KR8.J.P.KR8.J.P.KR8.J.P.K.9.J.P.K.P.K.Q.K.9.J,P.K.9.J.P.K.9.K.P.K.9.J.P.KRich.P.K........................PE..L......^...........!.........................................................`......{.....@..............................N..............s............... .... ...5..@...8...........................x...@............................................text............................... ..`.rdata...g.......h..................@..@.data....;...p...6...Z..............@....idata..3A.......B..................@..@.00cfg..............................@..@.rsrc...s...........................@..@.reloc..)=... ...>..................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\_version.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.881064907741125
Encrypted:	false
SSDEEP:
MD5:	8CCCC1274F3C75EA3ADAB44E0D07CE7F
SHA1:	E39ECC4A5148BD6825A030B2AB35252F2A6461AC
SHA-256:	6E7C0CF2ABD1C1D7A4887CF9F8EBFABC03C9753AD9BB9F3B16ABD43BAB957B2F
SHA-512:	0C5CCB409F0D70B33A5B7E921B021628483AB0D0D39BBE569816BFA102D585DF3BE15AB8491A2F45043BFF5EF6BC77C3AAEAC0EEDB029A1E48C70B599BEEEEE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../R..N<..N<..N<..6...N<...=..N<.&=..N<...?..N<...9..N<...8..N<.x'=..N<..N=..N<.^.4..N<.^.<..N<.}....N<.^.>..N<.Rich.N<.........................PE..L....1._...........!......................... ...............................p............@.........................P%..\....%..d....P.......................`..X....".............................. "..@............ ..\|............................text............................... ..`.rdata..8.... ......................@..@.data...x....0......................@....gfids.......@....... ..............@..@.rsrc........P......."..............@..@.reloc..X....`.......$..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\lz4\block\_block.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	6.401737186239046
Encrypted:	false
SSDEEP:
MD5:	E36FE48EA61B8B16527B1C9D03F4D290
SHA1:	0AAC06A317C7037895B7A07116417BF58A2A9577
SHA-256:	585185C0DF46BE01A538FD435A0CDA64A644022DCA82B1673F89D44816F0099D
SHA-512:	3A3D4CCC895036F40A289AEFB73AAD038209778668D71D10EE6A3378148335A501BF0632335DFFDF74B3EDAD662E49756CCFE257510625BD0CCE2AFC1F19EAF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........EG.r+..r+..r+......r+..,..r+.....r+..,(..r+..,...r+..,/..r+.:...r+..r..r+..,#..r+..,+..r+.?,...r+..,)..r+.Rich.r+.........................PE..L....1._...........!.....&..................@............................................@.........................PG..X....G..x...............................d....D.............................. D..@............@...............................text....%.......&.................. ..`.rdata.......@.....................@..@.data........P.......8..............@....gfids.......p.......H..............@..@.rsrc................J..............@..@.reloc..d............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\main.exe.manifest

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	5.275985339055138
Encrypted:	false
SSDEEP:
MD5:	CA7F091FB148F315F9BC345B52D213B2
SHA1:	02854D1DB2A237935A483DDB0ACA38E83FFEEFA0
SHA-256:	56149FA3B65314B976DA333FCAB5F6ABCE825D4AD1D6EB63EA477C297C4A143F
SHA-512:	352BEE98987E6F887D937C45E26A23786075597559D1DA89453A707650528B3496503D53589722EFC0A906769A81B7C83474A70D737601FEB7B9F16DEA6D10A7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="main-patched" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">.. <security>.. <requestedPrivileges>.. <requestedExecutionLevel level="asInvoker" uiAccess="false"/>.. </requestedPrivileges>.. </security>.. </trustInfo>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="" name="Microsoft.Windows.Common-Controls" processorArchitecture="" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e

C:\Users\user\AppData\Local\Temp\_MEI46802\mfc140u.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4444320
Entropy (8bit):	7.080080542206874
Encrypted:	false
SSDEEP:
MD5:	EC85D7A09109D1F52F165CFBA6DB8B33
SHA1:	BCC0A43BEA8E4D0DB781F417CC2FAEFBB034BD36
SHA-256:	CFBA55B3D6891A0F9E90726094DC4E57553C3443CEF156E5FFCD5965AC4E8E3F
SHA-512:	446B9B56B89730DCB891701C28D8B2C6666A924C0A908FDEA386E139A6392AFD7B69FD4BF5DBC20308BAED7897FDA23777798FDF2B10291F954EED10935CFB8B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......A..Q.t...t...t...q..t...n..t...o..t...p..t....-..t..k/...t..k/...t..k/...t..k/...t...#...t...u..t...t...w..k/...u..k/...t..k/A..t..k/...t..Rich.t..................PE..L...$K<V.........."!......)..................`)...............................C.....(.D...@..........................^..L...........0+...............C..>....@.......).T...............................@....................)......................text...M.).......)................. ..`.data.........).......).............@....idata..zS......T.................@..@.tls......... +....................@....rsrc........0+....................@..@.reloc........@.......@.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\psutil\_psutil_windows.cp37-win32.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61952
Entropy (8bit):	6.398422616773887
Encrypted:	false
SSDEEP:
MD5:	43A66AA75039BFA7AF0D0026A603DDD9
SHA1:	D1DAB6108CFBBAD53E1054144E5C52FC00B508FA
SHA-256:	0F42C8F5EE147C3EE6B2EDCFB91DAF5D6F1209375D97E61C189FC32EAFAC4697
SHA-512:	ADFB1463B2D5A9BF13838B131D0827E17F005533DDA9010EF50874A626D7514C60059A06C01348AD75017E5AB0B5AA955E6A6A2AC4EED0E5422B6F3EB5682D13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........]..]..]..T.3.Q..f..._..f...^..f...V..f...V....._......N..].......Q....\..._.\....\..Rich]..................PE..L....#L^...........!.........^...............................................0............@.........................`...h......h............................ ......................................0...@............................................text............................... ..`.rdata..............................@..@.data....-.......*..................@....gfids..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	162320
Entropy (8bit):	6.65421740486783
Encrypted:	false
SSDEEP:
MD5:	187CDD3E6152D56986BB523C3A0F7D3E
SHA1:	ACA59C23E4E4974C37378BC7A2F365467E25C245
SHA-256:	7F22B82BFFB4BD87C8C5DC3357C25B5714264B46CE05F6DC8C1FC4C579DCA5FD
SHA-512:	C0612FB2F5D560055FFB3EC239DD4A8B06EDECE59E1C35AF2DA0E5D142643E6FC22FF4F1255CD620092D59958F758B790331163869480AA416026C374193C952
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P/h.1A;.1A;.1A;.I.;.1A;.o@:.1A;.oB:.1A;.oD:.1A;.oE:.1A;.o@:.1A;.Y@:.1A;.1@;.1A;.oI:.1A;.oA:.1A;.o.;.1A;.oC:.1A;Rich.1A;........PE..L...@.:_...........!................(...............................................Y.....@..........................*..P....+.......p...............`...............&..T...........................8'..@............................................text............................... ..`.rdata...F.......H..................@..@.data........@.......&..............@....gfids.......`.......4..............@..@.rsrc........p.......6..............@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58896
Entropy (8bit):	5.838216038576758
Encrypted:	false
SSDEEP:
MD5:	167EBEFCF1A2CB0CE7F4118FE826F58B
SHA1:	5D532467D78DCC2B63848452C4F600513B4136CF
SHA-256:	112C98099E5E6156A8844C6C39B2136F3146E1F2221C37B9064AB7AF6FDFABB7
SHA-512:	BCD67BF4F7E5ADBD8E06A28FE3F805F79323369FBE3F37D32A513AA0336F6FFD4E1C7D978FA0480742BA1AE5D91CEB2E255E9D7033D00670E738335387F92E22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5H..q)d.q)d.q)d..wl.p)d..wd.p)d..w..p)d..wf.p)d.Richq)d.........PE..L...,.:_...........!......................... ............................................@.........................` ..,............................................ ..T............................................................................text............................... ..`.rdata..T.... ......................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\python37.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3441168
Entropy (8bit):	6.692336437440565
Encrypted:	false
SSDEEP:
MD5:	465089EACED8159EC533E4A37033E227
SHA1:	074596ADAE6F53F33B8297F02E21F6A6F7AC6FF1
SHA-256:	2B29AE140CB9F08AF872ACF9E17F785EF99398EF3367549B55242BC064D6AE40
SHA-512:	55ECA0922074162C22FFF2B4F97BD2972540FA893B9B02B7D9BFA26345186DBBDAF1FBC37A9EBA6366743D0D42FB5BB88E708877DFD57CB02CA4D3A6953CFB81
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........->..LP.LP.LP.4..LP..Q.LP.4..LP..S.LP..U.LP..T.LP..$Q.LP.LQ..MP...X.jLP...P.LP.....LP...R.LP.Rich.LP.........PE..L...".:_...........!.........D......-........................................P6.......4...@...........................+......,.\|....`4..............h4......p4.X.....+.T...........................(.+.@............................................text............................... ..`.rdata..<...........................@..@.data...`s....,.......,.............@....gfids.......P4.......2.............@..@.rsrc........`4.......2.............@..@.reloc..X....p4.......2.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\pythoncom37.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	407040
Entropy (8bit):	6.538898063390376
Encrypted:	false
SSDEEP:
MD5:	E7013CC99216383D1722136870282AA0
SHA1:	0596196D7FE24CA6E19D21102275BF6E972DBDEC
SHA-256:	2CFF7BFF664EE5FFD3DD073F08F88FD18C37042B280305465AF8AE6EF2827E76
SHA-512:	2DB3840F5B1D5B3B14D6FAA4B5F4DC7BF8B2B5AD5273C20FD79ABD74FDABDD6A314B84E6EAE8496C38FACF34B13E00C149F0AA05CFC6478D93DE9920B26DC302
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.;u..U&..U&..U&...&..U&g.T'..U&g.V'..U&g.P'..U&g.Q'..U&.].&..U&..T'..U&.].&..U&..T&@.U&..P'X.U&..U'..U&..W'..U&Rich..U&........PE..L......]...........!.....n...........W............ .......................................@.........................@....`..Pl.......`..\....................p..8q.....T...........................(...@...............T............................text...zl.......n.................. ..`.rdata...............r..............@..@.data...0........:..................@....gfids..L....P......................@..@.rsrc...\....`......................@..@.reloc..8q...p...r..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\pywintypes37.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.528675006294188
Encrypted:	false
SSDEEP:
MD5:	FFD5FAC26740C3975AF8112827D724C3
SHA1:	58BDDB3ECD15A04C2B402A7091D9D57325B073F7
SHA-256:	0315EE7826F735A72D2208B46F5CEBB270E5F1FE3104A4B007ACA5C813EEF2A3
SHA-512:	2105388344C8D7B7B48130584186E585E718FE55FEA627C4CD70EAF46D4E8ACF4431F55BF6619F8708589D4D0BA7ECB1B1848AB763C553BADAF33214C12BA73C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%.XyK.XyK.XyK.Q..TyK.6"J.ZyK....YyK.6"H.ZyK.6"N.IyK.6"O.SyK.....YyK.."J.ZyK.....SyK.XyJ..yK.."N.UyK.."K.YyK.."I.YyK.RichXyK.........PE..L...[..]...........!.............................z.......................................@.........................P5...E..dz..........d.......................\....*..T...........................8+..@............................................text...u........................... ..`.rdata..............................@..@.data...............................@....gfids..L...........................@..@.rsrc...d...........................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23568
Entropy (8bit):	6.3163367160293795
Encrypted:	false
SSDEEP:
MD5:	D3BF89184B94A4120F4F19F5BCD128D6
SHA1:	C7F22BB0B957BD7103CF32F8958CFD2145EAA5B8
SHA-256:	568EFDC33F1FCC1AF1D030C75FCCEDC2D9B1FCBF49C239726E2CF49D47ADD902
SHA-512:	1DA8EBF323D170C5E9F6BFBB738E60119CCC690A08234DD23F2D9C1A33519FD4AD154805B012CCA3DC7565BEE672D334CA877AFE2B5211E2122DD6E1CE337971
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'...Fb..Fb..Fb..>...Fb...c..Fb...a..Fb...g..Fb...f..Fb.+.c..Fb...c..Fb..Fc..Fb.+.j..Fb.+.b..Fb.+....Fb.+.`..Fb.Rich.Fb.........PE..L...>.:_...........!...............2........0......................................NL....@..........................5..L....5..x....`...............B.......p..t....1..T...........................(2..@............0...............................text............................... ..`.rdata..8....0......................@..@.data...p....@.....................@....gfids.......P.......0..............@..@.rsrc........`.......2..............@..@.reloc..t....p.......>..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	985616
Entropy (8bit):	6.750787193290997
Encrypted:	false
SSDEEP:
MD5:	68FCAE2F9BDB38FDFA4E7826A45A494E
SHA1:	8A3C69F5D9140B07A8FCF578CE479CD4B1295003
SHA-256:	9DC0373E28A45187528591A3ED0EABC4C4A2A6D3EEB8E38C3F451FC11D9E5B48
SHA-512:	8E916967FC1995A68DE2CDF878AC4C5A5C16F226D92B78CE1BB30047F9E6834886791CF7B7F03485AEC5AC0D31DBBA28DEEF2354B1B18D58FD798473F12759C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*...n...n...n...g.3.b...U..l...U..c...U..e...U..e...5.m...n..........o......o....._.o......o...Richn...........PE..L...L.:_...........!.....0..........o........@............................... ......GM....@......................... M..l ...m..................................P\..@I..T............................I..@............@...............................text............0.................. ..`.rdata..X8...@...:...4..............@..@.data................n..............@....gfids..............................@..@.rsrc...............................@..@.reloc..P\.......^..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1117640
Entropy (8bit):	6.790099637219717
Encrypted:	false
SSDEEP:
MD5:	C61E2D171A51D54A7118745E3689484C
SHA1:	55D47CD4EBEF483C4812B880573362A88857D89D
SHA-256:	903DB0B165960955E9AF1415D1FFF4F395021FA041B49D542491EAA272C94CA6
SHA-512:	DD62D18EC54D67A2E41BD0AD30DB4C4711CD9CF579FB16702300734ED40C7E834EE08E265733159FA42CE9065859B313004B61814E9436B0832120B992A7C02F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0<..t]..t]..t]..}%..G]..t]...].../..u].../..b].../..u].../...].../..*].../..._.../}.u].../..u]..Richt]..........PE..L.....4............!.....,...................@............................... ...........@A.........................^......tb...........................!.........\...T............................"..@............`..p............................text...0+.......,.................. ..`.data...<....@.......0..............@....idata.......`.......@..............@..@.rsrc................V..............@..@.reloc..............\..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063440
Entropy (8bit):	5.335145703200824
Encrypted:	false
SSDEEP:
MD5:	22EE48112415EE74C80B66CC1A8E1CA8
SHA1:	9EB11B06BA0EA22A2F339D0CE300F45F48607D4C
SHA-256:	8F38B8891C74DA4AF150B60D21053CDA95A61881C61B8FFF1C8852885DE8B2AF
SHA-512:	080DA19FCBFCFDD55BCCF231F6F4820204707AE3A08DE7E40CE8E1F87DF1EDD916FD55A37E6560C1E1A6935DDC42D47DCE82AA834A8287B024D907CC9B98B3CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,F..B...B...B......B..C...B..A...B..G...B..F...B.u.C...B...C...B...C...B.u.J...B.u.B...B.u.....B.u.@...B.Rich..B.........PE..L...?.:_...........!.....4...........4.......P...............................`......V.....@..........................Q..X...HR.......@............... .......P.......N..T...........................XN..@............P...............................text...N2.......4.................. ..`.rdata.......P.......8..............@..@.data...(....`.......B..............@....gfids.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32api.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	6.4361136309732165
Encrypted:	false
SSDEEP:
MD5:	86E4FE10195511F403A8C2DE45BB8062
SHA1:	79CD2CC3D5165078145106A284C11B4B85CCB037
SHA-256:	4C28231D0105AF47E3D7C7241B5EC50FCBFB3E8B60D68A0DBE8180BD543B3856
SHA-512:	65A7949EC63D1E1D34093753F05341E51911B74C5C7D4554CF2EE8626333E6460AF0B3A4F5780B7CB3C5E7EDE1410F907F947542383D7660E0AF6AFAB606928C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z.\w..\w..\w..U...Zw..2,..^w..2,.._w..2,..Ww..,..Xw..2,..Nw.....Ww..\w...v..,..^w..,..]w..,..]w..Rich\w..........................PE..L...}..]...........!......................................................................@......................... I.......I..........T...........................pA..T............................@..@...............0....H..@....................text............................... ..`.rdata...~..........................@..@.data........p.......\..............@....gfids..L............n..............@..@.rsrc...T............p..............@..@.reloc........... ...t..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32com\shell\shell.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388096
Entropy (8bit):	6.700427480647071
Encrypted:	false
SSDEEP:
MD5:	88BBC2850F3C74A35DD768605F7BAE02
SHA1:	3C9AE4DFC4C5AE06917B9735BCDE78611FFC04C6
SHA-256:	998E24ED4A8D2840BBEED542B2582CBC7E69996D8A38C7E8DC3FA2A39BDEA2B7
SHA-512:	6CFF11204620A2B09CAC2ACA34B0A37F3CB4BFCAD239727A4E68A2E37C097CDA72F927BA11134F3FC968A8FB218F47618C10FF460CC96E85022B344993D2DBFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.q.!.q.!.q.!..m!.q.!.. .q.!.. .q.!.. .q.!.. .q.!<.0!.q.!3. .q.!<..!.q.!<.5!.q.!.q.!.q.!3. .q.!3. .q.!3. .q.!Rich.q.!........PE..L......]...........!.....$..........C........@...............................`............@.............................I...............D..........................p...T..............................@............@...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...8o...@...8...&..............@....gfids..L............^..............@..@.rsrc...D............`..............@..@.reloc..............d..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32gui.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	173568
Entropy (8bit):	6.42950791869676
Encrypted:	false
SSDEEP:
MD5:	E784B34CA391EE4495DA3CDEB2F97B93
SHA1:	9236ED916AE35D73DD55A074E2DDB1993A5B7A9F
SHA-256:	4E0BF38971FD03795DE66011D6F59D9913817BAF5EA4F386A0187C2633A609AE
SHA-512:	4E1621813C0ABA7188FCFEEF820E2C45A593DD6EE9C99AAEED18EADE4CCCB2E86264338C8831044C5BA7453C0F5588E83D97B2B8202F0B3A9E04BB2E933FCE11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................&............................u......z?~...........u......u......u......Rich............................PE..L......]...........!......................................................................@......................... ..e..............T........................9...!..T...........................X!..@............................................text............................... ..`.rdata.............................@..@.data...( ...`.......H..............@....gfids..L............f..............@..@.rsrc...T............h..............@..@.reloc...9.......:...l..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32process.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	6.286431013062985
Encrypted:	false
SSDEEP:
MD5:	BF174C9368C4FB71BC5741AC6DB9FEAF
SHA1:	DCED12BC182EB8AF95E1ABBFEA04FDACA3091A5D
SHA-256:	A60242ADA93FD9F215B47132C1F05B2666C821114CFBD733EFB2B08CFF27B76D
SHA-512:	B98A84AD170BDDA4B663088C139ACC82E2B19F27FEA760BAF759DDBCD90AF803A535D594C268875BF42C5DF137F61513F83BAF3AAB8F3CD345076EC2643D9997
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~x..............g.......D.......D.......D.......D.......D......................D.......D.......D......Rich............PE..L...p..]...........!.....P...P.......N.......`............................................@.............................W...............d...............................T...........................X...@............`...............................text...PO.......P.................. ..`.rdata...7...`...8...T..............@..@.data...0...........................@....gfids..L...........................@..@.rsrc...d...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32security.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	6.4607057274585875
Encrypted:	false
SSDEEP:
MD5:	0244DA7420CAA3CFB72517D31A3C8396
SHA1:	E4515EFE9DDD49EBC7898B763153A65295F6B5CF
SHA-256:	EEF7C6C4D010C557632C1C6E3E2345BFA53820DBE357AC893235F9DA72C88895
SHA-512:	9A8248C1935B5EEBCC7EF87B16ED7E7A32CFA26B50D9449792E8EBC8A90D31C08682AE5879346BAE54BBB0423D9F4B161A42447F796217D3E331082FEDEE2F2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sqX27.6a7.6a7.6a>h.a1.6aYK7`5.6aYK5`6.6aYK3`9.6aYK2`<.6a.K7`3.6a...a>.6a7.7a..6a.K3`4.6a.K6`6.6a.K4`6.6aRich7.6a........................PE..L...t..]...........!................1.....................................................@..........................}.......~..........d............................r..T...........................(s..@............................................text............................... ..`.rdata..............................@..@.data...............................@....gfids..L...........................@..@.rsrc...d...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32trace.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.767125323911372
Encrypted:	false
SSDEEP:
MD5:	DE4E97F1B623FE3500D184E3255FEEEF
SHA1:	FC4D1EA415326BBA20F731907C71D32503CC3D31
SHA-256:	0DAC5B82544CE0D358CE20599CA2D8159D1BF004DA9224F3788C44EF1A91A3DA
SHA-512:	B34A52FAC8C50D369F4134C2C328A745E7232C6470459C4156F6F6B1EC2476FD53551CD8B02217918396D8413525BE8CB92325BECF829D9CBC0CB4521F8FAE1F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...............\|X......_......._......._......._......)_......&...............)_......)_......)_......Rich....................PE..L...u..]...........!.....$...$.......$.......@............................................@..........................J..S...DK..........\............................F..T...........................HG..@............@..@............................text...J".......$.................. ..`.rdata.......@.......(..............@..@.data........`.......<..............@....gfids.......p.......@..............@..@.rsrc...\............B..............@..@.reloc...............F..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32ui.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1149952
Entropy (8bit):	5.776088209653105
Encrypted:	false
SSDEEP:
MD5:	E4D758B4BFA5EDAB1DAAB070F79A6233
SHA1:	2BDCA17683F5EF18A5593551CE5A6FDB6A364A23
SHA-256:	DD528DC7146A0CA6C4C210D1F91278926FBEE5EBEDF1144750751FF47CB3188D
SHA-512:	4FA2E552880D217CC24247377DF11B96836F4916200CAC50BD1AEFD2F8F6DF120B6D5E0C1A62CD081D165ED09A035554E6212BA0DA740D4B6734696601DEB459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u8...V...V...V..l...V.>MS...V.....V..OU...V..OR...V..OS...V..OW...V..OW...V...W.6.V..OS...V..OV...V..O....V..OT...V.Rich..V.........................PE..L...T..]...........!................. ............(.......................................@......................... ...2Q..T...h...............................8.......T..........................h...@............................................text............................... ..`.rdata..lI.......J..................@..@.data...d.... ...^..................@....tls.................^..............@....gfids..(............`..............@..@.rsrc................b..............@..@.reloc..8............\|..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI46802\win32wnet.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	6.152062338900863
Encrypted:	false
SSDEEP:
MD5:	EB7BE654FA6D098BB44D30CEF66915C9
SHA1:	2FA98324E316CC96F1F5DE46372892CD5684CC6A
SHA-256:	6E07E288DFBFEA22B8349B20ED955898B4B1DE9D7EA837985553D813FA13D921
SHA-512:	81CA7F475E3287EE210709527754ACA3AA96B50665C78E4DB1C729E17E9506B0DFDBD16FC31F4A17E8FEF90F929DAB75AAB39AAF8D66786D7941F78AF2DB441C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%T..D:..D:..D:..<...D:...;..D:...9..D:...?..D:...>..D:.d.;..D:.k..D:..D;..D:.d.?..D:.d.:..D:.d.8..D:.Rich.D:.................PE..L...w..]...........!.....6...:.......5.......P............................................@.........................@d..#...di..........T........................... \..T...........................x\..@............P...............................text....5.......6.................. ..`.rdata...%...P...&...:..............@..@.data...0............`..............@....gfids..L............f..............@..@.rsrc...T............h..............@..@.reloc...............l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ncchiimh.c4p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\system15627a17808b7546c

Download File

Process:	C:\Users\user\Desktop\decrypt.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16990381
Entropy (8bit):	7.997367892243842
Encrypted:	true
SSDEEP:
MD5:	6FCA51D1E24BDCB68A20F6D9A445E96E
SHA1:	F30DCD2DB2F6EB09E2A811A1DCFA100C7AAC57E6
SHA-256:	25BFA19B6C1C93818329306066D240B41CDE3FF4F3063C7310CAB619C06655E1
SHA-512:	9BF28BEB35B9D4098D43420E5ADBA156FEBE04413A2D122EAE2843AD933A79D302E99BD167E8F7327AFE704D58E8DD7CBF70875FFE340814C6D6AF6AEAA0C823
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ..A..A..A....A.....A.....A...8..A.a5...A.a5...A.a5..A....A..A..A.b5...A.b5..A.Rich.A.........................PE..L....%.a.........."..........................0....@.......................... ......ya....@.................................d...<.......X...........................................................8...@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp07v8c5ym\gen_py\init.py

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.713840781302666
Encrypted:	false
SSDEEP:
MD5:	8C7CA775CF482C6027B4A2D3DB0F6A31
SHA1:	E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
SHA-256:	52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
SHA-512:	19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
Malicious:	false
Reputation:	unknown
Preview:	# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

C:\Users\user\AppData\Local\Temp\tmp07v8c5ym\gen_py\dicts.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	data
Category:	dropped
Size (bytes):	11
Entropy (8bit):	2.9139770731827523
Encrypted:	false
SSDEEP:
MD5:	7D60C03264BFC8080355775EF16397EA
SHA1:	713B57F2F873E930C1FDAF17718749FCDF212961
SHA-256:	48BA2619D546477FD8624E27AFEA42F6CD0A72B1C5435F8B5D40CC082ADBD81C
SHA-512:	00A341DAD0CA02B65B19A9122F242388F6503E382A90651A21B6A16D8867D1D09149C292B0DB8E85A23EB941120749E6853A0392D756DE0141FC4006A847CACB
Malicious:	false
Reputation:	unknown
Preview:	..K....}q..

C:\Users\user\AppData\Local\Temp\ugx49rj2

Download File

Process:	C:\Users\user\AppData\Local\Temp\system15627a17808b7546c
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Reputation:	unknown
Preview:	blat

C:\Users\user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	87
Entropy (8bit):	4.398074715615676
Encrypted:	false
SSDEEP:
MD5:	A835E8E7ADA925AB8F97CB60E55F00E9
SHA1:	A985A0D33E48296328C7F4435811AE7F05808F6D
SHA-256:	A510DAAB4A23B263367AAA96AB781AFCF48AA85D8BC97F167B861C2A4F1AD5D0
SHA-512:	EC1BAE4308C427DE2775D7CFD536B7BB1FB085970D156BDCBE4EF7C58FD48FB76E6806CE8F9D6314C9CC008D78BF06ECF4165370E1BAE37FF802F55D6EA87893
Malicious:	false
Reputation:	unknown
Preview:	cd Desktop...\decrypt.exe --safetorun -a...\decrypt.exe --safetorun -x --channel=1 -a..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	7F2E7A9300DDAA4FD1A8DF69B847C878
SHA1:	1820F2ACED77EF58BC6026416508294B13FF7216
SHA-256:	DBFA5754F0F4FC5AFA5C31F4D354D3EDD513AA96A0F2D599D4EC4BBDDE0CD657
SHA-512:	607509F550633AFF4842CCE38C0E465FC694F2C5C4EFF1BFF3412E0D2A2593F5F14D8775461E8453D1F49B40C78BFD71FB3154A4AAE8AF0965A9B3E76B324A44
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F. .. ......{4...nV.H.[..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4...! h:.[.....H.[......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H.Y<...............................A.p.p.D.a.t.a...B.V.1......YE...Roaming.@......FW.H.YE...........................M...R.o.a.m.i.n.g.....\.1......YA...MICROS~1..D......FW.H.YJ...............................M.i.c.r.o.s.o.f.t.....V.1.....GX+w..Windows.@......FW.H.Y<...........................T...W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H.Y<.....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....FW.J..Programs..j......FW.H.Y<.....................@......!r.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H.YQ...........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H.YP.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VPMSMTIUW93G8N0ZV4S4.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	3.937857383589843
Encrypted:	false
SSDEEP:
MD5:	7F2E7A9300DDAA4FD1A8DF69B847C878
SHA1:	1820F2ACED77EF58BC6026416508294B13FF7216
SHA-256:	DBFA5754F0F4FC5AFA5C31F4D354D3EDD513AA96A0F2D599D4EC4BBDDE0CD657
SHA-512:	607509F550633AFF4842CCE38C0E465FC694F2C5C4EFF1BFF3412E0D2A2593F5F14D8775461E8453D1F49B40C78BFD71FB3154A4AAE8AF0965A9B3E76B324A44
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F. .. ......{4...nV.H.[..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4...! h:.[.....H.[......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H.Y<...............................A.p.p.D.a.t.a...B.V.1......YE...Roaming.@......FW.H.YE...........................M...R.o.a.m.i.n.g.....\.1......YA...MICROS~1..D......FW.H.YJ...............................M.i.c.r.o.s.o.f.t.....V.1.....GX+w..Windows.@......FW.H.Y<...........................T...W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H.Y<.....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....FW.J..Programs..j......FW.H.Y<.....................@......!r.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H.YQ...........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H.YP.....Q...........

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.999291651537833
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	decrypt.exe
File size:	17'126'992 bytes
MD5:	0a08cc3661a39defcdc182acf62e17e5
SHA1:	580ccc43274151726405797779500f4fe9a0069c
SHA256:	db433f673eeacd8e905cca9ef3b283d30c466ab6afde31e53373197ee5d197fd
SHA512:	f083ccd34621c685bc05094197a8dc2f7d795a124da67eb351c1b89f74848787d9408eca7ed9b0c34f5c0d564bf766842d0cb316bc4b7141a65b397b69a62aca
SSDEEP:	393216:cYvwa/xPKBtFlFk5zb91woDQGQ3bNkpmVqehJGFsxQrnkvDKZwdp5t:H4BNMvbcGAbNZVqnsxQbUDT9
TLSH:	3807335AF5D004F1C5E12C37D935A6C2C437E471EAC44A8F0A1BDF6AA858C578BE9DC2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f..."..."...".......................6.......!..."...~.......7...............1.......#.......#.......#...Rich"..................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401b19
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676C5FDC [Wed Dec 25 19:41:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	eeb9c59be65b5a0861a842d1f49817b3

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	26/04/2024 07:49:24 27/04/2025 07:49:24
Subject Chain	E=huddafoods@gmail.com, CN=HUDDA FOODS (SMC-PRIVATE) LIMITED, O=HUDDA FOODS (SMC-PRIVATE) LIMITED, L=Multan, S=Punjab, C=PK, OID.1.3.6.1.4.1.311.60.2.1.3=PK, SERIALNUMBER=0168969, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	EA00C257C7591CBB2D3B03B8533EF338
Thumbprint SHA-1:	02FED651B2EADA8963E95644141336451C2337A7
Thumbprint SHA-256:	7802DF46CED02B95DE7ED3BCDEDE905DE86063BB916F4CDCDF96B342E45D4050
Serial:	3E47D172255BDBB3E93C5E9D

Entrypoint Preview

Instruction
call 00007F7BE4C74D32h
jmp 00007F7BE4C7494Dh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F7BE4C74ADBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F7BE4C74ACCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F7BE4C74ACEh
add edx, 28h
cmp edx, esi
jne 00007F7BE4C74AACh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F7BE4C74ABBh
call 00007F7BE4C75208h
test eax, eax
jne 00007F7BE4C74AC5h
xor al, al
ret
mov eax, dword ptr fs:[00000018h]
push esi
mov esi, 00420CD8h
mov edx, dword ptr [eax+04h]
jmp 00007F7BE4C74AC6h
cmp edx, eax
je 00007F7BE4C74AD2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F7BE4C74AB2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F7BE4C74AC9h
mov byte ptr [00420CF4h], 00000001h
call 00007F7BE4C7501Fh
call 00007F7BE4C75755h
test al, al
jne 00007F7BE4C74AC6h
xor al, al
pop ebp
ret
call 00007F7BE4C7A7C2h
test al, al
jne 00007F7BE4C74ACCh
push 00000000h
call 00007F7BE4C75766h
pop ecx
jmp 00007F7BE4C74AABh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0Ch
push esi
mov esi, dword ptr [ebp+08h]
test esi, esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f288	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x23000	0x1034188	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1054400	0x1250	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1058000	0x1178	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e730	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1e750	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x148	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17530	0x17600	4d5ef9cb5af9d6e8a15704d8b1f84091	False	0.5948466744652406	data	6.649482193956779	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0x69d4	0x6a00	9b93037de380aea158a165def431171c	False	0.4741303066037736	data	5.241989057939991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x1404	0xa00	d601f257916cc483f3395a69ee1bf181	False	0.205078125	data	2.532462717958198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x22000	0xe0	0x200	fbe2a9dec78d8c85aaa8f959b732e981	False	0.248046875	Matlab v4 mat-file (little endian) 4, numeric, rows 13, columns 16, imaginary	1.174631136579321	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x23000	0x1034188	0x1034200	50cc8e938460d62201756eaf15239236	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1058000	0x1178	0x1200	e9ffaae3e1492b75c038f6ef4ece8132	False	0.79296875	data	6.466494082879002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CUSTOMDATA	0x23080	0x1034108	data	English	United States	0.962071418762207

Imports

DLL

Import

KERNEL32.dll

Sleep, GetModuleFileNameA, GetModuleHandleA, LoadResource, SizeofResource, FindResourceA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetFileType, CloseHandle, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, MultiByteToWideChar, DeleteFileW, WaitForSingleObject, GetExitCodeProcess, CreateProcessW, GetFileAttributesExW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, CreateFileW, ReadFile, ReadConsoleW, HeapSize, HeapReAlloc, SetEndOfFile, WriteConsoleW, EncodePointer, DecodePointer, RaiseException

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report decrypt.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_decrypt.exe_1c69db41e74d944dfe4996f39dffe8a77355566_011ae4ae_91deea0b-35bc-4e95-82fc-dce9287c4a64\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78A5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78F4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7924.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imaging.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingcms.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingft.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_imagingtk.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\PIL\_webp.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_cffi_backend.cp37-win32.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_elementtree.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_multiprocessing.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_pytransform.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_sqlite3.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\_win32sysloader.pyd

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-louserzation-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-processthreads-l1-1-1.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-synch-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-core-timezone-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\_MEI46802\api-ms-win-crt-locale-l1-1-0.dll

Windows Analysis Report
decrypt.exe

C:\Users\user\AppData\Local\Temp\tmp07v8c5ym\gen_py\init.py